Do not mix unrelated affected and fixed packages

[pombredanne]

In the UI and API, we should not mix unrelated affected and fixed packages. For instance for https://public.vulnerablecode.io/vulnerabilities/VCID-pst1-g1u7-aaan for CVE-2022-21704, the affected "pkg:npm/[email protected]" is surely not fixed by "pkg:deb/debian/[email protected]" ... these are related but completely different PURLs.

• "pkg:npm/[email protected]" MUST be fixed by a "pkg:npm/log4js"
• "pkg:deb/debian/[email protected]" must be fixing some "pkg:deb/debian/node-log4js"

For the UI, see:

• https://github.com/nexB/vulnerablecode/issues/1287

[pombredanne]

This has been implemented and fixed in the UI by @johnmhoran (Thanks!)

We still need to do the work in the API:

[TG1999]

Will fix this in V2 API.

[pombredanne]

The new API v2 has different semantics and is always by package therefore this does not apply there anymore. Closing now!