An extension installed at the version fixing a vulnerability is still reported as vulnerable

Problem

An extension whose id starts with org.xwiki.platform: or org.xwiki.contrib is listed in the Extension Vulnerabilities tab of the Security Vulnerabilities administration when its installed version is exactly the version in which the vulnerability was fixed. The entry is a false positive, and the administrator cannot make it go away: the advice is to upgrade, but the installed version is already the fixed one and can be the latest release.

Reported on the forum: https://forum.xwiki.org/t/on-plantuml-macro-security-vulnerabilty-report-for-release-2-4-1/18963

Steps to reproduce

1. On XWiki 18.7.0, install PlantUML Macro 2.4.1 (org.xwiki.contrib.plantuml:macro-plantuml-macro), for instance as a dependency of PlantUML Administration 2.4.1.
2. Enable the security scan and wait for it to run.
3. Open Administration > Security Vulnerabilities > Extension Vulnerabilities.

Expected: PlantUML Macro 2.4.1 is not listed, since CVE-2026-42140 (GHSA-42fc-7w97-8vrc) is fixed in 2.4.1.

Actual: PlantUML Macro 2.4.1 is listed with CVE-2026-42140 (4.4), and the advice is to upgrade the extension requiring it, org.xwiki.contrib.plantuml:macro-plantuml-ui/2.4.1, which is already the latest version.

Cause

Extensions with these ids are not on Maven Central, so OsvExtensionSecurityAnalyzer queries osv.dev without a version and OsvResponseAnalyzer filters the returned advisories against the installed version itself. OsvResponseAnalyzer#isInRange builds a Maven version range that is inclusive on both ends:

String range = String.format("[%s,%s]", introduced, fixed == null ? "" : fixed);

The upper bound comes from RangeObject#getEnd(), which returns the fixed event of the range and falls back to last_affected. In the OSV schema fixed is exclusive (the fixed version is not affected) and only last_affected is inclusive. Both are treated as inclusive here.

For this advisory osv.dev returns the events introduced: 0 and fixed: 2.4.1, so the range tested is [0,2.4.1], which contains 2.4.1. A query to osv.dev with the version 2.4.1 returns no vulnerability.

Other extensions are not affected, because for them the version is sent to osv.dev, which does the matching.

Possible fix

Use an exclusive upper bound when the end of the range is a fixed event, and keep the inclusive bound for last_affected. RangeObject#getEnd() does not say which of the two it returned, so that information has to be carried to isInRange.