osv: skip results marked as "withdrawn"

CHANGELOG.md

@@ -8,6 +8,12 @@ All versions prior to 0.0.9 are untracked.
 
 ## [Unreleased]
 
+### Fixed
+
+* Fixed an issue where audits done with the OSV vulnerability service (`-s osv`)
+  were not correctly filtered by "withdrawn" status; "withdrawn" vulnerabilities
+  are now excluded ([#386](https://github.com/pypa/pip-audit/pull/386))
+
 ## [2.4.4]
 
 ### Changed

pip_audit/_service/osv.py

@@ -90,6 +90,12 @@ def query(self, spec: Dependency) -> Tuple[Dependency, List[VulnerabilityResult]
 
             id = vuln["id"]
 
+            # If the vulnerability has been withdrawn, we skip it entirely.
+            withdrawn_at = vuln.get("withdrawn")
+            if withdrawn_at is not None:
+                logger.debug(f"OSV vuln entry '{id}' marked as withdrawn at {withdrawn_at}")
+                continue
+
             # The summary is intended to be shorter, so we prefer it over
             # details, if present. However, neither is required.
             description = vuln.get("summary")

test/service/test_osv.py

@@ -244,3 +244,36 @@ def test_osv_vuln_affected_missing(monkeypatch):
     assert logger.warning.calls == [
         pretend.call("OSV vuln entry 'fakeid' is missing 'affected' list")
     ]
+
+
+def test_osv_vuln_withdrawn(monkeypatch):
+    logger = pretend.stub(debug=pretend.call_recorder(lambda s: None))
+    monkeypatch.setattr(service.osv, "logger", logger)
+
+    payload = {
+        "vulns": [
+            {
+                "id": "fakeid",
+                "withdrawn": "some-datetime",
+            }
+        ],
+    }
+
+    response = pretend.stub(raise_for_status=lambda: None, json=lambda: payload)
+    post = pretend.call_recorder(lambda *a, **kw: response)
+
+    osv = service.OsvService()
+    monkeypatch.setattr(osv.session, "post", post)
+
+    dep = service.ResolvedDependency("foo", Version("1.0.0"))
+    results = dict(osv.query_all(iter([dep])))
+
+    assert len(results) == 1
+    assert dep in results
+
+    vulns = results[dep]
+    assert len(vulns) == 0
+
+    assert logger.debug.calls == [
+        pretend.call("OSV vuln entry 'fakeid' marked as withdrawn at some-datetime")
+    ]