From b802c63ec3d3746d53eb4a1331bb97f6c32ffece Mon Sep 17 00:00:00 2001
From: Jess Lowe <jesslowe@google.com>
Date: Wed, 5 Aug 2026 00:21:26 +0000
Subject: [PATCH 1/2] fix canonical link issue

---
 vulnfeeds/conversion/common.go | 40 +++++++++++++++++++++++++++++++---
 1 file changed, 37 insertions(+), 3 deletions(-)

diff --git a/vulnfeeds/conversion/common.go b/vulnfeeds/conversion/common.go
index e2097ce5f2f..44cf9f98ead 100644
--- a/vulnfeeds/conversion/common.go
+++ b/vulnfeeds/conversion/common.go
@@ -145,10 +145,32 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 	unresolvedRanges := versionRanges
 	var successfulRepos []string
 
+	localCanonicalCache := make(map[string]string)
+	getCanonical := func(repo string) (string, error) {
+		if canonical, ok := localCanonicalCache[repo]; ok {
+			return canonical, nil
+		}
+		canonical, err := git.FindCanonicalLink(repo, http.DefaultClient, cache)
+		if err == nil {
+			localCanonicalCache[repo] = canonical
+		}
+
+		return canonical, err
+	}
+
 	claimedRepos := make(map[string]bool)
 	for _, vr := range versionRanges {
 		if vr.Range.GetRepo() != "" {
-			claimedRepos[vr.Range.GetRepo()] = true
+			canonicalRepo, err := getCanonical(vr.Range.GetRepo())
+			if err != nil {
+				if git.IsRateLimit(err) {
+					metrics.Outcome = models.Error
+					return nil, nil, nil
+				}
+				claimedRepos[vr.Range.GetRepo()] = true
+			} else {
+				claimedRepos[canonicalRepo] = true
+			}
 		}
 	}
 
@@ -160,7 +182,7 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 			continue
 		}
 
-		repo, err := git.FindCanonicalLink(repo, http.DefaultClient, cache)
+		repo, err := getCanonical(repo)
 		if err != nil {
 			metrics.AddNote("Failed to find canonical link - %s %v", repo, err)
 			if git.IsRateLimit(err) {
@@ -184,7 +206,19 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 
 		var stillUnresolvedRanges []models.RangeWithMetadata
 		for _, vr := range unresolvedRanges {
-			if (vr.Range.GetRepo() != "" && vr.Range.GetRepo() != repo) || (vr.Range.GetRepo() == "" && claimedRepos[repo]) {
+			vRepo := vr.Range.GetRepo()
+			if vRepo != "" {
+				canonicalVRepo, err := getCanonical(vRepo)
+				if err != nil {
+					if git.IsRateLimit(err) {
+						metrics.Outcome = models.Error
+						return nil, nil, nil
+					}
+				} else {
+					vRepo = canonicalVRepo
+				}
+			}
+			if (vRepo != "" && vRepo != repo) || (vRepo == "" && claimedRepos[repo]) {
 				stillUnresolvedRanges = append(stillUnresolvedRanges, vr)
 				continue
 			}

From b075f13a6f19ed8966970b195e41850c36f5e5b2 Mon Sep 17 00:00:00 2001
From: Jess Lowe <jesslowe@google.com>
Date: Thu, 6 Aug 2026 02:03:43 +0000
Subject: [PATCH 2/2] no local

---
 vulnfeeds/conversion/common.go | 19 +++----------------
 1 file changed, 3 insertions(+), 16 deletions(-)

diff --git a/vulnfeeds/conversion/common.go b/vulnfeeds/conversion/common.go
index 44cf9f98ead..9148db2b881 100644
--- a/vulnfeeds/conversion/common.go
+++ b/vulnfeeds/conversion/common.go
@@ -145,23 +145,10 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 	unresolvedRanges := versionRanges
 	var successfulRepos []string
 
-	localCanonicalCache := make(map[string]string)
-	getCanonical := func(repo string) (string, error) {
-		if canonical, ok := localCanonicalCache[repo]; ok {
-			return canonical, nil
-		}
-		canonical, err := git.FindCanonicalLink(repo, http.DefaultClient, cache)
-		if err == nil {
-			localCanonicalCache[repo] = canonical
-		}
-
-		return canonical, err
-	}
-
 	claimedRepos := make(map[string]bool)
 	for _, vr := range versionRanges {
 		if vr.Range.GetRepo() != "" {
-			canonicalRepo, err := getCanonical(vr.Range.GetRepo())
+			canonicalRepo, err := git.FindCanonicalLink(vr.Range.GetRepo(), http.DefaultClient, cache)
 			if err != nil {
 				if git.IsRateLimit(err) {
 					metrics.Outcome = models.Error
@@ -182,7 +169,7 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 			continue
 		}
 
-		repo, err := getCanonical(repo)
+		repo, err := git.FindCanonicalLink(repo, http.DefaultClient, cache)
 		if err != nil {
 			metrics.AddNote("Failed to find canonical link - %s %v", repo, err)
 			if git.IsRateLimit(err) {
@@ -208,7 +195,7 @@ func GitVersionsToCommits(versionRanges []models.RangeWithMetadata, repos []stri
 		for _, vr := range unresolvedRanges {
 			vRepo := vr.Range.GetRepo()
 			if vRepo != "" {
-				canonicalVRepo, err := getCanonical(vRepo)
+				canonicalVRepo, err := git.FindCanonicalLink(vRepo, http.DefaultClient, cache)
 				if err != nil {
 					if git.IsRateLimit(err) {
 						metrics.Outcome = models.Error