[Celestial-0]

What's changed?

The OSV parser gives each affected package fresh introduced and fixed commit lists. Previously, packages shared those lists and inherited commits from other blocks in the advisory. A package with no ranges could also be emitted because an earlier package supplied commits.

The fix moves the two list initializations into the affected-package loop. Multiple Git ranges within one package still accumulate their commits. Four regression tests cover these cases in the existing OSV test module. I also added the changelog note and author entry requested by the linked contribution guide.

Related issue

Fixes #2489

Validation

Before the fix, the new tests returned 3 failed, 1 passed. With the fix, the full OSV module returns 22 passed:

python -X utf8 -m pytest -q --disable-warnings vulnerabilities/tests/pipes/test_osv_v2.py

I ran this on Windows with Python 3.12.14 and the repository's pinned development dependencies. UTF-8 mode is needed for the existing fixture text on Windows.

Black, isort and git diff --check pass. The test file also passes pycodestyle. The parser file has 12 pycodestyle findings; I checked the unchanged upstream file and got the same 12 findings. I have not run the entire repository suite. The DCO check passes; upstream test CI has not run yet.

I used AI assistance to investigate and implement this change. The cause is the shared list objects: AffectedPackageV2 keeps the lists it receives, so appending commits for a later block changes earlier packages too. The regression tests exercise the real parser and classifier without fetching repositories.

Checklist

• I understand the problem and implemented the solution using appropriate functions.
• I added or updated tests to cover my changes.
• I verified my changes by running linting, ensuring all local tests pass, and confirming that CI checks succeed.