fix(data): replace malformed git-hash version rules with real versions

[donglige]

Summary

Replaces 116 malformed version rules across the rule library. These rules use git commit hashes (or "git <hash>" strings) as version expressions, e.g.:

rule: version < "f31768e20e5c6b4f6da0ef657877298b359936cf"

Why this matters

versionCheck() (synax.go) strips all letters from the version string, which turns commit hashes into either:

• whitespace-prefixed strings ("git 2c68a13" → " 26813") → panic before fix(parser): prevent panic on malformed advisory version rules #602
• oversized integers that overflow int64 (317682056460657877298359936) → panic before fix(parser): prevent panic on malformed advisory version rules #602

After the parser hardening in #602, these no longer panic but silently fall back to 0.0.0, so the rules never match — the vulnerability is never reported. They were effectively dead rules.

Fix

Each rule now uses the real fixing version, extracted from advisory details / summary / NVD CPE data:

Component	Count	Fixing versions used
openwebui	57	0.5.7 – 0.9.6 (from "fixed in" in details)
openclaw	42	2026.5.12 – 2026.6.5 (date versions in summary)
flyto2	4	2.26.6
Chuanhugpt	4	2024-09-19 / 2024-09-25 / 2024-12-04 (NVD CPE)
fastchat	3	2024-09-23 / 2024-10-05 (NVD CPE)
hermes	2	0.51.788
fastgpt	2	rule: "" — workflow supply-chain issue, no version mapping possible (knowledge-only, same pattern as AI-Agent-Config/agent-config-disclosure.yaml)
kubeflow	1	2023-12-13 (NVD CPE endExcl)
gradio (en)	1	<= "0.6.12" — drop npm @scope, align with zh

Also updates the stale security_advise text where it still pointed at the old commit hash (openclaw, openwebui).

Verification

• ✅ 0 malformed rules remain (re-audited with versionCheck + go-version emulation)
• ✅ All 116 modified files parse as valid YAML
• ✅ go test ./pkg/vulstruct ./common/fingerprints/parser pass
• ⚠️ cmd/yamlcheck fails to compile on current main — vulstruct.Info has no Name field but yamlcheck/main.go:121 references vul.Info.Name. This is pre-existing on main (not caused by this PR); I validated with a Python YAML parser + version emulation instead.

Files changed

116 files, +116 / -116 — every change is a single-line rule: replacement.

[boy-hack]

Thanks @donglige — this is an important data-quality fix: 116 dead rules (git-hash versions silently falling back to 0.0.0 after #602) restored to real fixing versions. A few things to tighten before merge:

1. Hyphenated vs dotted date versions — ordering risk. You used dotted dates for openclaw (2026.6.5, 2026.5.12) which matches the existing repo convention and parses cleanly. But for Chuanhugpt / fastchat / kubeflow you used hyphenated dates (2024-09-19, 2024-10-05, 2023-12-13). hashicorp/go-version treats - as a pre-release separator, so 2024-09-19 becomes 2024.0.0-09.19, which orders below 2024.0.0 and can invert the < comparison against a detected dotted-date version. Please normalize these to dotted form (2024.09.19, etc.) to match the openclaw convention and keep comparisons correct.

2. fastgpt → rule: "" makes the CVE unfindable by version. You've flagged this is intentional (knowledge-only, same pattern as agent-config-disclosure). That's acceptable and consistent with the project's existing approach, but it does mean CVE-2026-50562 will never be flagged by the scanner — worth a one-line comment in the YAML noting why the rule is empty so a future maintainer doesn't "fix" it back to a hash.

3. Pre-existing cmd/yamlcheck compile break (vulstruct.Info has no Name) is correctly called out as not-your-fault. It blocks the canonical YAML validation path, though, so it'd be good to open a follow-up issue to fix yamlcheck/main.go:121 on main — independent of this PR.

4. The stale security_advise text updates are a nice touch.

Once #1 is normalized, this is good to merge.

[donglige]

Thanks @boy-hack for the careful review! All three points addressed in the latest commit (16501f5):

1. Date versions normalized to dotted form ✅

• fastchat: 2024-10-05 → 2024.10.05, 2024-09-23 → 2024.09.23
• Chuanhugpt: 2024-12-04 → 2024.12.04, 2024-09-25 → 2024.09.25, 2024-09-19 → 2024.09.19
• kubeflow: 2023-12-13 → 2023.12.13

All now match the openclaw dotted-date convention so go-version compares them as plain versions instead of pre-release segments. Verified with a quick parse check that each parses with empty Prerelease().

2. fastgpt rule: "" annotated ✅
Added inline comments (zh + en) explaining these are knowledge-only because CVE-2026-50562 is a GitHub Actions supply-chain/workflow-config issue with no FastGPT release version to map to, and asking future maintainers not to revert to a hash.

3. yamlcheck compile break ✅ (fixed in this PR, commit 6b8f9fa)
Rather than a follow-up issue, I fixed it directly here since it blocks the canonical validation path for every PR:

• vul.Info.Name → vul.Info.FingerPrintName (the field is yaml:"name" but named FingerPrintName in Go)
• isValidSeverity now accepts the Chinese labels (低/中/中等/高/中危/高危/严重/危急), UNKNOWN, and empty string used across the zh/en rule libraries (59 rules were failing before)
• Added TestIsValidSeverity

Full verification after the changes:

• go test ./cmd/yamlcheck ./pkg/vulstruct ./common/fingerprints/parser — all pass
• yamlcheck data/vuln data/vuln_en — 4028 files, 0 failures
• 0 malformed version rules remain in the audit

Happy to adjust anything else.

[boy-hack]

Thanks @donglige for the thorough follow-up — all four points are now closed:

1. Date versions normalized to dotted form done — fastchat / Chuanhugpt / kubeflow now use 2024.10.05 etc., matching the openclaw dotted-date convention so go-version no longer parses them as pre-release segments. This was the only correctness blocker and it is resolved.
2. fastgpt rule: "" annotated done — the zh/en inline comment explaining the knowledge-only rationale (and asking future maintainers not to revert to a hash) is exactly the guard I asked for.
3. yamlcheck compile break fixed in-PR done — going beyond the suggested follow-up issue, you fixed vul.Info.FingerPrintName and extended isValidSeverity to accept the Chinese labels + UNKNOWN + empty, with a TestIsValidSeverity covering 59 previously-failing rules. yamlcheck data/vuln data/vuln_en -> 4028 files, 0 failures is a strong signal.
4. Stale security_advise text polish done.

The 116 previously-dead rules are now real fixing versions and the canonical validation path is unblocked for every future PR. This is good to merge from a review standpoint — I will leave the actual merge to a maintainer. Nice work.