Query API missing GIT ecosystem

[mayak222]

Is your feature request related to a problem? Please describe.
The query API doesn't recognize 'GIT' as a supported ecosystem (returns "Invalid ecosystem." error).

Describe the solution you'd like
I would like to be able to query GIT vulnerabilities (found here) via the query API.

[michaelkedar]

Hi,
GIT vulnerabilities can currently be queried by just providing the commit, e.g.

curl -d \
  '{"commit": "6879efc2c1596d11a6a6ad296f80063b558d5e0f"}' \
  "https://api.osv.dev/v1/query"

[michaelkedar]

We should probably improve the error message for when someone uses GIT as an ecosystem explain this usage.

[another-rex]

As for querying for version tags, we currently don't support querying for them on the Git ecosystem, but it might be something we should add.

[oliverchang]

google/osv-scanner#1791 (comment) might also be another reason in support of supporting querying by the GIT ecosystem and version tags.

[douglasclarke]

Not sure if this is a separate bug or a misunderstanding of the commit based queries. Looking at https://api.osv.dev/v1/vulns/CURL-CVE-2025-0167 you can see that vulnerability was introduced at 46620b97431e19c53ce82e55055c85830f088cf4.

When I query with
curl -s -d \ '{"commit": "46620b97431e19c53ce82e55055c85830f088cf4"}' "https://api.osv.dev/v1/query"

I do not get CURL-CVE-2025-0167 reported in the result.

[oliverchang]

@another-rex I think we landed on supporting querying by GIT in our API right? Because we also need this for sideloaded binary vuln matching?

[another-rex]

Yes!

[oliverchang]

While we're here we should also consider: #3463