Potentially incorrect versions entries in PYSEC-2024-115 & PYSEC-2024-53

[G-Rath]

It seems that https://api.osv.dev/v1/vulns/PYSEC-2024-115 and https://api.osv.dev/v1/vulns/PYSEC-2024-53 have PIP version constraints in their versions:

"langchain-openai==0.1.25",
"langchain-core==0.2.40",
"langchain-community==0.2.17",
"langchain-openai==0.1.24",
"langchain-groq==0.1.10",

Looking at the spec for versions I think this might technically be valid but afaik it's never been done before and it won't work with the offline logic in osv-scanner because it expects to be comparing versions only.

It looks like this is being added by osv.dev as the upstream (e.g. https://github.com/pypa/advisory-database/blob/main/vulns/langchain/PYSEC-2024-115.yaml) does not include these versions.

I picked this up via the semantic workflow in the osv-detector repo that runs the library from osv-scalibr across all the available versions in each ecosystem

[G-Rath]

oh also impacts https://api.osv.dev/v1/vulns/PYSEC-2024-184 & https://api.osv.dev/v1/vulns/PYSEC-2023-255 which I'm pretty sure are not valid PIP versions at all