A vulnerability range is a claim about ordering, and it is worth no more than the version parser sitting underneath it. Walk an OSV range's events in whatever order they happen to sit in the file, compare them against leniently parsed versions, and you get two silent failures: verdicts that flip...
Source: [Dev.to](https://dev.to/polycratia/a-date-is-not-a-version-strict-parsing-under-osv-ranges-3mai)