Attempt to automatically generate unaffected_versions:

lib/github_advisory_sync.rb

@@ -337,6 +337,32 @@ def update(package)
       package.filename
     end
 
+    def vulnerable_version_ranges_for(package)
+      vulnerabilities.select { |v|
+        v['package']['name'] == package.name
+      }.map { |v|
+        v['vulnerableVersionRange'].split(', ',2).map do |version_range|
+          version_range.split(' ',2)
+        end
+      }.sort_by { |((lower_op,lower_version),(upper_op,upper_version))|
+        lower_version
+      }
+    end
+
+    def unaffected_versions_for(package)
+      if (version_range = vulnerable_version_ranges_for(package).first)
+        lower_version_range = version_range[0]
+        operator, version   = lower_version_range
+
+        case operator
+        when '>'
+          ["<= #{version}"]
+        when '>=', '='
+          ["< #{version}"]
+        end
+      end
+    end
+
     def first_patched_versions_for(package)
       first_patched_versions = []
 
@@ -371,10 +397,13 @@ def create(package)
 
       new_data = package.merge_data(
         "cvss_v3"             => ("<FILL IN IF AVAILABLE>" unless cvss),
-        "cvss_v4"             => "<FILL IN IF AVAILABLE>",
-        "unaffected_versions" => ["<OPTIONAL: FILL IN SEE BELOW>"]
+        "cvss_v4"             => "<FILL IN IF AVAILABLE>"
       )
 
+      if (unaffected_versions = unaffected_versions_for(package))
+        new_data['unaffected_versions'] = unaffected_versions
+      end
+
       patched_versions = patched_versions_for(package)
 
       if !patched_versions.empty?