fix: allow epoch 0 to match, update test outputs and testing

[tyler-catlin]

• Tests written and linted
• Documentation written
• Commit history is tidy
• Potential release notes have been inspected

What this does

We are currently stripping out 0 epochs if they are given, which is causing us to have problems with version parsing.

Notes for the reviewer

Instructions on how to run this locally, background context, what to review, questions…

More information

• Jira ticket CN-482
• Link to documentation

[CLAassistant]

All committers have signed the CLA.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ Recommended focus areas for review Deviation from standard RPM display The updated formatRpmPackageVersion now explicitly includes the 0: prefix for packages with epoch 0. Standard RPM tools (e.g., rpm -q) typically suppress the epoch if it is zero. While this appears to be the intended behavior to fix version matching issues, please ensure that downstream consumers of this string format are compatible with the explicit 0: prefix. Additionally, verify that the distinction between an undefined epoch (resulting in V-R) and a 0 epoch (resulting in 0:V-R) is intentional and handled correctly by the consuming logic, as missing epochs often imply 0 in RPM contexts. if (packageInfo.epoch === undefined) { return `${packageInfo.version}-${packageInfo.release}`; } return `${packageInfo.epoch}:${packageInfo.version}-${packageInfo.release}`;

📚 Repository Context Analyzed This review considered 20 relevant code sections from 9 files (average relevance: 0.76) lib/index.ts (relevance: 1.00, lines 1-100) package-lock.json (relevance: 0.89, 7 segments, lines 2101-2200) lib/rpm/types.ts (relevance: 0.89, lines 1-71) package.json (relevance: 0.89, lines 1-50) lib/rpm/README.md (relevance: 0.81, lines 1-6) lib/types.ts (relevance: 0.78, lines 1-26) lib/berkeleydb/index.ts (relevance: 0.73, lines 1-100) ... and 2 more file(s)

[SteveShani]

Approving, but I am not aware of the full consequences of this change. As long as vulndb is able to understand the version, it should be fine.