When the gobin indexer what first deployed in production it did not persist a norm_version in the package table, this mean that matching wouldn't work for these packages as the matcher was querying that field. This bug was corrected so new Go packages were inserted with the norm_version and matched correctly. However, when the indexer sees packages it has seen before it does not duplicate them in the package table hence all the Go packages that were inserted before the bug fix are still in an incomplete state.

We need to run a script to update Go packages in the DB with their norm_version (and norm_kind).  We can get a list of all potentially vulnerable packages from the matcher DB.

Example of vulnerabilities not being surfaced:

https://quay.io/repository/crozzy/tester/manifest/sha256:ca17930d9454508910564e195ddc833430587120e7a1c5bcfb0d9225bd41ac4f?tab=vulnerabilities

https://github.com/advisories/GHSA-vpvm-3wq2-2wvm