#4259 @swamp/cve/http2shell: Ubuntu missing from LIBBROTLI_TRACKER and NODE_TRACKER

Problem

The scanner reports Ubuntu hosts as Medium for CVE-2026-111497 even after the distro fix is installed. LIBBROTLI_TRACKER and NODE_TRACKER in models/_lib/advisory.ts have no Ubuntu entries, so the check cannot recognise a backported fix and judges the version string alone. Ubuntu keeps the upstream version number when it backports, so a fixed package still looks old.

Observed

On Ubuntu 26.04 with libbrotli1 1.2.0-3ubuntu0.1 installed, the scanner reports a Medium finding. Ubuntu lists that build as fixed, and lists its nodejs package as not affected.

Expected

No finding on an Ubuntu host running a fixed build.

Suggested fix

Add Ubuntu entries to both trackers, for example from USN-8956:

• 26.04 libbrotli1: fixed in 1.2.0-3ubuntu0.1
• 24.04 (noble) fixed build: 1.1.0-2ubuntu0.1
• nodejs: not affected

Environment

• Extension version 2026.10.25.1, tracker snapshot 2026-10-24T18:00Z
• There is no config option to supply a distro fix or suppress the finding

Related: #3889

Upstream repository: https://github.com/swamp-club/swamp-extensions

Environment

• Extension: @swamp/cve/http2shell@2026.10.25.1
• swamp: 20261030.222321.0-sha.709f5920
• OS: darwin (aarch64)
• Deno: 2.9.8
• Shell: /bin/zsh