The OSV spec forbids overlapping semver ranges:

Ranges listed with type SEMVER should not overlap: since SEMVER is a strict linear ordering, it is always possible to simplify to non-overlapping ranges.

Consider the case where a vulnerability was fixed in go1.14.14 and go1.15.7. We should record this as the ranges [0, 1.14.14) and [1.15.0,1.15.7). Currently, we have reports where this is instead recorded as [0, 1.14.14) and [0, 1.15.7).

We should add a vulnreport lint check, and maybe a fix to derive the starting point for the second range. (Alternatively, we could leave the report as-is and always try to derive the start point when generating OSV, but that seems less clear than being explicit.)