diff --git a/cmd/vulnreport/main.go b/cmd/vulnreport/main.go
index 0470668..a594e95 100644
--- a/cmd/vulnreport/main.go
+++ b/cmd/vulnreport/main.go
@@ -142,7 +142,7 @@
 	if err != nil {
 		return err
 	}
-	// Parse CVE ID from GitHub issue.
+	// Parse CVE or GHSA ID from GitHub issue.
 	parts := strings.Fields(iss.Title)
 	var modulePath string
 	for _, p := range parts {
@@ -151,15 +151,24 @@
 			break
 		}
 	}
-	cveID := parts[len(parts)-1]
-	if !strings.HasPrefix(cveID, "CVE") {
-		return fmt.Errorf("expected last element of title to be the CVE ID; got %q", iss.Title)
+	id := parts[len(parts)-1]
+	var r *report.Report
+	switch {
+	case strings.HasPrefix(id, "CVE"):
+		cve, err := cvelistrepo.FetchCVE(ctx, repoPath, id)
+		if err != nil {
+			return err
+		}
+		r = report.CVEToReport(cve, modulePath)
+	case strings.HasPrefix(id, "GHSA"):
+		ghsa, err := ghsa.FetchGHSA(ctx, ghToken, id)
+		if err != nil {
+			return err
+		}
+		r = report.GHSAToReport(ghsa, modulePath)
+	default:
+		return fmt.Errorf("expected last element of title to be the CVE ID or GHSA ID; got %q", iss.Title)
 	}
-	cve, err := cvelistrepo.FetchCVE(ctx, repoPath, cveID)
-	if err != nil {
-		return err
-	}
-	r := report.CVEToReport(cve, modulePath)
 	addTODOs(r)
 	return r.Write(fmt.Sprintf("reports/GO-2021-%04d.yaml", issueNumber))
 }
@@ -189,6 +198,9 @@
 	if r.Links.Commit == "" {
 		r.Links.Commit = todo
 	}
+	if len(r.Links.Context) == 0 {
+		r.Links.Context = []string{todo}
+	}
 	if len(r.Versions) == 0 {
 		r.Versions = []report.VersionRange{{
 			Introduced: todo,
diff --git a/internal/ghsa/ghsa.go b/internal/ghsa/ghsa.go
index 5af39b9..47fdf5d 100644
--- a/internal/ghsa/ghsa.go
+++ b/internal/ghsa/ghsa.go
@@ -68,52 +68,96 @@
 	return s.ID
 }
 
+// A gqlSecurityAdvisory represents a GitHub security advisory structured for
+// GitHub's GraphQL schema. The fields must be exported to be populated by
+// Github's Client.Query function.
+type gqlSecurityAdvisory struct {
+	ID              string
+	Identifiers     []Identifier
+	Summary         string
+	Description     string
+	Origin          string
+	Permalink       githubv4.URI
+	PublishedAt     time.Time
+	UpdatedAt       time.Time
+	Vulnerabilities struct {
+		Nodes []struct {
+			Package struct {
+				Name      string
+				Ecosystem string
+			}
+			FirstPatchedVersion struct{ Identifier string }
+			// TODO(https://go.dev/issue/52550): uncomment when
+			// https://support.github.com/ticket/personal/0/1599280
+			// is fixed.
+			//Severity               githubv4.SecurityAdvisorySeverity
+			UpdatedAt              time.Time
+			VulnerableVersionRange string
+		}
+		PageInfo struct {
+			HasNextPage bool
+		}
+	} `graphql:"vulnerabilities(first: 100, ecosystem: $go)"` // include only Go vulns
+}
+
+// securityAdvisory converts a gqlSecurityAdvisory into a SecurityAdvisory.
+// Errors if the security advisory was updated before it was published, or if
+// there are more than 100 vulnerabilities associated with the advisory.
+func (sa *gqlSecurityAdvisory) securityAdvisory() (*SecurityAdvisory, error) {
+	if sa.PublishedAt.After(sa.UpdatedAt) {
+		return nil, fmt.Errorf("%s: published at %s, after updated at %s", sa.ID, sa.PublishedAt, sa.UpdatedAt)
+	}
+	if sa.Vulnerabilities.PageInfo.HasNextPage {
+		return nil, fmt.Errorf("%s has more than 100 vulns", sa.ID)
+	}
+	s := &SecurityAdvisory{
+		ID:          sa.ID,
+		Identifiers: sa.Identifiers,
+		Summary:     sa.Summary,
+		Description: sa.Description,
+		Origin:      sa.Origin,
+		Permalink:   sa.Permalink.URL.String(),
+		PublishedAt: sa.PublishedAt,
+		UpdatedAt:   sa.UpdatedAt,
+	}
+	for _, v := range sa.Vulnerabilities.Nodes {
+		s.Vulns = append(s.Vulns, &Vuln{
+			Package: v.Package.Name,
+			// TODO(https://go.dev/issue/52550): uncomment when
+			// https://support.github.com/ticket/personal/0/1599280
+			// is fixed.
+			//Severity:               v.Severity,
+			EarliestFixedVersion:   v.FirstPatchedVersion.Identifier,
+			VulnerableVersionRange: v.VulnerableVersionRange,
+			UpdatedAt:              v.UpdatedAt,
+		})
+	}
+	return s, nil
+}
+
+func newGitHubClient(ctx context.Context, accessToken string) *githubv4.Client {
+	ts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})
+	tc := oauth2.NewClient(ctx, ts)
+	return githubv4.NewClient(tc)
+}
+
 // List returns all SecurityAdvisories that affect Go,
 // published or updated since the given time.
-// The withCVE argument controls whether to select advisories that are
-// connected to CVEs.
+// If withCVE is true, selects only advisories that are
+// connected to CVEs, otherwise selects only advisories without CVEs.
 func List(ctx context.Context, accessToken string, since time.Time, withCVE bool) ([]*SecurityAdvisory, error) {
-	ts := oauth2.StaticTokenSource(&oauth2.Token{AccessToken: accessToken})
-	tc := oauth2.NewClient(context.Background(), ts)
-	client := githubv4.NewClient(tc)
+	client := newGitHubClient(ctx, accessToken)
 
 	var query struct { // the GraphQL query
 		SAs struct {
-			Nodes []struct {
-				ID              string
-				Identifiers     []Identifier
-				Summary         string
-				Description     string
-				Origin          string
-				Permalink       githubv4.URI
-				PublishedAt     time.Time
-				UpdatedAt       time.Time
-				Vulnerabilities struct {
-					Nodes []struct {
-						Package struct {
-							Name      string
-							Ecosystem string
-						}
-						FirstPatchedVersion struct{ Identifier string }
-						// TODO(https://go.dev/issue/52550): uncomment when
-						// https://support.github.com/ticket/personal/0/1599280
-						// is fixed.
-						//Severity               githubv4.SecurityAdvisorySeverity
-						UpdatedAt              time.Time
-						VulnerableVersionRange string
-					}
-					PageInfo struct {
-						HasNextPage bool
-					}
-				} `graphql:"vulnerabilities(first: 100, ecosystem: $go)"` // include only Go vulns
-			}
+			Nodes    []gqlSecurityAdvisory
 			PageInfo struct {
 				EndCursor   githubv4.String
 				HasNextPage bool
 			}
 		} `graphql:"securityAdvisories(updatedSince: $since, first: 100, after: $cursor)"`
 	}
-	vars := map[string]interface{}{
+	vars := map[string]any{
 		"cursor": (*githubv4.String)(nil),
 		"go":     githubv4.SecurityAdvisoryEcosystemGo,
 		"since":  githubv4.DateTime{Time: since},
@@ -127,39 +171,15 @@
 			return nil, err
 		}
 		for _, sa := range query.SAs.Nodes {
-			if sa.PublishedAt.After(sa.UpdatedAt) {
-				return nil, fmt.Errorf("%s: published at %s, after updated at %s", sa.ID, sa.PublishedAt, sa.UpdatedAt)
-			}
 			if withCVE != isCVE(sa.Identifiers) {
 				continue
 			}
 			if len(sa.Vulnerabilities.Nodes) == 0 {
 				continue
 			}
-			if sa.Vulnerabilities.PageInfo.HasNextPage {
-				return nil, fmt.Errorf("%s has more than 100 vulns", sa.ID)
-			}
-			s := &SecurityAdvisory{
-				ID:          sa.ID,
-				Identifiers: sa.Identifiers,
-				Summary:     sa.Summary,
-				Description: sa.Description,
-				Origin:      sa.Origin,
-				Permalink:   sa.Permalink.URL.String(),
-				PublishedAt: sa.PublishedAt,
-				UpdatedAt:   sa.UpdatedAt,
-			}
-			for _, v := range sa.Vulnerabilities.Nodes {
-				s.Vulns = append(s.Vulns, &Vuln{
-					Package: v.Package.Name,
-					// TODO(https://go.dev/issue/52550): uncomment when
-					// https://support.github.com/ticket/personal/0/1599280
-					// is fixed.
-					//Severity:               v.Severity,
-					EarliestFixedVersion:   v.FirstPatchedVersion.Identifier,
-					VulnerableVersionRange: v.VulnerableVersionRange,
-					UpdatedAt:              v.UpdatedAt,
-				})
+			s, err := sa.securityAdvisory()
+			if err != nil {
+				return nil, err
 			}
 			sas = append(sas, s)
 		}
@@ -171,6 +191,26 @@
 	return sas, nil
 }
 
+// FetchGHSA returns the SecurityAdvisory for the given Github Security
+// Advisory ID.
+func FetchGHSA(ctx context.Context, accessToken, ghsaID string) (_ *SecurityAdvisory, err error) {
+	client := newGitHubClient(ctx, accessToken)
+
+	var query struct {
+		SA gqlSecurityAdvisory `graphql:"securityAdvisory(ghsaId: $id)"`
+	}
+	vars := map[string]any{
+		"id": githubv4.String(ghsaID),
+		"go": githubv4.SecurityAdvisoryEcosystemGo,
+	}
+
+	if err := client.Query(ctx, &query, vars); err != nil {
+		return nil, err
+	}
+
+	return query.SA.securityAdvisory()
+}
+
 func isCVE(ids []Identifier) bool {
 	for _, id := range ids {
 		if id.Type == "CVE" {
diff --git a/internal/ghsa/ghsa_test.go b/internal/ghsa/ghsa_test.go
index d147844..57af6fa 100644
--- a/internal/ghsa/ghsa_test.go
+++ b/internal/ghsa/ghsa_test.go
@@ -16,7 +16,7 @@
 var githubTokenFile = flag.String("ghtokenfile", "",
 	"path to file containing GitHub access token")
 
-func TestList(t *testing.T) {
+func mustGetAccessToken(t *testing.T) string {
 	if *githubTokenFile == "" {
 		t.Skip("-ghtokenfile not provided")
 	}
@@ -24,7 +24,11 @@
 	if err != nil {
 		t.Fatal(err)
 	}
-	accessToken := strings.TrimSpace(string(bytes))
+	return strings.TrimSpace(string(bytes))
+}
+
+func TestList(t *testing.T) {
+	accessToken := mustGetAccessToken(t)
 	// There were at least three relevant SAs since this date.
 	since := time.Date(2022, 1, 1, 0, 0, 0, 0, time.UTC)
 	const withoutCVEs = false
@@ -42,3 +46,24 @@
 		}
 	}
 }
+
+func TestFetchGHSA(t *testing.T) {
+	accessToken := mustGetAccessToken(t)
+	// Real GHSA that should be found.
+	const ghsaID string = "GHSA-g9mp-8g3h-3c5c"
+	got, err := FetchGHSA(context.Background(), accessToken, ghsaID)
+	if err != nil {
+		t.Fatal(err)
+	}
+	want := ghsaID
+	var gotID string
+	for _, id := range got.Identifiers {
+		if id.Type == "GHSA" {
+			gotID = id.Value
+			break
+		}
+	}
+	if gotID != want {
+		t.Errorf("got GHSA with id %q, want %q", got.ID, want)
+	}
+}
diff --git a/internal/report/ghsa.go b/internal/report/ghsa.go
new file mode 100644
index 0000000..8872e1d
--- /dev/null
+++ b/internal/report/ghsa.go
@@ -0,0 +1,122 @@
+// Copyright 2021 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package report
+
+import (
+	"fmt"
+	"strings"
+
+	"golang.org/x/vulndb/internal"
+	"golang.org/x/vulndb/internal/ghsa"
+)
+
+// GHSAToReport creates a Report struct from a given GHSA SecurityAdvisory and modulePath.
+func GHSAToReport(sa *ghsa.SecurityAdvisory, modulePath string) *Report {
+	u := sa.UpdatedAt
+	r := &Report{
+		Module:       modulePath,
+		Description:  sa.Description,
+		Published:    sa.PublishedAt,
+		LastModified: &u,
+		Links:        Links{Context: []string{sa.Permalink}},
+	}
+	var cves, ghsas []string
+	for _, id := range sa.Identifiers {
+		switch id.Type {
+		case "CVE":
+			cves = append(cves, id.Value)
+		case "GHSA":
+			ghsas = append(ghsas, id.Value)
+		}
+	}
+	r.CVEs = cves
+	r.GHSAs = ghsas
+	if len(sa.Vulns) == 0 {
+		return r
+	}
+	r.Package = sa.Vulns[0].Package
+	r.Versions = versions(sa.Vulns[0].EarliestFixedVersion, sa.Vulns[0].VulnerableVersionRange)
+	for _, v := range sa.Vulns[1:] {
+		var a Additional
+		a.Package = v.Package
+		a.Versions = versions(v.EarliestFixedVersion, v.VulnerableVersionRange)
+		r.AdditionalPackages = append(r.AdditionalPackages, a)
+	}
+	r.Fix()
+	return r
+}
+
+// versions extracts the versions in which a vulnerability was introduced and
+// fixed from a Github Security Advisory's EarliestFixedVersion and
+// VulnerableVersionRange fields, and wraps them in a []VersionRange.
+//
+// If the vulnRange cannot be parsed, or the earliestFixed and vulnRange are
+// incompatible, populate the relevant fields with a TODO for a human to handle.
+func versions(earliestFixed, vulnRange string) []VersionRange {
+	// Don't try to be fully general here. Handle the common cases (which, as of
+	// March 2022, are the only cases), and let a person handle the others.
+	items, err := parseVulnRange(vulnRange)
+	if err != nil {
+		return []VersionRange{{
+			Introduced: fmt.Sprintf("TODO (got error %q)", err),
+		}}
+	}
+
+	var intro, fixed string
+
+	// Most common case: a single "<" item with a version that matches earliestFixed.
+	if len(items) == 1 && items[0].op == "<" && items[0].version == earliestFixed {
+		intro = "v0.0.0"
+		fixed = "v" + earliestFixed
+	}
+
+	// Two items, one >= and one <, with the latter matching earliestFixed.
+	if len(items) == 2 && items[0].op == ">=" && items[1].op == "<" && items[1].version == earliestFixed {
+		intro = "v" + items[0].version
+		fixed = "v" + earliestFixed
+	}
+
+	// A single "<=" item with no fixed version.
+	if len(items) == 1 && items[0].op == "<=" && earliestFixed == "" {
+		intro = "v0.0.0"
+	}
+
+	if intro == "" {
+		intro = fmt.Sprintf("TODO (earliest fixed %q, vuln range %q)", earliestFixed, vulnRange)
+	}
+
+	// Unset intro if vuln was always present.
+	if intro == "v0.0.0" {
+		intro = ""
+	}
+
+	return []VersionRange{{Introduced: intro, Fixed: fixed}}
+}
+
+type vulnRangeItem struct {
+	op, version string
+}
+
+// parseVulnRange splits the contents of a GitHub Security Advisory's
+// VulnerableVersionRange field into separate items.
+func parseVulnRange(s string) ([]vulnRangeItem, error) {
+	// A GHSA vuln range is a comma-separated list of items of the form "OP VERSION"
+	// where OP is one of "<", ">", "<=" or ">=" and VERSION is a semantic
+	// version.
+	var items []vulnRangeItem
+	parts := strings.Split(s, ",")
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p == "" {
+			continue
+		}
+		before, after, found := internal.Cut(p, " ")
+		if !found {
+			return nil, fmt.Errorf("invalid vuln range item %q", p)
+		}
+		items = append(items, vulnRangeItem{strings.TrimSpace(before), strings.TrimSpace(after)})
+	}
+	return items, nil
+}
diff --git a/internal/report/ghsa_test.go b/internal/report/ghsa_test.go
new file mode 100644
index 0000000..d94f454
--- /dev/null
+++ b/internal/report/ghsa_test.go
@@ -0,0 +1,93 @@
+// Copyright 2022 The Go Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package report
+
+import (
+	"testing"
+	"time"
+
+	"github.com/google/go-cmp/cmp"
+	"golang.org/x/vulndb/internal/ghsa"
+)
+
+func TestGHSAToReport(t *testing.T) {
+	updatedTime := time.Date(2022, 01, 01, 01, 01, 00, 00, time.UTC)
+	sa := &ghsa.SecurityAdvisory{
+		ID:          "G1_blah",
+		Identifiers: []ghsa.Identifier{{Type: "GHSA", Value: "G1"}, {Type: "CVE", Value: "C1"}},
+		UpdatedAt:   updatedTime,
+		Permalink:   "https://github.com/permalink/to/G1",
+		Description: "a description",
+		Vulns: []*ghsa.Vuln{{
+			Package:                "aPackage",
+			EarliestFixedVersion:   "1.2.3",
+			VulnerableVersionRange: "< 1.2.3",
+		}},
+	}
+	got := GHSAToReport(sa, "aModule")
+	want := &Report{
+		Module:  "aModule",
+		Package: "aPackage",
+		Versions: []VersionRange{
+			{Fixed: "v1.2.3"},
+		},
+		LastModified: &updatedTime,
+		Description:  "a description",
+		GHSAs:        []string{"G1"},
+		CVEs:         []string{"C1"},
+		Links:        Links{Context: []string{"https://github.com/permalink/to/G1"}},
+	}
+
+	if diff := cmp.Diff(*got, *want); diff != "" {
+		t.Errorf("mismatch (-want, +got):\n%s", diff)
+	}
+}
+func TestParseVulnRange(t *testing.T) {
+	for _, test := range []struct {
+		in   string
+		want []vulnRangeItem
+	}{
+		{"", nil},
+		{"< 1.2.3", []vulnRangeItem{{"<", "1.2.3"}}},
+		{"< 4.3.2, >= 1.2.3", []vulnRangeItem{
+			{"<", "4.3.2"},
+			{">=", "1.2.3"},
+		}},
+	} {
+		got, err := parseVulnRange(test.in)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if !cmp.Equal(got, test.want, cmp.AllowUnexported(vulnRangeItem{})) {
+			t.Errorf("%q:\ngot  %+v\nwant %+v", test.in, got, test.want)
+		}
+	}
+}
+
+func TestVersions(t *testing.T) {
+	for _, test := range []struct {
+		earliestFixed string
+		vulnRange     string
+		intro, fixed  string
+	}{
+		{"1.0.0", "< 1.0.0", "", "v1.0.0"},
+		{"", "<= 1.4.2", "", ""},
+		{"1.1.3", ">= 1.1.0, < 1.1.3", "v1.1.0", "v1.1.3"},
+		{
+			"1.2.3", "<= 2.3.4",
+			`TODO (earliest fixed "1.2.3", vuln range "<= 2.3.4")`, "",
+		},
+	} {
+		got := versions(test.earliestFixed, test.vulnRange)
+		want := []VersionRange{{
+			Introduced: test.intro,
+			Fixed:      test.fixed,
+		}}
+		if !cmp.Equal(got, want) {
+			t.Errorf("%q, %q:\ngot  %+v\nwant %+v",
+				test.earliestFixed, test.vulnRange, got, want)
+		}
+	}
+}
diff --git a/internal/worker/worker.go b/internal/worker/worker.go
index f29175f..a2e9b7b 100644
--- a/internal/worker/worker.go
+++ b/internal/worker/worker.go
@@ -22,7 +22,6 @@
 	"golang.org/x/sync/errgroup"
 	"golang.org/x/time/rate"
 	vulnc "golang.org/x/vuln/client"
-	"golang.org/x/vulndb/internal"
 	"golang.org/x/vulndb/internal/cvelistrepo"
 	"golang.org/x/vulndb/internal/cveschema"
 	"golang.org/x/vulndb/internal/derrors"
@@ -363,7 +362,7 @@
 func newGHSABody(sr storeRecord) (string, error) {
 	sa := sr.(*store.GHSARecord).GHSA
 
-	r := ghsaToReport(sa)
+	r := report.GHSAToReport(sa, "")
 	rs, err := r.ToString()
 	if err != nil {
 		return "", err
@@ -384,89 +383,6 @@
 	return b.String(), nil
 }
 
-func ghsaToReport(sa *ghsa.SecurityAdvisory) *report.Report {
-	u := sa.UpdatedAt
-	r := &report.Report{
-		GHSAs:        []string{sa.PrettyID()},
-		Description:  sa.Description,
-		Published:    sa.PublishedAt,
-		LastModified: &u,
-	}
-	if len(sa.Vulns) == 0 {
-		return r
-	}
-	r.Package = sa.Vulns[0].Package
-	r.Versions = versions(sa.Vulns[0].EarliestFixedVersion, sa.Vulns[0].VulnerableVersionRange)
-	for _, v := range sa.Vulns[1:] {
-		var a report.Additional
-		a.Package = v.Package
-		a.Versions = versions(v.EarliestFixedVersion, v.VulnerableVersionRange)
-		r.AdditionalPackages = append(r.AdditionalPackages, a)
-	}
-	return r
-}
-
-func versions(earliestFixed, vulnRange string) []report.VersionRange {
-	// Don't try to be fully general here. Handle the common cases (which, as of
-	// March 2022, are the only cases), and let a person handle the others.
-	items, err := parseVulnRange(vulnRange)
-	if err != nil {
-		return []report.VersionRange{{
-			Introduced: fmt.Sprintf("TODO (got error %q)", err),
-		}}
-	}
-
-	var intro, fixed string
-
-	// Most common case: a single "<" item with a version that matches earliestFixed.
-	if len(items) == 1 && items[0].op == "<" && items[0].version == earliestFixed {
-		intro = "v0.0.0"
-		fixed = "v" + earliestFixed
-	}
-
-	// Two items, one >= and one <, with the latter matching earliestFixed.
-	if len(items) == 2 && items[0].op == ">=" && items[1].op == "<" && items[1].version == earliestFixed {
-		intro = "v" + items[0].version
-		fixed = "v" + earliestFixed
-	}
-
-	// A single "<=" item with no fixed version.
-	if len(items) == 1 && items[0].op == "<=" && earliestFixed == "" {
-		intro = "v0.0.0"
-	}
-
-	if intro == "" {
-		intro = fmt.Sprintf("TODO (earliest fixed %q, vuln range %q)", earliestFixed, vulnRange)
-	}
-	return []report.VersionRange{{Introduced: intro, Fixed: fixed}}
-}
-
-type vulnRangeItem struct {
-	op, version string
-}
-
-// parseVulnRange splits the contents of a GitHub Security Advisory's
-// VulnerableVersionRange field into separate items.
-func parseVulnRange(s string) ([]vulnRangeItem, error) {
-	// A GHSA vuln range is a comma-separated list of items of the form "OP VERSION"
-	// where OP is one of "<", ">", "<=" or ">=" and VERSION is a semantic
-	// version.
-	var items []vulnRangeItem
-	parts := strings.Split(s, ",")
-	for _, p := range parts {
-		p = strings.TrimSpace(p)
-		if p == "" {
-			continue
-		}
-		before, after, found := internal.Cut(p, " ")
-		if !found {
-			return nil, fmt.Errorf("invalid vuln range item %q", p)
-		}
-		items = append(items, vulnRangeItem{strings.TrimSpace(before), strings.TrimSpace(after)})
-	}
-	return items, nil
-}
-
 func vulnTable(vs []*ghsa.Vuln) string {
 	var b strings.Builder
 	fmt.Fprintf(&b, "| Unit | Fixed | Vulnerable Ranges |\n")
diff --git a/internal/worker/worker_test.go b/internal/worker/worker_test.go
index 73ceb72..13531a7 100644
--- a/internal/worker/worker_test.go
+++ b/internal/worker/worker_test.go
@@ -24,7 +24,6 @@
 	"golang.org/x/vulndb/internal/ghsa"
 	"golang.org/x/vulndb/internal/gitrepo"
 	"golang.org/x/vulndb/internal/issues"
-	"golang.org/x/vulndb/internal/report"
 	"golang.org/x/vulndb/internal/worker/log"
 	"golang.org/x/vulndb/internal/worker/store"
 )
@@ -273,11 +272,13 @@
 ` + "```" + `
 package: aPackage
 versions:
-  - introduced: v0.0.0
-    fixed: v1.2.3
+  - fixed: v1.2.3
 description: a description
 ghsas:
   - G1
+links:
+    context:
+      - https://github.com/permalink/to/G1
 
 ` + "```"
 
@@ -421,51 +422,3 @@
 		}
 	}
 }
-
-func TestParseVulnRange(t *testing.T) {
-	for _, test := range []struct {
-		in   string
-		want []vulnRangeItem
-	}{
-		{"", nil},
-		{"< 1.2.3", []vulnRangeItem{{"<", "1.2.3"}}},
-		{"< 4.3.2, >= 1.2.3", []vulnRangeItem{
-			{"<", "4.3.2"},
-			{">=", "1.2.3"},
-		}},
-	} {
-		got, err := parseVulnRange(test.in)
-		if err != nil {
-			t.Fatal(err)
-		}
-		if !cmp.Equal(got, test.want, cmp.AllowUnexported(vulnRangeItem{})) {
-			t.Errorf("%q:\ngot  %+v\nwant %+v", test.in, got, test.want)
-		}
-	}
-}
-
-func TestVersions(t *testing.T) {
-	for _, test := range []struct {
-		earliestFixed string
-		vulnRange     string
-		intro, fixed  string
-	}{
-		{"1.0.0", "< 1.0.0", "v0.0.0", "v1.0.0"},
-		{"", "<= 1.4.2", "v0.0.0", ""},
-		{"1.1.3", ">= 1.1.0, < 1.1.3", "v1.1.0", "v1.1.3"},
-		{
-			"1.2.3", "<= 2.3.4",
-			`TODO (earliest fixed "1.2.3", vuln range "<= 2.3.4")`, "",
-		},
-	} {
-		got := versions(test.earliestFixed, test.vulnRange)
-		want := []report.VersionRange{{
-			Introduced: test.intro,
-			Fixed:      test.fixed,
-		}}
-		if !cmp.Equal(got, want) {
-			t.Errorf("%q, %q:\ngot  %+v\nwant %+v",
-				test.earliestFixed, test.vulnRange, got, want)
-		}
-	}
-}