The next OSV schema release will add an `upstream` field: https://github.com/ossf/osv-schema/pull/312 We need to support this on OSV.dev's side.