Release v7.0.3

Patch release of the 7.0 line. Searches now report affected versions they were hiding, three new advisory sources are ingested, and database downloads are verified as they stream.

Search accuracy. NVD writes the oldest affected branch of a CVE as a range with no lower bound. Searches used to drop such a range whenever another row for the same package had a lower bound, so those versions came back clean. Now the range is dropped only when it looks like a stub: it has a commit-sha bound, has a bound that can't be ordered, repeats the sibling's ceiling, or claims a version the sibling marks as fixed. On the vdb7-full image of 2026-10-22, this brings back 17,552 index rows that were hiding affected versions. Firefox 100.0 goes from 839 to 1,143 CVEs and Go 1.17.0 from 19 to 108, and PHP 8.2.28 now reports both PHP2Shell CVEs (#296, #297). Separately, commit-sha ceilings written as <=sha no longer match every release version (#287). These fixes live in the search code, so they apply to the database you already have as soon as you upgrade.

Package identity. The PHP interpreter is now stored as pkg:generic/php instead of pkg:composer/php (#293). The Node.js runtime is now stored as pkg:generic/nodejs/node, which is the purl cdxgen reports for it, instead of pkg:npm/node.js and pkg:npm/node (#295). CPE lookups reach both. In databases built from this code, the old composer and npm spellings no longer return interpreter or runtime CVEs. OSV records that alias each other are now filed under their own CVE rather than the first alias in the group. As a result, node-forge 1.4.0 is no longer reported for a CVE it fixes, and each record's own GHSA stays searchable (#282, #283, #285).

New sources. Bottlerocket (BRSA), Oracle Linux (ELSA) and Seal Security advisories are now ingested (#289). Follow-up fixes make Seal rows match only Seal's own rebuilds, put Oracle rows on the right major-release channel, and skip Bottlerocket entries that carry an OS release instead of a package version (#290, #291). Set VDB_IGNORE_SEAL=true to leave the Seal feeds out. The same work removed an oracle vendor mapping that stored NVD rows for MySQL, Java and other Oracle products as rpm, and stopped Photon "Not Affected" rows from matching every version. MinimOS, Wolfi and Chainguard entries that their publishers mark as not affected are no longer stored as affected (#287).

Downloads. Image downloads now stream through a small registry client. It checks each layer's digest and size before moving the file into place, so an interrupted download no longer leaves a truncated database behind, and progress is logged every GiB (#288).

mcp-server-vdb 7.0.3 is published alongside this release and pins this version (#300).

Full Changelog: v7.0.2...v7.0.3