Skip to content

v0.2.0: NVD source identifiers resolve to contributor names — ⚠️ breaking value change

Latest
Latest

Choose a tag to compare

View all tags
@cyanheads cyanheads released this 31 Jul 10:35
v0.2.0
This tag was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.
75d7ac3
This commit was signed with the committer’s verified signature.
cyanheads Casey Hand
SSH Key Fingerprint: lkZCAfVCK5qsrcvEYCs0BnVRDCX7pKsdCZkw5yYKMuw
Verified
Learn about vigilant mode.

NVD source identifiers resolve to contributor names — ⚠️ breaking value change

  • weaknesses[].source and references[].source now emit NVD's published contributor name (e.g. CVE, CISA-ADP) instead of the raw identifier — the GUID is not preserved anywhere else, so a consumer matching the old value breaks on upgrade with no schema change to warn it (#46)
  • New NvdSourceService caches NVD's source dictionary (/rest/json/source/2.0) behind a 24h TTL, single-flighted across concurrent callers (#46)
  • Bounded retry budget keeps an unreachable source dictionary from stalling a CVE fetch on the full CVE retry budget; a caller-cancelled load no longer counts as an outage; brief-mode fetches skip the dictionary entirely
  • deps: @biomejs/biome ^2.5.5 → ^2.5.6

CHANGELOG v0.2.0

Assets 3
Loading