Notice: Archiving the vulsio dictionary repositories

[shino]

Hi everyone,

We want to give the community advance notice that the vulsio "dictionary" repositories — long-standing dependencies of Vuls — will be archived as Vuls completes its transition to vuls.db–based detection.

Background

Vuls is gradually moving its detection backend to vuls.db, and the migration is already complete for the majority of OS ecosystems. The migration is automatic and requires no configuration on the user's side — if you are running a recent Vuls release, you are already benefiting from it. As a result, most of the dictionary OSS repositories that Vuls has historically depended on are no longer required.

In the latest release, v0.39.1, only the following three dependencies on vulsio repositories remain:

github.com/vulsio/go-cti            v0.3.6
github.com/vulsio/go-cve-dictionary v0.16.2
github.com/vulsio/gost              v0.7.4

Repositories to be archived

• https://github.com/vulsio/go-cpe-dictionary
• https://github.com/vulsio/go-cti
• https://github.com/vulsio/go-cve-dictionary
• https://github.com/vulsio/go-exploitdb
• https://github.com/vulsio/go-kev
• https://github.com/vulsio/go-msfdb
• https://github.com/vulsio/gost
• https://github.com/vulsio/goval-dictionary

The three repositories still referenced by Vuls (go-cti, go-cve-dictionary, gost) will be archived after they are fully removed from Vuls in a future release. The remaining five can be archived sooner since Vuls no longer depends on them.

Timeline

The exact dates are not yet fixed. Expect archival to happen gradually over roughly the next few weeks to three months. We'll proceed as the remaining migration work lands.

What "archived" means

• The repositories become read-only: no further releases, no merged PRs, no triage of new issues.
• Existing tags, releases, and source remain available, and existing module versions will continue to be installable via go get / Go modules.
• Existing open issues and pull requests will be left as-is and frozen in place — we will not be closing or migrating them.
• No further security patches or maintenance updates will be provided.

If you depend on these repositories

• Vuls users: no action needed. The migration to vuls.db is automatic and requires no configuration.
• Direct users of the libraries/CLIs: pin to a known-good version, or fork if you need continued maintenance.

A huge thank-you to everyone who contributed

These repositories have been the backbone of Vuls' detection for nearly a decade. To everyone who filed issues, sent pull requests, fixed parsers for the long tail of advisory formats, kept up with upstream data-source changes, and supported other users — thank you. The depth and breadth of contribution to the dictionary projects is what made Vuls possible in the first place, and that work doesn't disappear just because the repositories go read-only. It is preserved in the code, in vuls.db, and in everything Vuls does today.

Questions?

If you have questions, concerns, or a use case we should know about before archival, please reply to this discussion.