Remove MitreCVE feed backend (#16519)

[janriokrause]

Summary

• Deletes the mitre_cve_feed view, parse_cve_id and add_or_update_cve functions, and all related imports and tests
• Removes the commented-out cve-feed.json URL pattern (FIXME from Stop serving cve-feed.json on any path #16542)

Notes

The gone() redirect in redirects.py (#16521) is intentionally kept so the old URL continues to return 410. The security/partials/cve.html template is also kept. It renders CVE entries on advisory detail pages and is unrelated to the feed.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.78%. Comparing base (979bbe4) to head (674b6d8).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #17142      +/-   ##
==========================================
- Coverage   81.85%   81.78%   -0.08%     
==========================================
  Files         175      175              
  Lines        9410     9376      -34     
==========================================
- Hits         7703     7668      -35     
- Misses       1707     1708       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Removes the deprecated Mitre CVE feed backend from the security app, completing the decommissioning work started in #16521 / #16542 while keeping the 410 Gone redirect behavior in place via bedrock/security/redirects.py.

Changes:

• Removed the MitreCVE model and its JSON feed view, along with related imports and management-command logic.
• Deleted Mitre CVE model tests and removed the stale commented-out URL pattern for cve-feed.json.
• Added migration 0009_delete_mitrecve to drop the MitreCVE database table.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
bedrock/security/views.py	Removes the Mitre CVE JSON feed view and MitreCVE dependency.
bedrock/security/urls.py	Removes the leftover commented-out cve-feed.json URL pattern reference.
bedrock/security/tests/test_models.py	Deletes MitreCVE model tests and removes the import.
bedrock/security/models.py	Deletes the MitreCVE model class.
bedrock/security/migrations/0009_delete_mitrecve.py	Drops the MitreCVE table via DeleteModel.
bedrock/security/management/commands/update_security_advisories.py	Removes CVE-feed-specific parsing/upsert logic and the MitreCVE clear step.

[janriokrause]

Just removed the migration from this commit and created a separate PR #17143.

[stevejalim]

Just removed the migration from this commit and created a separate PR #17143.

Looking at the failing test test_no_missing_migrations it seems that Django detects the deleted Model class and expects there to be a complementary migration.

I think we can balance this by keeping the Model definition in this PR (you can remove the custom methods if you want) and focus on dropping the non-models.py code in this PR, then in #17143 delete the Model definition there, along with the migration to drop the table. How does that seem to you @janriokrause ?

[janriokrause]

Great. Thanks for the hint. Updated both PRs.

[stevejalim]

Might be worth a search for MitreCVE in the codebase in general - I see it's still included in the export-db-to-sqlite.sh script and can come out of there, too - either in this PR or in the one that drops the model - it won't really matter

[janriokrause]

Removed MitreCVE from export-db-to-sqlite.sh in the follow-up PR #17143.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 1 comment.

[Copilot]

Consider cleaning up the remaining MitreCVE model/table as part of this decommissioning. After this change, the update_security_advisories --clear-db path no longer deletes MitreCVE rows, and MitreCVE also appears to be otherwise unused (only the model/migrations remain), which can leave stale data in the DB and ongoing schema maintenance overhead. Options: add a migration to remove the model/table, or (if you’re intentionally keeping the table temporarily) keep deleting it here and/or add a short comment explaining why it’s retained.

[janriokrause]

Model/table will be deleted in a follow-up PR #17143, following the multi-release process of migrations.