v1.36.3 — Dependency check accuracy

v1.36.3 — Dependency check accuracy

check_dependencies and domain vulnerability lookups could miss CVEs whose package data came from GitHub advisories or MITRE, or match the wrong versions. This release fixes how affected-product ranges are stored and matched.

Fixes

• GitHub advisory and MITRE package ranges are kept. Comparator ranges such as >= 2.4.0, < 2.14.0 are now parsed into proper version bounds instead of being discarded or stored as raw text.
• Inclusive and exact bounds are honoured. Ranges ending in <= X and exact = X entries are matched correctly. An exact CPE version covers that release line (e.g. 1.2 → 1.2.x) unless the CVE lists individual patch versions for that line.
• Empty NVD updates no longer erase other sources' products. CVEs awaiting NVD analysis keep the ranges supplied by GitHub, MITRE or OSV.
• Ranked product search counts distinct CVEs, so one advisory with many rows can't push true matches out of the result window; platform-only rows are excluded.
• Backfill from OSV. CVEs covered by a GitHub advisory but missing product data are filled from OSV's copy of that advisory. OSV last_affected and last_known_affected_version_range are honoured. Existing gaps fill progressively over the next sync runs.
• fixed_in is now documented as the matched range's exclusive upper bound; it is omitted when the range has none.

Also included since v1.36.2: D3FEND mapping crawl fix, CWE lookup index, dependency updates.

Compatibility

No schema, endpoint or MCP tool changes (55 tools, 7 resources, 3 prompts). Response shape is unchanged; results for the same input are more accurate. Tests: 3,021 passing.