feat: implement cpe matching and nvd importer#2518

Open

rlang-ta wants to merge 20 commits into

guacsec:mainfrom

rlang-ta:cpe-matching

Commits on Jul 15, 2026

feat(common): parse CPE 2.3 formatted strings

rlang-ta
and
claude
committed
feat(ingestor): ingest cpe23Type external references from SPDX

rlang-ta
and
claude
committed
feat(entity): add cpe_status table for CPE-keyed vulnerability statuses

rlang-ta
and
claude
committed
feat(ingestor): store CPE applicability from CVE records as cpe_status

rlang-ta
and
claude
committed
feat(ingestor): ingest affected entries from CVE ADP containers

rlang-ta
and
claude
committed
feat(fundamental): match SBOM package CPEs against cpe_status in SBOM details

rlang-ta
and
claude
committed
feat(fundamental): include CPE matches in batch severity counts

rlang-ta
and
claude
committed
fix(ingestor): skip unknown-status entries in CVE CPE ingestion

rlang-ta
and
claude
committed
feat(ingestor): add NVD advisory loader and NVD document format

rlang-ta
and
claude
committed
feat(importer): add NVD importer with per-year feed ingestion

rlang-ta
and
claude
committed
feat(fundamental): backlink SBOMs matched via package CPE in vulnerability details

rlang-ta
and
claude
committed
Merge branch 'main' into cpe-matching
rlang-ta
authored
feat(entity): persist CPE 2.3 extended attributes

rlang-ta
and
claude
committed
test(fundamental): cover NVD unbounded ranges and exact CPE boundaries

rlang-ta
and
claude
committed
Merge remote-tracking branch 'upstream/main' into cpe-matching
rlang-ta
committed