feat(detector): enrich MITRE CVE v5 via vuls2

[MaineK00n]

What did you implement:

Add MITRE CVE v5 (mitre-cve-v5) as a vuls2 enrich data source and remove the MITRE path from go-cve-dictionary. MITRE CveContent is now sourced from the vuls2 DB via the enrich pipeline rather than FillCvesWithGoCVEDictionary.

This mirrors the NVD migration in #2575 (feat!(detector): route NVD to vuls2).

Motivation

We are progressively moving CVE enrichment off go-cve-dictionary and onto vuls2's enrich pipeline (KEV, exploits, RedHat CVE, NVD, ENISA EUVD, …). MITRE CVE v5 is the next source to migrate.

Changes

• Bump vuls-data-update to the revision that adds the SSVC content field (feat(extract/mitre/cve/v5): extract SSVC from CNA/ADP metrics MaineK00n/vuls-data-update#862). vuls2 is kept at master's pinned version (Go MVS links the single newer vuls-data-update across the build).
• detector/vuls2/vuls2.go: add sourceTypes.MitreCVEV5 to the enrich DataSources filter.
• detector/vuls2/vendor.go: add enrichMitreCVE and a Mitre case in cveContentSourceLink. MITRE content is emitted one entry per CNA/ADP source (rendered as mitre(<source>)) so each source's CVSS, CWE, references, and SSVC decision point are reported separately. SSVC options (Exploitation / Automatable / Technical Impact) are mapped to models.SSVC via mitreSSVC.
• detector/detector.go / models/utils.go: drop ConvertMitreToModel and its use in FillCvesWithGoCVEDictionary.
• testdata: add a positive mitre-cve-v5 enrich test (CVE-2023-44487, including a CISA-ADP SSVC entry); move the "datasource not in filter" case to a new nvd-api-cve fixture.

Notes

• SSVC and CNA/ADP source labels are now preserved (previously lost when first drafted, before vuls-data-update#862). CVSS, CWE, references, summary, and dates are mapped per source.
• Requires the DB to carry mitre-cve-v5 data extracted with vuls-data-update#862 (db pipeline: ci(db): enable mitre-cve-v5 in db-main vulsio/vuls-data-db#177).

Fixes # (issue)

Type of change

• New feature (non-breaking change which adds functionality)

How Has This Been Tested?

• go build ./...
• go vet ./detector/... ./models/...
• make fmt (gofmt clean on touched files)
• go test ./detector/... ./models/... — all pass, including the mitre-cve-v5 Test_enrich case (asserts source-split contents + SSVC).

Checklist:

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR

Is this ready for review?: NO

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Migrate MITRE CVE v5 enrichment off go-cve-dictionary and into the vuls2 enrich pipeline, enabling per-CNA/ADP source CveContent entries (including SSVC) sourced from the vuls2 DB.

Changes:

• Add mitre-cve-v5 to the vuls2 enrich datasource filter and implement MITRE v5 enrichment mapping (incl. SSVC + per-source splitting).
• Remove the legacy go-cve-dictionary MITRE conversion path.
• Bump vuls-data-update / vuls2 deps and add/update enrich fixtures + tests for MITRE v5 and datasource filtering.

Reviewed changes

Copilot reviewed 10 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
models/utils.go	Removes legacy go-cve-dictionary MITRE→model conversion helper.
detector/detector.go	Stops filling MITRE CveContents from go-cve-dictionary in FillCvesWithGoCVEDictionary.
detector/vuls2/vuls2.go	Adds sourceTypes.MitreCVEV5 to vuls2 enrich datasource filter.
detector/vuls2/vendor.go	Adds MITRE v5 enrichment (enrichMitreCVE), SSVC mapping, and MITRE source link handling.
detector/vuls2/vuls2_test.go	Adds a positive MITRE v5 enrich test and makes comparisons order-insensitive for multi-entry contents.
detector/vuls2/testdata/fixtures/enrich/nvd-api-cve/datasource.json	New fixture datasource for “not in enrich filter” coverage.
detector/vuls2/testdata/fixtures/enrich/nvd-api-cve/data/CVE-2020-0001.json	New fixture CVE payload for “not in enrich filter” coverage.
detector/vuls2/testdata/fixtures/enrich/mitre-cve-v5/data/CVE-2024-1102.json	Removes prior “filtered out” MITRE fixture now that MITRE is enabled.
detector/vuls2/testdata/fixtures/enrich/mitre-cve-v5/data/CVE-2023-44487.json	Updates MITRE fixture to include SSVC + container role metadata.
go.mod	Bumps vuls-data-update and vuls2 versions.
go.sum	Updates module sums for the bumped dependencies.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 10 out of 11 changed files in this pull request and generated no new comments.

[shino]

⭐