[ybelMekk]

[Copilot]

🟢 Approval recommended

No active review issues block the addition of KEV details to the CVE API.

No open issues 🎉

1 file not reviewed

• internal/graph/gengql/vulnerability.generated.go: Generated file

What changed in this PR

Adds known exploited vulnerability (KEV) details to the CVE API and updates vulnerability transformations to use the upstream KEV entry.

Changes:

• Exposes optional catalog descriptions, reference URLs, and description sources through CVE.kevEntry.
• Derives exploitation and ransomware signals from the upstream KEV object.
• Updates dependencies, generated GraphQL code, fixtures, and tests.

File	Description
internal/​vulnerability/​transform.go	Maps KEV details and exploitation signals.
internal/​vulnerability/​transform_test.go	Updates fixtures to use KEV objects.
internal/​vulnerability/​models.go	Adds the KEV model and CVE field.
internal/​vulnerability/​fake/​fakedata.go	Generates nested KEV data.
internal/​graph/​vulnerability.resolvers_test.go	Tests catalog details, absent entries, and partial data.
internal/​graph/​schema/​vulnerability.graphqls	Defines KEVEntry and exposes CVE.kevEntry.
internal/​graph/​gengql/​vulnerability.generated.go	Adds generated KEV field handling.
internal/​graph/​gengql/​root_.generated.go	Updates generated schema and complexity handling.
go.sum	Updates upstream API dependency checksums.
go.mod	Updates the upstream vulnerability API dependency.
eslint.config.js	Exempts KEVEntry from the ID requirement.

_{Review effort: Balanced}