Struct CveDatabase 

pub struct CveDatabase { /* private fields */ }

CVE database for querying known vulnerabilities

Implementations

impl CveDatabase

pub fn builtin() -> Result<Self, CveDbError>

Load the built-in CVE database

pub fn from_file(path: &Path) -> Result<Self, CveDbError>

Load CVE database from a JSON file

pub fn from_json(json: &str) -> Result<Self, CveDbError>

Load CVE database from a JSON string

pub fn version(&self) -> &str

Get database version

pub fn updated_at(&self) -> &str

Get last update timestamp

pub fn entries(&self) -> &[CveEntry]

Get all entries

pub fn len(&self) -> usize

Get entry count

pub fn is_empty(&self) -> bool

Check if database is empty

pub fn check_product( &self, vendor: &str, product: &str, version: &str, ) -> Vec<&CveEntry>

Check if a product/version combination is affected by any CVE Returns matching CVE entries

pub fn check_product_by_name( &self, product: &str, version: &str, ) -> Vec<&CveEntry>

Check a product/version against all CVEs, ignoring vendor.

An npm package name uniquely identifies a product, but the same package can be recorded under different vendor strings across databases (the shipped DB uses modelcontextprotocol; a custom DB may use anthropic or geelen). Matching on product name avoids brittle vendor coupling that silently produced zero findings (issue #149).

pub fn create_findings( &self, vendor: &str, product: &str, version: &str, file_path: &str, line: usize, ) -> Vec<Finding>

Create findings for matching CVEs (vendor + product).

pub fn create_findings_by_product( &self, product: &str, version: &str, file_path: &str, line: usize, ) -> Vec<Finding>

Create findings for matching CVEs by product name, ignoring vendor.

Preferred for npm packages, where the package name is the reliable key and the recorded vendor string varies between databases (issue #149).

Trait Implementations

impl Default for CveDatabase

fn default() -> Self

Returns the “default value” for a type.