feat!(detector): replace go-kev with vuls2

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of “[WIP]” in the title.

What did you implement:

Remove go-kev dependency and replace KEVuln detection with vuls2-based
KEV enrichment pipeline supporting CISA, VulnCheck, and ENISA KEV.

• Remove detector/kevuln.go and all FillWithKEVuln call sites
• Remove KEVulnConf from config, TOML template, and subcmds
• Add enrichVulnerabilities() and enrichAdvisories() in vendor.go
  with explicit sourceID switch for each data source
• Add enrichVulnerabilityKEV() for CISA/VulnCheck KEV (vulnerability-based)
• Add enrichAdvisoryKEV() for ENISA KEV (advisory-based)
• Add enrichRedHatCVE() extracted from inline enrich() logic
• Use GetVulnerabilityDataByVulnerabilityID for unified vuln+advisory lookup
• Add ENISAKEVType and ENISAKEV struct to models
• Add unit tests for CISA, VulnCheck, and ENISA KEV enrichment
• Remove go-kev from dependabot.yml

Type of change

• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

unit test

Checklist:

You don't have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there aren't other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

[Copilot]

Pull request overview

This PR removes the legacy go-kev-backed KEVuln pipeline and shifts KEV enrichment to the vuls2 DB-based enrichment flow, including new fixtures/tests to validate CISA KEV and VulnCheck KEV mapping.

Changes:

• Removed go-kev integration: config (KEVulnConf), TOML template output, validation hooks, and the detector/kevuln.go implementation.
• Added vuls2 enrichment step to backfill vulnerability content (e.g., RedHat API data) and KEV data (CISA/VulnCheck) from the vuls2 DB.
• Updated module/dependency metadata and Dependabot ignore lists; added enrichment fixtures + unit tests.

Reviewed changes

Copilot reviewed 24 out of 25 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
subcmds/server.go	Drops KEVuln config init and removes KEVuln from DB validation call.
subcmds/report.go	Drops KEVuln config init.
subcmds/report_windows.go	Drops KEVuln config init for Windows report subcommand.
subcmds/discover.go	Removes [kevuln] section from generated TOML template output.
server/server.go	Removes gost RedHat fill and KEVuln fill from server-mode enrichment path.
go.sum	Removes go-kev hashes and updates other transitive deps.
go.mod	Removes go-kev, updates indirect deps, and adds a replace for vuls-data-update.
detector/vuls2/vuls2.go	Adds enrich(...) stage to pull non-detecting source content + KEV data from vuls2 DB.
detector/vuls2/vuls2_test.go	Adds unit tests validating enrichment for RedHat API + CISA/VulnCheck KEV.
detector/vuls2/vendor.go	Adds KEV mapping helpers + enrichment CVSS extraction and RedHatAPI source link handling.
detector/vuls2/testdata/fixtures/enrich/vulncheck-kev/datasource.json	Adds datasource fixture for VulnCheck KEV.
detector/vuls2/testdata/fixtures/enrich/vulncheck-kev/data/2021/CVE-2021-30713.json	Adds VulnCheck KEV vulnerability fixture.
detector/vuls2/testdata/fixtures/enrich/redhat-cve/datasource.json	Adds datasource fixture for RedHat CVE API.
detector/vuls2/testdata/fixtures/enrich/redhat-cve/data/CVE-2024-1102.json	Adds RedHat CVE API vulnerability fixture.
detector/vuls2/testdata/fixtures/enrich/cisa-kev/datasource.json	Adds datasource fixture for CISA KEV.
detector/vuls2/testdata/fixtures/enrich/cisa-kev/data/2022/CVE-2022-21971.json	Adds CISA KEV vulnerability fixture.
detector/vuls2/internal/test/test.go	Adds helper to populate a vuls2 DB from fixtures for unit tests.
detector/vuls2/export_test.go	Exposes enrich via Enrich for external-package tests.
detector/util.go	Removes KEVuln DB validation from ValidateDBs.
detector/kevuln.go	Deletes the go-kev-backed KEV enrichment implementation.
detector/detector.go	Removes gost RedHat fill and KEVuln fill from the generic detect/report pipeline.
config/vulnDictConf.go	Removes KEVulnConf type and env/config initialization.
config/tomlloader.go	Drops Conf.KEVuln from init list.
config/config.go	Removes KEVuln from config struct and validation list.
.github/dependabot.yml	Removes go-kev from ignore list.

Comments suppressed due to low confidence (1)

server/server.go:93

• Server mode no longer calls any KEV enrichment after detection. For Linux this may be covered by vuls2 enrichment, but Windows detection still uses gost (DetectPkgCves) and will now miss KEV data. Consider adding a vuls2-backed KEV enrichment step for Windows/non-vuls2 paths (or documenting the behavior change).

	nMetasploitCve, err := detector.FillWithMetasploit(&r, config.Conf.Metasploit, config.Conf.LogOpts)
	if err != nil {
		logging.Log.Errorf("Failed to fill with metasploit: %+v", err)
		http.Error(w, err.Error(), http.StatusServiceUnavailable)
	}
	logging.Log.Infof("%s: %d exploits are detected", r.FormatServerName(), nMetasploitCve)

	if err := detector.FillWithCTI(&r, config.Conf.Cti, config.Conf.LogOpts); err != nil {
		logging.Log.Errorf("Failed to fill with Cyber Threat Intelligences: %+v", err)
		http.Error(w, err.Error(), http.StatusServiceUnavailable)
	}

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 24 out of 25 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 3 comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 25 out of 26 changed files in this pull request and generated 1 comment.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.