[afoote-mitre]

PR Stack

1. Add scoped search and CVE enrichment filters #133 - Add scoped search and CVE enrichment filters
2. This PR - Harden the v0.5.0 release behavior

This PR must merge after #133. It targets dev so the final review shows the complete release stack; once #133 merges, GitHub will reduce this PR to the eight focused remediation commits on v0.5.0-review.

Summary

This review follow-up addresses correctness, dependency, performance-boundary, observability, release metadata, and maintainability findings identified against v0.5.0-release.

Changes

Fail closed on incomplete OpenSearch responses

OpenSearch requests now disable partial search results and validate timeout state, shard failures, hit structure, and complete _source payloads before controllers can return a successful response.

Primary files:

• utils/searchProvider.js
• utils/searchResponseValidator.js
• utils/searchProvider.test.js
• utils/searchResponseValidator.test.js

Remediate repository-owned dependency advisories

Updated brace-expansion to 5.0.9 and js-yaml to 4.3.1, then regenerated the lockfile. The remaining adm-zip advisory is inherited through cve-core, has no available fix, and is outside this repository ownership boundary.

Primary files:

• package.json
• package-lock.json

Require CVSS tokens in one vector

CVSS token queries retain their OpenSearch candidate prefilter, then apply semantic filtering so all slash-delimited tokens supplied for one parameter must occur in the same eligible CVSS vector. Candidate source retrieval remains scope-aware and limited to required vector fields.

Primary files:

• utils/cvss.js
• utils/searchContainerMetrics.js
• utils/searchPostFilters.js
• utils/searchQueryBuilder.js
• utils/cvss.test.js
• utils/searchQueryBuilder.test.js
• README.md

Bound reference URL substring searches

Added a three-character minimum for referenceURL, including HTTP 400 validation, generated OpenAPI constraints, and user documentation. Existing wildcard escaping and the 2,048-character maximum remain unchanged.

Primary files:

• controllers/middleware.js
• utils/constants.js
• utils/errors.js
• routes/swagger.js
• api-docs/openapi.json
• README.md

Reject inverted date ranges

Publication, modification, SSVC timestamp, and KEV date-added pairs now reject a start later than the end. Equal boundaries remain valid because all four range contracts are inclusive.

Primary files:

• controllers/middleware.js
• utils/errors.js
• routes/swagger.js
• api-docs/openapi.json
• README.md

Correct semantic-search telemetry

CVSS, SSVC, and KEV semantic searches now report cache status as not_applicable; only CPE searches report hit, in-flight, or miss states because only CPE searches use the temporary application cache.

Primary files:

• utils/searchPerformance.js
• utils/searchPerformance.test.js

Align release metadata

Bumped package, lockfile, and generated OpenAPI metadata from 0.4.0-beta to 0.5.0-beta.

Primary files:

• package.json
• package-lock.json
• api-docs/openapi.json

Remove unreachable post-filter code

Removed the dead standard-search post-filter path and obsolete CPE-specific candidate builder wrapper. CPE semantic assertions now live with the generalized post-filter module they exercise.

Primary files:

• controllers/searchController.js
• utils/searchQueryBuilder.js
• utils/searchPostFilters.test.js
• controllers/searchController.test.js
• utils/searchQueryBuilder.test.js