[afoote-mitre]

Summary

• Restore successful /webSearch responses when cve-core omits optional result metadata.
• Preserve fail-closed handling for malformed metadata and incomplete OpenSearch responses.
• Bump the project and generated API specification to 1.0.0-beta.

Why This Change Is Needed

cve-core returns successful CveResult objects with errors omitted. The Search API response validator required errors to be an array, so valid OpenSearch results were rejected and returned as sanitized HTTP 502 responses. The existing test fixtures always supplied errors: [], which did not represent the real cve-core success shape and masked the regression.

Changes

Change	Primary files	Reason
Normalize omitted optional notes and errors metadata to empty arrays while validating successful /webSearch responses	controllers/searchController.js	Accept the documented cve-core result shape without weakening malformed-response checks
Model real successful CveResult metadata and add malformed-metadata regression coverage	controllers/searchController.test.js	Prevent mocks from hiding the production incompatibility and retain fail-closed behavior
Verify route-level normalization of omitted metadata	routes/search.integration.test.js	Confirm the public response consistently contains notes and errors arrays
Set the release version to 1.0.0-beta	package.json, package-lock.json, api-docs/openapi.json	Keep package metadata, lockfile metadata, and generated OpenAPI documentation aligned

Validation

• Focused Jest controller and route integration suites: 52/52 passed.
• Live local /webSearch requests succeeded for default, CVE ID, and relevancy sorting.
• Search API Artillery smoke profile: 18/18 requests returned HTTP 200 with zero failed virtual users.
• ESLint, Prettier, and git diff --check passed for the changed files.