rename cvemap to vulnx#432
Conversation
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. Please check the settings in the CodeRabbit UI or the You can disable this status message by setting the Note Other AI code review bot(s) detectedCodeRabbit has detected other AI code review bot(s) in this pull request and will avoid duplicating their findings in the review comments. This may lead to a less comprehensive review. WalkthroughThe pull request systematically renames the project from CVEMap (cvemap) to vulnx across the entire codebase. This includes updating package declarations, import paths, module references, command entry points, CLI implementations, type definitions, and documentation to consistently reference the new project name. Changes
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~25 minutes
🚥 Pre-merge checks | ✅ 3 | ❌ 2❌ Failed checks (2 warnings)
✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
dogancanbakir
force-pushed
the
fix/rename-cvemap-to-vulnx
branch
from
2ebdcde to
c412edb
Compare
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (7)
pkg/service/vulnx.go (1)
20-28: Incomplete rename:Cvemapstruct andCVEMAP_API_URLenvironment variable not updated to align with file and package rename.The file has been renamed to
vulnx.goand the import path updated, but several identifiers still use the old naming throughout the codebase:
CVEMAP_API_URLenvironment variable (line 21) — inconsistent with new naming schemeCvemapstruct (line 25) — file namedvulnx.gobut exportsCvemaptypeNewCvemapconstructor (line 41) — creates API inconsistencyThis creates confusion where users import from
vulnx/pkg/servicebut useservice.Cvemapandservice.NewCvemap. The struct is actively used across the codebase (runner.go, testutils), so updates need to be coordinated.🔧 Suggested fix for consistency
var ( - BaseUrl = env.GetEnvOrDefault("CVEMAP_API_URL", "https://cve.projectdiscovery.io/api/v1") + BaseUrl = env.GetEnvOrDefault("VULNX_API_URL", "https://cve.projectdiscovery.io/api/v1") ErrUnAuthorized = errorutil.New(`unauthorized: 401 (get your free api key from https://cloud.projectdiscovery.io)`) ) -type Cvemap struct { +type Vulnx struct { opts *Options client *retryablehttp.Client }Update constructor and all method receivers, then update usages in pkg/runner/runner.go (lines 225, 242, 248, 284, 291, 293) and pkg/testutils/util.go.
DEVELOPMENT.md (1)
16-17: Stale reference to removedbuild-vulnxtarget.The documentation references
make build-vulnx, but according to the Makefile changes, thebuild-vulnxtarget has been removed. Only thebuildtarget remains, which now builds the vulnx binary directly.Proposed fix
-# Build vulnx binary -make build-vulnx +# Run tests +make testAlternatively, remove this redundant section since
make buildalready builds vulnx.Makefile (1)
70-70:.PHONYreferences non-existentbuild-vulnxtarget.The
build-vulnxtarget is listed in.PHONYbut doesn't exist in the Makefile. Either remove it from.PHONYor add the target.Proposed fix
-.PHONY: all build build-vulnx integration tidy fmt vet test lint pre-push pre-commit git-hooks fix-deps +.PHONY: all build integration tidy fmt vet test lint pre-push pre-commit git-hooks fix-depscmd/integration-test/server.go (1)
26-30: Rename the server banner to “vulnx”.
The log message still references “Cvemap”, which is inconsistent with the repo rename.✏️ Proposed update
- fmt.Println("Cvemap test server listening on 8080...") + fmt.Println("vulnx test server listening on 8080...")pkg/tools/analyze/groupby.go (1)
116-127: Avoid bypassing facet-size caps in MCPHandler.
MCPHandler convertsfield=sizetofield:sizebefore Analyze runs. Analyze only parses=, so per-field size caps are skipped for MCP calls, defeating the 200-limit guard.🛡️ Proposed fix (let Analyze cap & normalize)
- // fix request fields format - for i, f := range fields { - if strings.Contains(f, "=") { - fields[i] = strings.ReplaceAll(f, "=", ":") - } - } + // Keep raw field expressions; Analyze will cap sizes and normalize.cmd/vulnx/clis/common.go (2)
517-525: Inconsistent error handling: string comparison instead oferrors.Is.Lines 519-522 use
err.Error() == "not found"for error checking, whilecmd/vulnx/clis/id.go(lines 132, 206) correctly useserrors.Is(err, vulnx.ErrNotFound). This inconsistency could cause issues if the error message format changes.Suggested fix
vuln, err := handler.Get(vulnID) if err != nil { - if err.Error() == "not found" { + if errors.Is(err, vulnx.ErrNotFound) { gologger.Warning().Msgf("Vulnerability not found: %s", vulnID) continue }
588-596: Same inconsistent error handling pattern.This is another occurrence of
err.Error() == "not found"that should useerrors.Is(err, vulnx.ErrNotFound)for consistency.Suggested fix
vuln, err := handler.Get(vulnID) if err != nil { - if err.Error() == "not found" { + if errors.Is(err, vulnx.ErrNotFound) { gologger.Warning().Msgf("Vulnerability not found: %s", vulnID) continue }
🤖 Fix all issues with AI agents
In @.gitignore:
- Around line 23-27: The .gitignore contains a duplicate entry for
/cmd/vulnx/vulnx; remove the redundant line so the path appears only once
(locate the repeated '/cmd/vulnx/vulnx' entries and delete the extra
occurrence).
In `@pkg/testutils/util.go`:
- Around line 12-13: The doc comment above RunVulnxBinaryAndGetResults is stale
and references RunCvemapßBinaryAndGetResults; update the comment to correctly
reference the current function name RunVulnxBinaryAndGetResults (and fix any
stray characters like ß) so the comment describes the function signature and
behavior accurately.
In `@README.md`:
- Around line 5-7: The badge images in README.md lack alt text which hurts
accessibility; update each <img> tag (e.g., the badges with src
"https://goreportcard.com/badge/github.com/projectdiscovery/vulnx",
"https://img.shields.io/badge/go-reference-blue", and
"https://img.shields.io/github/release/projectdiscovery/vulnx") to include
meaningful alt attributes (e.g., alt="Go Report Card: projectdiscovery/vulnx",
alt="Go reference documentation", alt="vulnx GitHub release") so screen readers
can convey the badge purpose.
🧹 Nitpick comments (9)
pkg/tools/tools.go (1)
34-36: Optional cleanup: remove commented-out stub to avoid drift.
IfAllMCPPromptsisn’t used, consider deleting the commented block.🧹 Proposed cleanup
-// // AllMCPPrompts returns all prompt templates for ProjectDiscovery vulnerability.sh (vulnx) MCP integration. -// func AllMCPPrompts(client *vulnx.Client) []templates.PromptTemplate { -// return templates.AllPromptTemplates(client) -// }cmd/vulnx/clis/analyzehelp.go (1)
36-58: Table output should explicitly useos.Stdout.Per coding guidelines, table rendering should use
table.NewWriter()with output set toos.Stdout. Currently,tbl.Render()on Line 58 writes to the default writer which may not beos.Stdout.♻️ Suggested fix
+import "os" + // Render table with only facet-capable fields tbl := table.NewWriter() + tbl.SetOutputMirror(os.Stdout) tbl.SetStyle(table.StyleRounded)And change Line 58:
- tbl.Render() + fmt.Println(tbl.Render())Or use
SetOutputMirrorand callRender()without capturing return value.Makefile (1)
15-16: Version injection is properly configured via GoReleaser for releases.The Makefile's build target uses only
-s -wldflags for local builds. However, the.goreleaser.ymlis correctly configured to inject version information via-X github.com/projectdiscovery/vulnx/cmd/vulnx/clis.Version={{.Version}}for release builds, matching the Version variable incmd/vulnx/clis/version.go.If you want version information in local builds, consider adding version ldflags to the Makefile's LDFLAGS variable (e.g.,
-X github.com/projectdiscovery/vulnx/cmd/vulnx/clis.Version=dev), but this is optional since release builds are properly handled.cmd/integration-test/main.go (1)
57-65: Consider returning an error when tests fail.The
runIntegrationTestsfunction always returnsnileven when tests fail. This means the integration test process will exit with code 0 (success) even if tests fail.♻️ Proposed fix
func runIntegrationTests() error { fmt.Println("Running Vulnx integration tests...") + var failedTests int for testName, testcase := range testCases { if err := testcase.Execute(); err != nil { fmt.Fprintf(os.Stderr, "%s Vulnx Test \"%s\" failed: %s\n", failed, testName, err) + failedTests++ } else { fmt.Printf("%s Vulnx Test \"%s\" passed!\n", success, testName) } } + if failedTests > 0 { + return fmt.Errorf("%d test(s) failed", failedTests) + } return nil }pkg/runner/runner.go (1)
223-226: RenameCvemapServicetoVulnxServicefor consistency with the vulnx branding effort.The
Runnerstruct and its methods currently use the oldCvemapServicename andservice.Cvemaptype, despite the service package file being renamed tovulnx.go. This inconsistency should be resolved by renaming:
- Field
CvemapService→VulnxService(lines 225, 248)- Type
service.Cvemap→service.Vulnx(line 225)- Constructor call
service.NewCvemap()→service.NewVulnx()(line 242)- All references throughout the file (lines 284, 291, 293)
This requires corresponding type and function renames in
pkg/service/vulnx.gofirst.pkg/tools/filters/filters.go (2)
28-31: Stale comment references "CVEMap API" instead of the new product name.The comment on line 29 still says "CVEMap API" while the code has been renamed to vulnx. Consider updating to "vulnerability.sh API" or "vulnx API" for consistency with the rest of the rename.
Suggested fix
// List retrieves the full list of vulnerability filter definitions from the -// CVEMap API. It forwards the call to vulnx.Client.GetVulnerabilityFilters +// vulnerability.sh API. It forwards the call to vulnx.Client.GetVulnerabilityFilters // using a background context. func (h *Handler) List() ([]vulnx.VulnerabilityFilter, error) {
43-54: Unusedclientparameter inMCPHandler.The
client *vulnx.Clientparameter is never used inside the returned function—h.List()already uses the handler's internalh.client. This matches the pattern in other handlers (e.g.,pkg/tools/id/id.go,pkg/tools/search/search.go) where the parameter appears to be part of a common interface signature but is unused when the handler already holds the client.If this parameter is required by the
MCPToolinterface contract, consider adding a brief comment explaining why it exists but is unused. Otherwise, if the interface allows, remove it to avoid confusion.cmd/vulnx/clis/id.go (1)
344-356: ID validation is minimal—consider adding CVE format validation.The
validateSingleIDfunction only checks for empty strings and length bounds (3-50 characters). It doesn't validate the CVE format (e.g.,CVE-YYYY-NNNN+). While the API will likely reject invalid IDs, client-side validation could provide faster feedback.This is a pre-existing behavior, so not blocking for this rename PR.
cmd/vulnx/clis/common.go (1)
1034-1036: Self-referential comment is confusing.The comment says "Format version status exactly like vulnx" but this code IS vulnx. This appears to be a remnant from when the code was comparing against another tool's format.
Suggested fix
- // Format version status exactly like vulnx + // Format version status using standard ProjectDiscovery format description := updateutils.GetVersionDescription(currentVersion, latestVersion) gologger.Info().Msgf("Current vulnx version %s %s", currentVersion, description)
![cursor[bot]](https://avatars.githubusercontent.com/in/1210556?s=60&v=4){kind=small}
There was a problem hiding this comment.
Cursor Bugbot has reviewed your changes and found 3 potential issues.
Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.
This PR is being reviewed by Cursor Bugbot
Details
Your team is on the Bugbot Free tier. On this plan, Bugbot will review limited PRs each billing cycle for each member of your team.
To receive Bugbot reviews on all of your PRs, visit the Cursor dashboard to activate Pro and start your 14-day free trial.
dogancanbakir
force-pushed
the
fix/rename-cvemap-to-vulnx
branch
from
c412edb to
377bf2f
Compare
- Change `-id` flag to `id` subcommand in CveIDTestCase - Use `--json` and `--silent` long flags instead of short forms - Fix expected help output case sensitivity Addresses PR review feedback about CLI flag format. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Update mock server to handle /v2/vulnerability endpoints
- Add /v2/vulnerability/{id} endpoint for GetVulnerabilityByID
- Add /v2/vulnerability/search endpoint for SearchVulnerabilities
- Keep legacy /api/v1/cves endpoint for backwards compatibility
- Update client to respect VULNX_API_URL environment variable
- Add BaseURLEnvVar constant for environment variable name
- Check env var during client initialization before using default
- Fix integration test configuration
- Update base URL to http://localhost:8080 (without /api/v1 suffix)
- Fix expected JSON output format to include spaces after colons
- Add convertToVulnerability helper to convert legacy CVEData to new type
Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
- Change DefaultBaseURL from staging to production API server (https://api.projectdiscovery.io) - Update workflow to set VULNX_API_URL env var for race condition tests instead of the unused PDCP_API_SERVER Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
Update comments and script messages to use "Vulnx" instead of "CVEMap": - scripts/fix-dependencies.sh - scripts/pre-commit.sh - pkg/tools/filters/filters.go Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
* rename cvemap to vulnx (#432) * rename cvemap to vulnx * fix: use subcommand format for integration tests - Change `-id` flag to `id` subcommand in CveIDTestCase - Use `--json` and `--silent` long flags instead of short forms - Fix expected help output case sensitivity Addresses PR review feedback about CLI flag format. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: update integration tests for new v2 API endpoints - Update mock server to handle /v2/vulnerability endpoints - Add /v2/vulnerability/{id} endpoint for GetVulnerabilityByID - Add /v2/vulnerability/search endpoint for SearchVulnerabilities - Keep legacy /api/v1/cves endpoint for backwards compatibility - Update client to respect VULNX_API_URL environment variable - Add BaseURLEnvVar constant for environment variable name - Check env var during client initialization before using default - Fix integration test configuration - Update base URL to http://localhost:8080 (without /api/v1 suffix) - Fix expected JSON output format to include spaces after colons - Add convertToVulnerability helper to convert legacy CVEData to new type Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * fix: use production API URL as default and update workflow env var - Change DefaultBaseURL from staging to production API server (https://api.projectdiscovery.io) - Update workflow to set VULNX_API_URL env var for race condition tests instead of the unused PDCP_API_SERVER Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> * chore: rename remaining CVEMap references to Vulnx Update comments and script messages to use "Vulnx" instead of "CVEMap": - scripts/fix-dependencies.sh - scripts/pre-commit.sh - pkg/tools/filters/filters.go Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com> --------- Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com> * bump version --------- Co-authored-by: Tarun Koyalwar <tarun@projectdiscovery.io> Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>
3 participants
Fixes #426
Note
Major rebrand and namespace migration from
cvemaptovulnx.cmd/vulnx/; removescmd/cvemap/github.com/projectdiscovery/vulnxand all imports/types (cvemap→vulnx)CVEMAP_API_URL→VULNX_API_URL)Dockerfile.vulnx→projectdiscovery/vulnx)vulnxvulnxbranding and commandsWritten by Cursor Bugbot for commit 377bf2f. This will update automatically on new commits. Configure here.
Summary by CodeRabbit
New Features
vulnxcommand (previouslycvemap)Chores
✏️ Tip: You can customize this high-level summary in your review settings.