Migrate to NVD JSON 2.0 feeds

[nscuro]

No description provided.

[Copilot]

Pull Request Overview

This PR replaces the legacy NVD API client with direct HTTP downloads of NVD JSON 2.0 feeds, parses them via Jackson’s streaming API, and removes the need for the NVD_TOKEN.

• Introduces HttpClient‐based download, gzip decompression, and Jackson JsonParser looping
• Removes old NvdCveClient code and related scheduler/executor logic
• Cleans up documentation and CI workflows to drop NVD_TOKEN

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

File	Description
src/main/java/org/dependencytrack/vulndb/source/nvd/NvdImporter.java	Replaces API client with HTTP + streaming JSON importer; handles per-year feed downloads
README.md	Removed reference to NVD_TOKEN environment variable
.github/workflows/update-database.yml	Removed NVD_TOKEN from CI workflow

Comments suppressed due to low confidence (1)

README.md:47

• Since the importer no longer requires an NVD_TOKEN, update this section to explain that no NVD-specific credentials are needed or remove the placeholder entirely.

-  -e 'NVD_TOKEN=<your_nvd_token>' \

[Copilot]

IntStream.range(2002, LocalDate.now().getYear()) excludes the current year; use rangeClosed(start, LocalDate.now().getYear()) or adjust the end to include this year if you intend to fetch the latest feed.

Suggested change

	this.feedYears = IntStream.range(2002, LocalDate.now().getYear()).boxed().toList();
	this.feedYears = IntStream.rangeClosed(2002, LocalDate.now().getYear()).boxed().toList();

[Copilot]

The skip condition savedLastModified.isBefore(lastModified) || savedLastModified.isEqual(lastModified) is inverted: it prevents downloads when the remote feed is newer. It should only skip when savedLastModified is after or equal to lastModified.

Suggested change

	&& (savedLastModified.isBefore(lastModified) || savedLastModified.isEqual(lastModified))) {
	&& (savedLastModified.isAfter(lastModified) || savedLastModified.isEqual(lastModified))) {

[Copilot]

Calling storeVulnerabilities per individual vulnerability can be inefficient. Consider batching several Vulnerability objects into a single call to reduce database round trips.

Suggested change

	while (jsonParser.nextToken() != JsonToken.END_ARRAY) {
	final var defCveItem = objectMapper.readValue(jsonParser, DefCveItem.class);
	final Vulnerability vuln = convert(defCveItem.getCve());
	// TODO: Batching
	database.storeVulnerabilities(List.of(vuln));
	}
	final List<Vulnerability> vulnerabilities = new ArrayList<>();
	while (jsonParser.nextToken() != JsonToken.END_ARRAY) {
	final var defCveItem = objectMapper.readValue(jsonParser, DefCveItem.class);
	final Vulnerability vuln = convert(defCveItem.getCve());
	vulnerabilities.add(vuln);
	}
	database.storeVulnerabilities(vulnerabilities);