feat(nvd): update cves

[tsim-sap]

Description

Adds an NVD update mode that periodically syncs modified CVEs back into Heureka, plus several additional fixes.

What type of PR is this? (check all applicable)

• 🍕 Feature

Related Tickets & Documents

• Closes feat(nvd): update cves #1242

Remove if not applicable

Added tests?

• Separate ticket for tests # (issue/pr)

Added to documentation?

• 🙅 no documentation needed

Checklist

• My code follows the style guidelines of this project
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes

[Copilot]

Pull request overview

Adds an “update mode” to the NVD scanner so it can periodically re-fetch CVEs modified in NVD (by last-modified date) and update existing Heureka Issues/IssueVariants when relevant fields change.

Changes:

• Extend NVD scanner config and main flow to support an update mode with a configurable review interval.
• Add processor logic (ProcessOrUpdate) plus new GraphQL queries/mutations to fetch and update Issues/IssueVariants.
• Extend Helm chart to deploy an additional CronJob for periodic update scans.

Reviewed changes

Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
scanner/nvd/scanner/config.go	Adds UpdateMode and ReviewIntervalDays config for last-modified update scanning.
scanner/nvd/processor/processor.go	Adds update path that queries existing Issues and conditionally updates Issue/IssueVariant.
scanner/nvd/main.go	Adds update-mode execution path and passes contexts through processing; adjusts time-window start timestamp.
scanner/nvd/client/queries/issuevariant_update.graphql	Adds GraphQL mutation to update an IssueVariant.
scanner/nvd/client/queries/issues_query.graphql	Extends issue query to include IssueVariant + CVSS vector for change detection.
scanner/nvd/client/queries/issue_update.graphql	Adds GraphQL mutation to update an Issue.
scanner/nvd/chart/nvd-scanner/values.yaml	Adds chart values for enabling/scheduling the update CronJob and review interval.
scanner/nvd/chart/nvd-scanner/templates/cronjob.yaml	Adds a second CronJob to run the scanner in update mode.

Comments suppressed due to low confidence (1)

scanner/nvd/main.go:120

• processCVESConcurrently’s semaphore does not actually cap concurrency: the worker goroutines continuously send tokens on an unbuffered channel, and each CVE goroutine consumes one token without returning it, so all CVE goroutines can proceed concurrently. This can cause unbounded parallel GraphQL/API calls (especially problematic in update mode).

	// sem is an unbuffered channel meaning that sending onto it will block
	// until there's a corresponding receive operation
	sem := make(chan struct{})

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.