Add JVN (Japan Vulnerability Notes) vulnerability data source

Implements ADR-031. Adds a vuln-data-source/jvn module (disabled by
default) that mirrors JVN iPedia from the yearly detail feeds
(jvndb_detail_YYYY.rdf, 1998-present), skipping years whose sha256 in
checksum.txt is unchanged since the last successful run.

Advisories are parsed from the VULDEF schema, converted to CycloneDX BOVs
and ingested through the existing mirror pipeline; no changes to
ingestion, storage, or matching. JVN-specific handling:

- CPE 2.2 URIs are normalised to CPE 2.3 formatted strings.
- The free-text Japanese VersionNumber field is parsed into vers ranges
  (e.g. "0.15.0 以上 0.15.2 未満" -> vers:generic/>=0.15.0|<0.15.2);
  products without a parseable version fall back to an all-versions range.
- Platform/edition qualifiers that JVN appends to version texts
  ("5.0 (client)", "Version 1809 for x64-based Systems", "12.04 LTS",
  "2013 SP1") are stripped in a salvage pass — NVD encodes the same
  qualifiers in separate CPE attributes (update/edition/target hardware),
  so the stripped version value matches NVD's representation. Cisco-style
  parenthesized build versions ("11.1(15)ca") are kept verbatim, as NVD
  does. Measured against all yearly feeds (813k VersionNumber entries),
  this halves the share of affected products whose version information
  would otherwise be lost (0.95% -> 0.49%).
- CWE ids are extracted from <RelatedItem type="cwe"> entries; their
  glossary URLs are skipped rather than emitted as advisory references.
- The Impact and Solution section descriptions are mapped to the
  CycloneDX detail and recommendation fields.
- Every advisory is stored under the JVN source, keyed by its JVNDB id.

Registers JVN in Vulnerability.Source, as the mirror validates source
names via Source.ofName.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: mitsukado-shinagawa <mitsukado-shinagawa@users.noreply.github.com>

Author: mitsukado-shinagawa

apiserver/pom.xml

@@ -222,6 +222,11 @@
             <artifactId>vuln-data-source-github</artifactId>
             <version>${project.version}</version>
         </dependency>
+        <dependency>
+            <groupId>org.dependencytrack</groupId>
+            <artifactId>vuln-data-source-jvn</artifactId>
+            <version>${project.version}</version>
+        </dependency>
         <dependency>
             <groupId>org.dependencytrack</groupId>
             <artifactId>vuln-data-source-nvd</artifactId>

apiserver/src/main/java/org/dependencytrack/model/Vulnerability.java

@@ -133,6 +133,7 @@ public enum Source {
         INTERNAL, // Internally-managed (and manually entered) vulnerability
         OSV,      // Google OSV Advisories
         SNYK,     // Snyk Purl Vulnerability
+        JVN,      // Japan Vulnerability Notes (JVN iPedia)
         UNKNOWN;  // Unknown vulnerability sources
 
         public static boolean isKnownSource(String source) {

vuln-data-source/jvn/pom.xml

@@ -0,0 +1,123 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  ~ This file is part of Dependency-Track.
+  ~
+  ~ Licensed under the Apache License, Version 2.0 (the "License");
+  ~ you may not use this file except in compliance with the License.
+  ~ You may obtain a copy of the License at
+  ~
+  ~   http://www.apache.org/licenses/LICENSE-2.0
+  ~
+  ~ Unless required by applicable law or agreed to in writing, software
+  ~ distributed under the License is distributed on an "AS IS" BASIS,
+  ~ WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  ~ See the License for the specific language governing permissions and
+  ~ limitations under the License.
+  ~
+  ~ SPDX-License-Identifier: Apache-2.0
+  ~ Copyright (c) OWASP Foundation. All Rights Reserved.
+  -->
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <parent>
+        <groupId>org.dependencytrack</groupId>
+        <artifactId>vuln-data-source-parent</artifactId>
+        <version>5.1.0-SNAPSHOT</version>
+    </parent>
+
+    <artifactId>vuln-data-source-jvn</artifactId>
+    <packaging>jar</packaging>
+
+    <name>Vulnerability Data Source :: JVN</name>
+
+    <properties>
+        <project.parentBaseDir>${project.basedir}/../..</project.parentBaseDir>
+    </properties>
+
+    <dependencies>
+        <dependency>
+            <groupId>org.dependencytrack</groupId>
+            <artifactId>vuln-data-source-api</artifactId>
+            <version>${project.version}</version>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.dependencytrack</groupId>
+            <artifactId>plugin-testing</artifactId>
+            <version>${project.version}</version>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>us.springett</groupId>
+            <artifactId>cpe-parser</artifactId>
+        </dependency>
+
+        <!-- Required at compile time by the jsonschema2pojo-generated config class. -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-annotations</artifactId>
+        </dependency>
+
+        <!-- Parses the JVN feed checksum.txt manifest; provided at runtime by Dependency-Track. -->
+        <dependency>
+            <groupId>com.fasterxml.jackson.core</groupId>
+            <artifactId>jackson-databind</artifactId>
+            <scope>provided</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>com.google.protobuf</groupId>
+            <artifactId>protobuf-java-util</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>io.github.nscuro</groupId>
+            <artifactId>versatile-core</artifactId>
+        </dependency>
+
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <scope>provided</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-simple</artifactId>
+            <scope>test</scope>
+        </dependency>
+
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter</artifactId>
+            <scope>test</scope>
+        </dependency>
+        <dependency>
+            <groupId>org.wiremock</groupId>
+            <artifactId>wiremock-standalone</artifactId>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+
+    <build>
+        <plugins>
+            <plugin>
+                <groupId>org.jsonschema2pojo</groupId>
+                <artifactId>jsonschema2pojo-maven-plugin</artifactId>
+                <executions>
+                    <execution>
+                        <goals>
+                            <goal>generate</goal>
+                        </goals>
+                    </execution>
+                </executions>
+                <configuration>
+                    <sourceDirectory>${basedir}/src/main/resources/org/dependencytrack/vulndatasource/jvn</sourceDirectory>
+                    <targetPackage>org.dependencytrack.vulndatasource.jvn</targetPackage>
+                    <generateBuilders>true</generateBuilders>
+                </configuration>
+            </plugin>
+        </plugins>
+    </build>
+
+</project>

vuln-data-source/jvn/src/main/java/org/dependencytrack/vulndatasource/jvn/JvnAdvisory.java

@@ -0,0 +1,60 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) OWASP Foundation. All Rights Reserved.
+ */
+package org.dependencytrack.vulndatasource.jvn;
+
+import org.jspecify.annotations.Nullable;
+
+import java.time.Instant;
+import java.util.List;
+
+/**
+ * A parsed JVN advisory, as returned by the MyJVN {@code getVulnDetailInfo} API.
+ *
+ * @since 5.1.0
+ */
+record JvnAdvisory(
+        String jvnDbId,
+        @Nullable String title,
+        @Nullable String overview,
+        @Nullable String detail,
+        @Nullable String recommendation,
+        List<String> cveIds,
+        List<Integer> cweIds,
+        List<Cvss> cvssList,
+        List<AffectedProduct> affected,
+        List<String> referenceUrls,
+        @Nullable Instant datePublic,
+        @Nullable Instant dateLastUpdated) {
+
+    /** An affected product: a single (product-level) CPE plus its Japanese version expressions. */
+    record AffectedProduct(
+            @Nullable String vendor,
+            @Nullable String productName,
+            String cpe22,
+            List<String> versionTexts) {
+    }
+
+    /** A CVSS rating attached to the advisory. */
+    record Cvss(
+            @Nullable String version,
+            @Nullable String severity,
+            @Nullable Double baseScore,
+            @Nullable String vector) {
+    }
+}

vuln-data-source/jvn/src/main/java/org/dependencytrack/vulndatasource/jvn/JvnClient.java

@@ -0,0 +1,107 @@
+/*
+ * This file is part of Dependency-Track.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * Copyright (c) OWASP Foundation. All Rights Reserved.
+ */
+package org.dependencytrack.vulndatasource.jvn;
+
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+
+import java.io.IOException;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpRequest;
+import java.net.http.HttpResponse;
+import java.net.http.HttpResponse.BodyHandlers;
+import java.time.Duration;
+import java.util.HashMap;
+import java.util.Map;
+
+/**
+ * A thin client for the JVN data feeds published under {@code https://jvndb.jvn.jp/ja/feed}.
+ * <p>
+ * Fetches the per-year detail feeds ({@code detail/jvndb_detail_YYYY.rdf}, full history 1988–present)
+ * and the {@code checksum.txt} manifest used to skip years whose feed has not changed. This is the
+ * same acquisition strategy used by go-cve-dictionary / Vuls, and — unlike the MyJVN
+ * {@code getVulnOverviewList} API — is not capped to the most-recent advisories.
+ *
+ * @since 5.1.0
+ */
+final class JvnClient {
+
+    static final String DEFAULT_FEED_BASE_URL = "https://jvndb.jvn.jp/ja/feed";
+
+    private static final ObjectMapper JSON = new ObjectMapper();
+
+    private final HttpClient httpClient;
+    private final String feedBaseUrl;
+
+    JvnClient(final HttpClient httpClient, final String feedBaseUrl) {
+        this.httpClient = httpClient;
+        this.feedBaseUrl = feedBaseUrl.endsWith("/")
+                ? feedBaseUrl.substring(0, feedBaseUrl.length() - 1)
+                : feedBaseUrl;
+    }
+
+    /** Downloads the full detail feed (a VULDEF document) for a single publication year. */
+    byte[] fetchDetailFeed(final int year) throws IOException, InterruptedException {
+        return get(feedBaseUrl + "/detail/" + detailFeedFilename(year));
+    }
+
+    /**
+     * Fetches {@code checksum.txt} and returns a map of feed filename to its {@code sha256} digest,
+     * so callers can skip re-downloading years whose feed is unchanged since the last run.
+     */
+    Map<String, String> fetchChecksums() throws IOException, InterruptedException {
+        final JsonNode array = JSON.readTree(get(feedBaseUrl + "/checksum.txt"));
+        final Map<String, String> digestByFilename = new HashMap<>();
+        if (array.isArray()) {
+            for (final JsonNode entry : array) {
+                final String filename = entry.path("filename").asText(null);
+                final String sha256 = entry.path("sha256").asText(null);
+                if (filename != null && sha256 != null) {
+                    digestByFilename.put(filename, sha256);
+                }
+            }
+        }
+        return digestByFilename;
+    }
+
+    /** The {@code checksum.txt} filename for a year's detail feed (e.g. {@code jvndb_detail_2015.rdf}). */
+    static String detailFeedFilename(final int year) {
+        return "jvndb_detail_" + year + ".rdf";
+    }
+
+    String feedBaseUrl() {
+        return feedBaseUrl;
+    }
+
+    private byte[] get(final String url) throws IOException, InterruptedException {
+        final HttpRequest request = HttpRequest.newBuilder()
+                .uri(URI.create(url))
+                .timeout(Duration.ofSeconds(60))
+                .header("User-Agent", "Dependency-Track JVN data source")
+                .GET()
+                .build();
+        final HttpResponse<byte[]> response = httpClient.send(request, BodyHandlers.ofByteArray());
+        if (response.statusCode() != 200) {
+            throw new IOException("Unexpected response code " + response.statusCode()
+                    + " from JVN feed: " + url);
+        }
+        return response.body();
+    }
+}