fix(cyclonedx): depend on public vdb-cyclonedx module so go install works

Consume github.com/Vulnetix/vdb-cyclonedx as a public tagged module (v0.1.0)
instead of a third_party/ copy behind a local replace. The replace was ignored by
'go install module@version' (it can only fetch from the module proxy), which broke
the documented 'go install github.com/vulnetix/cli/v3@latest' install path. Drop
the third_party copy and the replace; restore the Dockerfile dependency-cache
layer; replace the sync recipe with 'just update-vdb-cyclonedx <version>'.

Author: 0x73746F66

Dockerfile

@@ -6,13 +6,15 @@ WORKDIR /app
 # Install git (needed for go mod)
 RUN apk add --no-cache git
 
-# Copy the full source first. The go.mod replace points at the in-repo
-# third_party/vdb-cyclonedx copy, which must be present before dependency
-# resolution — so it cannot be split into a go.mod-only cache layer.
-COPY . .
+# Copy go mod files
+COPY go.mod go.sum ./
 
+# Download dependencies
 RUN go mod download
 
+# Copy source code
+COPY . .
+
 # Build the binary
 RUN CGO_ENABLED=0 GOOS=linux go build \
     -ldflags "-s -w -X github.com/vulnetix/cli/v3/cmd.version=docker" \

go.mod

@@ -4,7 +4,7 @@ go 1.25.0
 
 require (
 	github.com/Masterminds/semver/v3 v3.5.0
-	github.com/Vulnetix/vdb-cyclonedx v0.0.0
+	github.com/Vulnetix/vdb-cyclonedx v0.1.0
 	github.com/alecthomas/chroma/v2 v2.26.1
 	github.com/charmbracelet/bubbles v1.0.0
 	github.com/charmbracelet/bubbletea v1.3.10
@@ -94,12 +94,3 @@ require (
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	sigs.k8s.io/yaml v1.6.0 // indirect
 )
-
-// vdb-cyclonedx is the canonical CycloneDX parser/validator shared across the
-// Vulnetix Go services. The CLI is released as a standalone binary built from a
-// CLI-only checkout (Dockerfile / GitHub Action / goreleaser), so the sibling
-// module is not on disk at build time. We carry a synced copy under
-// third_party/ (refresh with: just sync-vdb-cyclonedx) and replace onto it so
-// release builds stay hermetic without full vendoring (which prunes the
-// go-tree-sitter CGO headers).
-replace github.com/Vulnetix/vdb-cyclonedx => ./third_party/vdb-cyclonedx

go.sum

@@ -7,6 +7,8 @@ github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERo
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.4.1 h1:9RfcZHqEQUvP8RzecWEUafnZVtEvrBVL9BiF67IQOfM=
 github.com/ProtonMail/go-crypto v1.4.1/go.mod h1:e1OaTyu5SYVrO9gKOEhTc+5UcXtTUa+P3uLudwcgPqo=
+github.com/Vulnetix/vdb-cyclonedx v0.1.0 h1:LI/8ypN7MabidtCcjUFCjI5CSG+WS6BfX/FxHGS/1nw=
+github.com/Vulnetix/vdb-cyclonedx v0.1.0/go.mod h1:0YeNSe1jhyjAZdAQ8Atkj8wZj2XzLjVXdu3P6qlTBh8=
 github.com/agnivade/levenshtein v1.2.1 h1:EHBY3UOn1gwdy/VbFwgo4cxecRznFk7fKWN1KOX7eoM=
 github.com/agnivade/levenshtein v1.2.1/go.mod h1:QVVI16kDrtSuwcpd0p1+xMC6Z/VfhtCyDIjcwga4/DU=
 github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=

justfile

@@ -502,22 +502,12 @@ deps:
     go mod download
     go mod tidy
 
-# Refresh the in-repo copy of the canonical vdb-cyclonedx module. The CLI is
-# released from a standalone checkout (no sibling on disk), so we carry a synced
-# copy under third_party/ and replace onto it. Run this after changing
-# ../vdb-cyclonedx so the CLI picks up the new parser/validator + schemas.
-sync-vdb-cyclonedx:
-    #!/usr/bin/env bash
-    set -euo pipefail
-    src="../vdb-cyclonedx"
-    dst="third_party/vdb-cyclonedx"
-    if [ ! -d "$src" ]; then echo "ERROR: $src not found (clone it alongside the CLI)"; exit 1; fi
-    rm -rf "$dst"
-    mkdir -p "$dst"
-    cp -a "$src"/. "$dst"/
-    rm -rf "$dst/.git" "$dst/.vulnetix"
+# Bump the pinned vdb-cyclonedx version. vdb-cyclonedx is a public tagged Go
+# module (github.com/Vulnetix/vdb-cyclonedx); tag a new release there, then run
+# this to point the CLI at it.
+update-vdb-cyclonedx VERSION:
+    go get github.com/Vulnetix/vdb-cyclonedx@{{VERSION}}
     go mod tidy
-    echo "synced $dst from $src"
 
 # Build and run with test UUID
 run: build