fix: use project version in x_generator for accurate CNA tracking

[jgamblin]

Summary

The x_generator.engine field embedded in every published CVE record has been reporting the wrong version. It was using cveClientlib.js's internal _version (frozen at 1.0.15) instead of the actual project version (1.0.25).

Before: Every CVE record published by cveClient says "engine": "cveClient/1.0.15" — regardless of which release the CNA is actually running.

After: CVE records will correctly report "engine": "cveClient/1.0.25" (or whatever the current release is), using the single _version constant that stays in sync with CHANGELOG.md and package.json.

Why this matters

The x_generator tag is the only way to measure cveClient adoption across the CNA community. With accurate version reporting we can:

• Track adoption — See how many CNAs are using cveClient and which versions they're on
• Identify outdated installs — Reach out to CNAs still on older versions with security or compatibility fixes
• Demonstrate usage — Show the CVE community that cveClient is actively used, which helps justify continued development

Without this fix, every CNA appears to be on 1.0.15 no matter what, making version tracking impossible.

What changed

Three locations in cveInterface.js set x_generator before publishing — during CVE download, CVE publish, and CVE reject. Each was:

if(get_deep(client,'constructor.name') && client._version)
    obj["x_generator"] = {engine: client.constructor.name + "/" + client._version };

Now simplified to:

obj["x_generator"] = {engine: "cveClient/" + _version };

This also removes the unnecessary conditional — the tag should always be set.

Also removes two stale tests for getadp/deleteadp methods that were removed in PR #45.

Test plan

• All 49 tests pass locally
• CI passes on this PR

🤖 Generated with Claude Code

[sei-vsarvepalli]

I think my plan earlier was to use the cveClientLib version independent of the UI version. I can see it is worth capturing the UI version as the UI is building the JSON and the clientlib is universal can be used by Node as well without the UI. So depending on how it was launched we can provide different . Current version actually comes from

cveClient/cveClientlib.js

Line 8 in 4e96a9c

this._version = "1.0.15";

[jgamblin]

Updated based on your feedback @sei-vsarvepalli — here's what changed:

1. Synced cveClientlib._version from 1.0.15 to 1.0.25 so both paths report the same project version going forward.

2. Both UI and Node.js paths now report as cveClient/<version> to stay consistent with the existing entries in the CVE corpus:

149 cveClient/1.0.13
112 cveClient/1.0.15
 19 cveClient/1.0.14

3. publishcve() in cveClientlib.js now injects a default x_generator if the caller doesn't set one — so Node.js users get tracking automatically without needing to know about the field.

4. The UI-set x_generator is never overwritten — cveInterface.js sets it before calling publishcve(), and the lib only fills it in if missing.

Going forward we may want to consider keeping these versions in sync as part of the release process, or pulling from a single source of truth (e.g. package.json).