feat!(detector): replace go-exploitdb with vuls2

[MaineK00n]

If this Pull Request is work in progress, Add a prefix of "[WIP]" in the title.

What did you implement:

Remove the go-exploitdb dependency entirely and migrate exploit enrichment to vuls2 EnrichVulnInfos pipeline.

Changes:

• Define models.ExploitType as a native string type with constants matching go-exploitdb values:
  • ExploitTypeExploitDB = "OffensiveSecurity"
  • ExploitTypeGitHub = "GitHub"
  • ExploitTypeInTheWild = "InTheWild"
  • ExploitTypeTrickest = "Trickest"
  • ExploitTypeNuclei = "Nuclei"
  • ExploitTypeNVD = "nvd"
• Add enrichExploits() to enrichVulnerabilities() in vuls2/vendor.go to handle ExploitExploitDB/GitHub/InTheWild/Trickest/NucleiRepository sources
• Add exploit source IDs to the DataSources filter in enrich() so exploit data is fetched from the vuls2 DB
• Remove FillWithExploit() calls from detector.go and server.go
• Remove ExploitConf and [exploit] TOML config section (no longer needed)
• Delete detector/exploitdb.go and detector/exploitdb_test.go
• Remove go-exploitdb from go.mod

BREAKING CHANGE: The [exploit] TOML config section and EXPLOITDB_* environment variables no longer have any effect. Exploit data is now sourced exclusively from the vuls2 database.

Type of change

• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How Has This Been Tested?

unit test (Test_enrich with fixture data for all 5 exploit sources)

Checklist:

You do not have to satisfy all of the following.

• Write tests
• Write documentation
• Check that there are not other open pull requests for the same issue/feature
• Format your source code by make fmt
• Pass the test by make test
• Provide verification config / commands
• Enable "Allow edits from maintainers" for this PR
• Update the messages below

Is this ready for review?: YES

Reference

[Copilot]

Pull request overview

Migrates exploit enrichment from the legacy go-exploitdb integration to the vuls2 EnrichVulnInfos pipeline, fully removing the go-exploitdb dependency and related runtime/config behaviors.

Changes:

• Add exploit-source enrichment (ExploitDB/GitHub/InTheWild/Trickest + Nuclei repository) to the vuls2 vendor enrichment path and source allowlist.
• Replace models.Exploit.ExploitType dependency on go-exploitdb types with a native models.ExploitType string type + constants.
• Remove old exploitdb enrichment flow (FillWithExploit call sites, exploitdb client implementation/tests) and update module dependencies/fixtures accordingly.

Reviewed changes

Copilot reviewed 23 out of 24 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
server/server.go	Removes legacy exploitdb enrichment from server-mode request handling.
models/vulninfos.go	Introduces native ExploitType type/constants and updates Exploit model field type.
models/utils.go	Switches NVD exploit tagging to use the new ExploitTypeNVD constant.
go.mod	Drops github.com/vulsio/go-exploitdb and bumps several dependencies.
go.sum	Updates dependency checksums in line with go.mod changes.
detector/vuls2/vuls2.go	Expands vuls2 enrichment query allowlist to include exploit + nuclei sources.
detector/vuls2/vuls2_test.go	Adds enrichment tests for exploit-* and nuclei-repository sources.
detector/vuls2/vendor.go	Adds enrichExploits() and wires it into enrichVulnerabilities().
detector/vuls2/vendor_test.go	New unit tests for enrichExploits() source-to-model conversion.
detector/vuls2/testdata/fixtures/enrich/nuclei-repository/datasource.json	Adds fixture datasource metadata for nuclei repository.
detector/vuls2/testdata/fixtures/enrich/nuclei-repository/data/2017/CVE-2017-18565.json	Adds nuclei exploit fixture with verified=true.
detector/vuls2/testdata/fixtures/enrich/nuclei-repository/data/2017/CVE-2017-14535.json	Adds nuclei exploit fixture without verified field.
detector/vuls2/testdata/fixtures/enrich/exploit-trickest/datasource.json	Adds fixture datasource metadata for trickest source.
detector/vuls2/testdata/fixtures/enrich/exploit-trickest/data/2017/CVE-2017-7273.json	Adds trickest exploit fixture data.
detector/vuls2/testdata/fixtures/enrich/exploit-inthewild/datasource.json	Adds fixture datasource metadata for inthewild source.
detector/vuls2/testdata/fixtures/enrich/exploit-inthewild/data/2017/CVE-2017-16885.json	Adds inthewild exploit fixture data.
detector/vuls2/testdata/fixtures/enrich/exploit-github/datasource.json	Adds fixture datasource metadata for github PoC source.
detector/vuls2/testdata/fixtures/enrich/exploit-github/data/2017/CVE-2017-9779.json	Adds github exploit fixture data.
detector/vuls2/testdata/fixtures/enrich/exploit-exploitdb/datasource.json	Adds fixture datasource metadata for exploit-db source.
detector/vuls2/testdata/fixtures/enrich/exploit-exploitdb/data/2017/CVE-2017-3132.json	Adds exploit-db exploit fixture data.
detector/util.go	Removes exploitdb DB validation/close logic from ValidateDBs().
detector/detector.go	Removes legacy exploitdb enrichment from the main detect flow.
detector/exploitdb.go	Deletes legacy go-exploitdb integration (client + HTTP fetch path).
detector/exploitdb_test.go	Deletes tests tied to the removed go-exploitdb conversion logic.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 29 out of 30 changed files in this pull request and generated no new comments.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[shino]

🥂

[shino]

🎊