feat: support and prefer githubID vuln identifiers from RetireJS

[chadlwilson]

Description of Change

Currently the RetireJS support does not understand the newer githubID identifier type within the retireJS repository schema, so if there is no CVE ID known, it will use a generic identifier rather than a stable, global known GHSA ID as the vulnerability name.

Additionally if a summary identifier is present (and theres no other "better" id to use) it uses it as the vulnerability name even if it is some massive multi-line string, as is the case for many GHSAs where it is raw markdown text. summary is mainly intended as a description value, and is just intended as a fallback in RetireJS land.

This PR modernizes the RetireJS support to reflect the current RetireJS DB and usage:

• Latest raw data
• TypeScript types for the identifiers
• Repo validation

Behaviour changes when determining vulnerability name

• if a githubID is present, it is preferred to the secondary legacy project-specific identiifiers (issue, PR, bug etc)
• removes looking at osvdb identifiers. OSVDB is dead, and these IDs help no-one :-)
• summary identifiers are ignored if > 100 chars OR multi-line

Before:

CVE 
  --> osvdb-id 
    --> indeterminateChoiceOf(project-issue, project-bug, project-PR) 
      --> summary 
        --> "Vulnerability in <library>"

After:

CVE
  --> GHSA-id
    --> project-issue
      --> project-bug
        --> project-PR
          --> ifSensible(summary)
            --> "Vulnerability in <library>"

These changes mean folks suppressing via vulnerabilityName may need to update their suppressions. I think this is minor because the RetireJS DB is not particularly large, and the same happens already if RetireJS add/update IDs to existing vulns, due to the vulnerability naming preference logic. I checked our base suppressions and we don't seem to have any that refer to RetireJS.

Related issues

• fixes Vulnerability description is used as vulnerability name #8402

Have test cases been added to cover the new functionality?

yes

[Copilot]

Pull request overview

Updates Dependency-Check’s RetireJS integration to align with the current RetireJS repository schema, preferring githubID identifiers (GHSA) and preventing overly-long/multiline summary values from becoming vulnerability names (improving report readability and suppressions).

Changes:

• Refactors RetireJS analysis to centralize identifier parsing and vulnerability-name selection (CVE > GHSA > secondary IDs > “sensible” summary > fallback).
• Updates/extends tests to cover the new identifier preference behavior and adds minimal “safe” JS fixtures for version detection.
• Removes OSVDB references from documentation.

Reviewed changes

Copilot reviewed 8 out of 11 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
core/src/main/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzer.java	Refactors RetireJS scanning + introduces RetireJsLibrary to implement new identifier preference logic (GHSA support, summary constraints, osvdb removal).
core/src/test/java/org/owasp/dependencycheck/analyzer/RetireJsLibraryTest.java	Adds unit coverage for new naming/identifier preference behavior (GHSA, summary rules, CVE handling).
core/src/test/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzerIT.java	Updates integration assertions and adds DOMPurify coverage to validate GHSA/CVE naming behavior end-to-end.
core/src/test/java/org/owasp/dependencycheck/analyzer/RetireJsAnalyzerFiltersTest.java	Adjusts filter tests to use the new “safe” JS fixtures.
core/src/test/resources/javascript/jquery.safe.js	Minimal jQuery fixture for version detection without bundling full library content.
core/src/test/resources/javascript/angular.safe.js	Trims Angular fixture to a minimal header while retaining version detection.
core/src/test/resources/javascript/ember.safe.js	Minimal Ember fixture for version detection.
core/src/test/resources/javascript/dompurify.safe.js	Minimal DOMPurify fixture for version detection.
src/site/markdown/related.md	Removes OSVDB from listed vulnerability sources.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chadlwilson]

I removed and replaced all these massive files for RetireJS testing with stubs that match the RetireJS rules. Don't need the whole things checked in since RetireJS doesn't work off hashes, and makes it easier to search the code without getting matches inside these test resources.