[Discussion] CVE catalog format — flat dicts vs typed registry?

[netanelcyber]

Question

cve_catalog_100.py and cve_catalog_de_novo_40.py currently store entries as list[dict[str, str]] with 4 keys. The core ADCVERegistry uses a richer dict shape (name, description, exploitation_status, tags, ...). Is now the right time to unify?

Options

1. Keep flat dicts — trivial to hand-edit, easy diff, no schema evolution cost. Downside: no type checking, silent typos.
2. Dataclass (CVEEntry) — mypy catches typos, IDE autocompletes fields, still trivially serialisable. Downside: PRs adding CVEs get noisier.
3. JSON/YAML data files + loader — non-devs can edit, better for automation from NVD feeds. Downside: needs a schema validator to keep quality.

Related concerns

• Should we dedupe across the two catalogs, or is overlap intentional (e.g. CVE-2024-38063 appears in both)?
• Do we want per-CVE CVSS, affected-versions ranges, MSRC links? If yes → option 2 or 3 wins on maintainability.
• Should the extended catalog be sourced from a periodic NVD pull rather than hand-maintained?

Thoughts?