fix(best_practices): versioned advisory table for vulnerable JS libraries (#773)

CHANGELOG.md

@@ -39,6 +39,7 @@ and verification for each change is in the
 - **Scoring:** The overall score always uses the published module weights, including dual-viewport audits. Incomplete performance measurements and unchecked HTML conformance do not contribute; estimated Speed Index remains diagnostic. Principle coverage uses execution records instead of assuming every catalogued criterion passed.
 - **Security:** Security-only audits also collect the JavaScript library checks. The known Handlebars advisory range includes versions below 4.7.7 and describes conditional exploitability.
 - **CLI:** After the audited pages, the batch progress bar shows the sitemap check as its own stage instead of resting on the last page count.
+- **Libraries:** Affected library versions come from a versioned advisory table (`ADVISORIES` in `best_practices/vulnerable_libs.rs`) with advisory id, CVE aliases, affected ranges, fixed version, source URL and review date. `vulnerable[]` entries list the matching `advisories[]` and carry `exploitability: "unconfirmed"` (a version match never proves the code path is reachable); `detected[].version_parsed` marks versions that could not be read, which are neither flagged nor cleared.
 - **Dependencies:** `runemark` 0.9.
 - **Dependencies:** `renderreport` 0.7.1.
 - **Dependencies:** `a11y-rules`, `a11y-report`, `a11y-dom`, `accname` 0.26.0.

src/audit/normalized.rs

@@ -2643,13 +2643,17 @@ mod tests {
                         severity: "high".to_string(),
                         description: "XSS".to_string(),
                         safe_version: "3.5.0+".to_string(),
+                        advisories: vec![],
+                        exploitability: Default::default(),
                     },
                     VulnerableLibrary {
                         name: "Lodash".to_string(),
                         version: "4.17.20".to_string(),
                         severity: "medium".to_string(),
                         description: "Prototype pollution".to_string(),
                         safe_version: "4.17.21+".to_string(),
+                        advisories: vec![],
+                        exploitability: Default::default(),
                     },
                 ],
                 has_vulnerabilities: true,

src/best_practices/mod.rs

@@ -9,8 +9,8 @@ pub use console_errors::{
 };
 pub use module::BestPracticesModule;
 pub use vulnerable_libs::{
-    analyze_vulnerable_libraries, DetectedLibrary, VulnerableLibrariesAnalysis, VulnerableLibrary,
-    CHECKED_LIBRARIES,
+    analyze_vulnerable_libraries, AdvisoryRef, DetectedLibrary, Exploitability,
+    VulnerableLibrariesAnalysis, VulnerableLibrary, CHECKED_LIBRARIES,
 };
 
 use chromiumoxide::Page;