Query the GCVE BCP-07 KEV catalogs; deprecate the CISA KEV helpers

[cedricbonhomme]

Vulnerability-Lookup retires /api/cisa_kev/ in vulnerability-lookup/vulnerability-lookup#641 (see vulnerability-lookup/vulnerability-lookup#640): that endpoint served a separate, non-BCP-07 mirror of the CISA list that kept retracted entries. The CISA catalog, like ENISA's and the others, is a GCVE BCP-07 KEV catalog served by /api/kev/, identified by its origin UUID. Without this change get_cisa_kevs and get_cisa_kevs_iter return a 404 body once that PR is deployed.

Changes

• get_kevs / get_kevs_iter list the BCP-07 assertions with the endpoint's filters: vuln_id, origin (catalog UUID), status_reason, exploited (True by default, False for withdrawn assertions only, 'all'), date_from, date_to, author. The iterator pages by 1000, the endpoint's maximum.
• get_kev(kev_uuid) fetches one assertion, get_kev_by_origin(origin, vuln_id) the assertion a catalog holds for a vulnerability (404 body when the catalog does not list it).
• CISA_KEV_ORIGIN is exported: the catalog UUID of CISA KEV in the GCVE references, the same on every instance.
• get_cisa_kevs / get_cisa_kevs_iter delegate to the new helpers with that origin and emit a DeprecationWarning. Their entries are now BCP-07 assertions rather than the former CISA records (cveID, dateAdded, ...), which is unavoidable since the old data no longer exists server-side.

from pyvulnerabilitylookup import CISA_KEV_ORIGIN, PyVulnerabilityLookup

client = PyVulnerabilityLookup('https://vulnerability.circl.lu')
enisa = 'cce329bf-df49-4c6e-a027-80be2e6483bd'
for kev in client.get_kevs_iter(origin=enisa):
    print(kev['vulnerability']['vulnId'], kev['status']['status_reason'])
client.get_kev_by_origin(CISA_KEV_ORIGIN, 'CVE-2025-32433')
client.get_kevs(vuln_id='CVE-2025-32433')  # every catalog listing it

Verified

• mypy clean.
• tests/test_web.py::test_kev (replaces test_cisa_kev) run against vulnerability.circl.lu: walks the whole CISA catalog through the iterator, round-trips one entry through get_kev and get_kev_by_origin, checks the cross-catalog vuln_id filter, and asserts the deprecated helpers warn and still answer.

No version bump; that is left to the release.