fix(msrc): an entry is found by the products it affects, not only by its title

[maksimtech]

The defect (audit finding PR-02)

patchradar scan "windows 11" found nothing in MSRC. The October 2026 document lists 1,057 entries affecting a Windows 11 product, and KB5127648, October's Windows 11 cumulative update, was installed on the machine that ran the scan.

MSRC titles an entry by component ("Windows Kernel Information Disclosure Vulnerability"). The operating system is named only in the document's ProductTree, which each entry points into through ProductStatuses. The keyword was matched against title and notes only. The September fixture had no ProductTree, so no test could notice.

Fix

An entry is also kept when the keyword names one of the products the entry lists as Known Affected (ProductStatuses Type 3). The match uses the same whole-word rule as titles (keyword_pattern). The matching product IDs are computed once per monthly document.

Measured on the whole real October 2026 document, served locally

keyword	before	after	time
windows 11	0	1,057	~195 ms (first run 400)
windows 10	0	980	~195 ms
windows server	4	1,099	~195 ms
windows	944	1,171	~195 ms
curl / excel	1 / 71	1 / 71	unchanged

1,057 is exactly the number of entries the audit counted with a Windows 11 product in ProductStatuses.

Tests

• Fixture: tests/fixtures/msrc_2026_oct_excerpt_recorded.json, from the real document downloaded on 2026-10-17. It keeps three entries verbatim and the FullProductNames they point to (62 KB):
  • CVE-2026-102187, Windows Kernel, affects Windows 11 26H2, remediated by KB 5127648;
  • CVE-2026-102192, Failover Cluster, Windows Server only;
  • CVE-2026-100209, Excel.
• Product tests: windows 11 finds the kernel entry, and windows server finds the cluster entry and not Excel. Both failed first.
• Tests written after the code, checked by mutation (each fails when its rule is removed):
  • product names are matched as words (win finds none);
  • only Known Affected counts. This uses a derived entry with its status Type changed, declared as such, because the real document holds only Type 3 (2,133 of them).
• Mutation check: all four mutations of the change are caught.
• Windows: 2096 passed. WSL: 2055 passed, 45 skipped (UI tests without node). ruff and mypy: clean.

Not in this PR: reporting the KB of the remediation for the matched product, and comparing it with installed updates. That is a follow-up.

🤖 Generated with Claude Code

[codspeed]

Merging this PR will not alter performance

⚠️ 11 benchmarks spent significant time in system calls

System calls cannot be consistently instrumented, so they are not included in the measure, which understates the real cost. Please switch to the Walltime instrument to accurately measure system calls.

Measurement and system calls

• test_add_to_watchlist
• test_init_db
• test_api_cves_filtered
• test_get_watchlist
• test_api_stats
• test_api_cves
• test_nvd_fetch_cves
• test_get_cves_by_software
• test_api_cve_detail
• test_get_cves
• …and 1 more

✅ 17 untouched benchmarks

---

_{Comparing fix/msrc-matches-the-products-an-entry-affects (e04d262) with main (47e0ed8)}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud