Clean out-of-date NVD results. (#10514)

Keep the vulnerabilities detected via NVD and stored in the DB in sync. with the results from the NVD vulnerability process.

server/vulnerabilities/oval/analyzer.go

@@ -102,16 +102,17 @@ func Analyze(
 		inserted = make([]fleet.SoftwareVulnerability, 0, len(toInsertSet))
 	}
 
-	err = utils.BatchProcess(toInsertSet, func(v []fleet.SoftwareVulnerability) error {
-		n, err := ds.InsertSoftwareVulnerabilities(ctx, v, source)
-		if err != nil {
-			return err
-		}
+	err = utils.BatchProcess(toInsertSet, func(vulns []fleet.SoftwareVulnerability) error {
+		for _, v := range vulns {
+			ok, err := ds.InsertSoftwareVulnerability(ctx, v, source)
+			if err != nil {
+				return err
+			}
 
-		if collectVulns && n > 0 {
-			inserted = append(inserted, v...)
+			if collectVulns && ok {
+				inserted = append(inserted, v)
+			}
 		}
-
 		return nil
 	}, vulnBatchSize)
 	if err != nil {

server/vulnerabilities/oval/analyzer_test.go

@@ -90,10 +90,12 @@ func loadSoftware(
 	err = ds.LoadHostSoftware(ctx, h, false)
 	require.NoError(t, err)
 
+	var cpes []fleet.SoftwareCPE
 	for _, s := range h.Software {
-		err = ds.AddCPEForSoftware(ctx, s, fmt.Sprintf("%s-%s", s.Name, s.Version))
-		require.NoError(t, err)
+		cpes = append(cpes, fleet.SoftwareCPE{SoftwareID: s.ID, CPE: fmt.Sprintf("%s-%s", s.Name, s.Version)})
 	}
+	_, err = ds.UpsertSoftwareCPEs(ctx, cpes)
+	require.NoError(t, err)
 
 	return h
 }