chore(vex): record not_affected for log4j-core 2.14.1 fixture strings

.gitignore

@@ -52,7 +52,7 @@ src/@iconify/icons-bundle.js
 **/vulnetix.db
 
 # Vulnetix credentials
-.vulnetix/
+.vulnetix/*
 .claude/
 **/credentials.json
 **/vdb.json
@@ -81,4 +81,5 @@ result
 /secrets.sarif
 internal/sast/secretsgen/batches/
 !.vulnetix/workflow.yaml
-!.vulnetix/workflow.yaml
+!.vulnetix/vex/
+!.vulnetix/config/

.vulnetix/config/vex.yaml

@@ -0,0 +1,13 @@
+# Committed VEX statements for this repository. Every Vulnetix scan (local and
+# CI) reads the documents under .vulnetix/vex/ before its gates, so a finding a
+# statement closes is reported as not_affected or fixed instead of open.
+apiVersion: vulnetix.com/v1
+kind: VexSource
+metadata:
+  name: repo-vex
+spec:
+  path:
+    path: .vulnetix/vex
+  scope:
+    repos:
+      - Vulnetix/cli

.vulnetix/vex/CVE-2021-44228.openvex.json

@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-44228.openvex.json",
+  "author": "Vulnetix",
+  "role": "Maintainer",
+  "timestamp": "2026-11-14T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2021-44228"
+      },
+      "products": [
+        {
+          "@id": "pkg:github/Vulnetix/cli",
+          "subcomponents": [
+            {
+              "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.",
+      "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory."
+    }
+  ]
+}

.vulnetix/vex/CVE-2021-44832.openvex.json

@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-44832.openvex.json",
+  "author": "Vulnetix",
+  "role": "Maintainer",
+  "timestamp": "2026-11-14T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2021-44832"
+      },
+      "products": [
+        {
+          "@id": "pkg:github/Vulnetix/cli",
+          "subcomponents": [
+            {
+              "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.",
+      "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory."
+    }
+  ]
+}

.vulnetix/vex/CVE-2021-45046.openvex.json

@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-45046.openvex.json",
+  "author": "Vulnetix",
+  "role": "Maintainer",
+  "timestamp": "2026-11-14T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2021-45046"
+      },
+      "products": [
+        {
+          "@id": "pkg:github/Vulnetix/cli",
+          "subcomponents": [
+            {
+              "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.",
+      "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory."
+    }
+  ]
+}

.vulnetix/vex/CVE-2021-45105.openvex.json

@@ -0,0 +1,29 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/Vulnetix/cli/blob/main/.vulnetix/vex/CVE-2021-45105.openvex.json",
+  "author": "Vulnetix",
+  "role": "Maintainer",
+  "timestamp": "2026-11-14T00:00:00Z",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "CVE-2021-45105"
+      },
+      "products": [
+        {
+          "@id": "pkg:github/Vulnetix/cli",
+          "subcomponents": [
+            {
+              "@id": "pkg:maven/org.apache.logging.log4j/log4j-core@2.14.1"
+            }
+          ]
+        }
+      ],
+      "status": "not_affected",
+      "justification": "component_not_present",
+      "impact_statement": "log4j-core is not a dependency of this Go module (go.mod and go.sum only; no Maven or Gradle build and no JAR in the shipped CLI). log4j-core 2.14.1 appears only as example strings in test fixtures, golden files, help text and documentation, and as SAST rule-efficacy test data under internal/sast/testdata.",
+      "status_notes": "Issues #215, #216 and #304. The fixtures are kept on purpose; they exercise the report and defence renderers with a well-known KEV advisory."
+    }
+  ]
+}