Sample warning leaks into freshly deployed output

[jpryde-blackberry]

I used the following runner to validate a couple of CVEs we just published:

import { Validate, readJsonFile } from '../src/index.ts';

const validator = new Validate();
const cveFiles = [
  'CVE-2026-18085.json',
  'CVE-2026-18084.json',
];
let allValid = true;

for (const fileName of cveFiles) {
  const path = `data/${fileName}`;

  try {
    const record = await readJsonFile(path);
    const diagnostics = await validator.validateCveRecord(record);

    console.log(JSON.stringify({
      path,
      cveId: record?.cveMetadata?.cveId,
      valid: diagnostics.valid,
      error: diagnostics.error,
      message: diagnostics.message,
      details: diagnostics.details,
      warnings: diagnostics.warnings,
    }, null, 2));

    allValid &&= diagnostics.valid;
  } catch (error) {
    allValid = false;

    console.log(JSON.stringify({
      path,
      valid: false,
      error: error instanceof Error ? error.name : 'VALIDATION_EXCEPTION',
      message: error instanceof Error ? error.message : String(error),
    }, null, 2));
  }
}

process.exitCode = allValid ? 0 : 1;

The CVEs returned clean but there was one warning configured for each of them:

{
      "messageId": "STUB_WARNING",
      "notificationMessage": "This is a stub warning notification.",
      "notificationDetails": "This warning is sample registry data for local development.",
      "schemaPath": "#",
      "dateAdded": "2026-07-13T00:00:00.000Z",
      "dateUpdated": "2026-07-13T00:00:00.000Z",
      "dateStart": "2026-07-13T00:00:00.000Z",
      "dateEnd": "2099-12-31T23:59:59.999Z",
      "priority": 1
}

If I were to consume this library directly using npm rather then check it out and make local modifications, it would not be clear to me that I need to set WarningRegistryPath to a json file containing an empty list (therefore avoiding defaultWarningRegistryPath) to disable this sample.

Should we set the default registry to an empty one and keep the src/registry/cve-program/warnings.json file as a non-default sample?