Fix a minor TODO with the CVE query
Test a custom critpath package in the unit test
Don't use the pkgdb for critpath packages by default