fetch vulnerability info during build