lint: 'cve' checker reports the replacement's vulnerabilities.