Returned CVE Records include an extra opensearch_ops field #177

Every record I retrieved (501 of 501) has a top-level opensearch_ops object:

"opensearch_ops": {"_source_version": "0.1", "ingest_timestamp": "2026-06-30T17:40:18.109339170Z"}

Records that have been updated since the initial load on 2026-06-30 also have ingested_cve_signature (CVE-ID|dateUpdated|sha256) inside that object.

The docs say this shouldn't happen. The README says records contains "complete CVE Records directly, without search-backend hit wrappers or infrastructure metadata", and the OpenAPI CveRecord schema describes "A complete CVE Record without search-backend transport metadata". It looks like searchResponseBuilder.js#L78 just returns _source as-is.

To reproduce

curl -s -X POST https://search.cve.org/search -H 'Content-Type: application/json' \
  -d '{"cveIds":"CVE-2024-5981"}' | jq '.records[0] | keys'

Why it matters

• Schema validation. Records fail validation against CVE JSON 5.x, because both root oneOf branches (Published and Rejected) set additionalProperties: false.
• Comparing against other copies. It's the only thing keeping these records from matching other copies. With opensearch_ops removed, 199 of 200 sampled records are identical to cvelistV5; the remaining one is stale, which I've reported separately. So anyone comparing against CVE Services or cvelistV5, or deduplicating, will see every record as different.

Suggestions

1. Strip the field from records.
2. If you'd like to keep the ingest metadata available, and I think it's useful for judging freshness, put it somewhere documented, such as a parallel recordMetadata: [{cveId, ingestTimestamp}] array.