static bool blendSpec(cchar *name, cchar *version, MprJson *spec)
{
    MprJson     *blend, *cp, *scripts;
    cchar       *script, *key;
    char        *major, *minor, *patch;
    int         i;

    /*
        Before blending, expand ${var} references
     */
    if ((scripts = mprGetJsonObj(spec, "app.client.+scripts")) != 0) {
        for (ITERATE_JSON(scripts, cp, i)) {
            if (!(cp->type & MPR_JSON_STRING)) continue;
            script = httpExpandRouteVars(app->route, cp->value);
            script = stemplateJson(script, app->config);
            mprSetJson(spec, sfmt("app.client.+scripts[@=%s]", cp->value), script);
        }
    }
    blend = mprGetJsonObj(spec, "blend");
    for (ITERATE_JSON(blend, cp, i)) {
        blendJson(app->config, cp->name, spec, cp->value);
    }
    if (mprGetJsonObj(spec, "app") != 0) {
        blendJson(app->config, "app", spec, "app");
    }
    if (mprGetJsonObj(spec, "directories") != 0) {
        blendJson(app->config, "directories", spec, "directories");
    }
    if (mprLookupKey(app->topDeps, name)) {
        major = ssplit(sclone(version), ".", &minor);
        minor = ssplit(minor, ".", &patch);
        key = sfmt("dependencies.%s", name);
        if (!mprGetJson(app->config, key)) {
            mprSetJson(app->config, key, sfmt("~%s.%s", major, minor));
        }
    }
    return 1;
}
NVD is only using a subset of CWE for mapping instead of the entire CWE, and the weakness type is not covered by that subset.