Similarly, ‘guix lint’ has a CVE “checker” that reports CVEs that affect a given package [0]. Since the Guix package name might differ from the “CPE name” (the naming scheme devised by NIST), Guix package definitions can include the CPE name to make sure ‘guix lint’ will look for the right thing. ‘guix lint’ is also able to determine whether a vulnerability is already patched in the Guix package definition.
There’s also work on a ‘guix health’ program in the pipe [1], which is again complicated by this whole CPE story (which Vulnix seems to ignore.)
Last but not least, Guix has “grafts”, a mechanism that allows for fast security update deployment, meaning that rebuilding the world is unnecessary when applying a security update on a package deep down in the dependency graph [2, 3].
[0] https://gnu.org/s/guix/manual/en/html_node/Invoking-guix-lin...
[1] https://issues.guix.info/issue/31442
[2] https://www.gnu.org/software/guix/blog/2016/timely-delivery-...
[3] https://www.gnu.org/software/guix/manual/en/html_node/Securi...