cve-lite-cli

No entries match these filters. Clear filters

1. v1.40.0 Oct 21, 2026 · issue 116

   Adds PR-scoped delta comments via GitHub Action delta input and enriches --json output with version, timestamp, and effective options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.40.0 https://github.com/OWASP/cve-lite-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.40.0

   • Adds delta input to the GitHub Action so pull requests receive a single upserted comment listing only the findings that PR introduced, not the full tree; fork PRs fall back to the job summary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. rule help markdown now leads with a link to the project so a triaging analyst can identify which tool produced each Code Scanning alert.
   • Adds delta input to the GitHub Action so pull requests receive a single upserted comment listing only the findings that PR introduced, not the full tree; fork PRs fall back to the job summary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !--ratchet with no committed baseline now applies --fail-on and exits non-zero when findings match the gate, instead of writing a baseline and exiting 0 — a CI job that checks out fresh every run and never committed its baseline could previously not fail and now can.
   • !pnpm lockfile v6 (pnpm 8 and earlier) was misparsed, causing vulnerable trees to report clean; re-scanning after upgrading may surface new findings that were silently missed before.
   • !The recommended upgrade version for a transitive finding now resolves the parent from the finding's own dependency path, so some previously reported fix versions will change.
2. v1.38.0 Oct 4, 2026 · issue 095

   cve-lite-cli v1.38.0 adds contextual per-finding prioritization signals and a new override-hygiene rule OA011⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.38.0 https://github.com/OWASP/cve-lite-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.38.0

   └──▷ TRY IT
   Catch overrides pinned above every parent's declared range (OA011) alongside the full CVE scan, and emit SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. for GitHub Code Scanning.
   copy

   $ cve-lite /path/to/project --check-overrides --sarif

   • Adds reachability, exposure, and usage contextual prioritization signals to each verbose finding, surfaced separately from the EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. prioritySignal; reachability reports path_depth_2 and above or falls back to direct_dependency, exposure flags findings whose path runs through a request-handling package, and usage is omitted entirely on a default scan rather than printed as n/a.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new override-hygiene rule OA011 — detects an override floor that exceeds every declaring package's range — joining the OverrideRuleId union alongside OA001–OA010.
   • The --all findings table drops the IDs column; advisory IDs remain available in --verbose, JSON, SARIF, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., and the HTML report.
   • The usage scan's 5000-file cap is now disclosed in the terminal, in --json, and in both HTML reporters, scoped per folder in multi-folder mode; a truncated scan records unknown for the contextual usage signal rather than claiming a package is unused.
   • Compact output now discloses withheld findings and command groups with counts and instructions (e.g. Showing 3 of 53 findings. Run --verbose --all to see them all.) instead of silently truncating.
   • Adds reachability, exposure, and usage contextual prioritization signals to each verbose finding, surfaced separately from the EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. prioritySignal; reachability reports path_depth_2 and above or falls back to direct_dependency, exposure flags findings whose path runs through a request-handling package, and usage is omitted entirely on a default scan rather than printed as n/a.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds new override-hygiene rule OA011 — detects an override floor that exceeds every declaring package's range — joining the OverrideRuleId union alongside OA001–OA010.

   3 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !If you gate CI on --check-overrides, re-run it after upgrading: OA010 was previously unreachable from the scan path and no-oped silently, so a prior clean result may not have been a genuine pass.
3. v1.37.0 Sep 23, 2026 · issue 083

   cve-lite-cli v1.37.0 adds --output <dir> to control where JSON, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. files land, with a matching GitHub Action input.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.37.0 https://github.com/OWASP/cve-lite-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.37.0

   └──▷ TRY IT
   Write all structured outputstructured outputForcing a model's response to match a given format or JSON schema, so software can parse it reliably instead of hoping the text is well formed. to a dedicated reports directory so a CI step can hand a stable path to the next stage without globbing or renaming.
   copy

   $ cve-lite /path/to/project --sarif --json --output reports

   • Adds --output <dir> flag to direct --json, --sarif, and --sbom output files into a specified directory (created when missing); passing --output without one of those three flags is an error rather than a silent no-op.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a matching output input to the GitHub Action for the same directory-routing behaviour.
   • Adds --output <dir> flag to direct --json, --sarif, and --sbom output files into a specified directory (created when missing); passing --output without one of those three flags is an error rather than a silent no-op.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

4. v1.36.0 Sep 20, 2026 · issue 081

   cve-lite-cli v1.36.0 ships the PR delta renderer as a public package and fixes two false-result bugs from v1.35.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.36.0 https://github.com/OWASP/cve-lite-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.36.0

   • Publishes the PR delta renderer as part of the distributed package, enabling external tools and CI workflows outside this repository to generate pull request comments from two scan reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

5. v1.35.0 Sep 16, 2026 · issue 077

   cve-lite-cli v1.35.0 adds override-hygiene rule OA010 and full multi-path dependency display in HTML reports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.35.0 https://github.com/OWASP/cve-lite-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.35.0

   └──▷ TRY IT
   Run an override hygiene audit to catch floors that admit vulnerable versions (OA010) alongside other override problems, without running a full CVE scan.
   copy

   $ cve-lite /path/to/project overrides

   Include override hygiene (including the new OA010 rule) in a single pass with the regular CVE scan, so vulnerable-floor overrides surface alongside CVE findings.
   copy

   $ cve-lite /path/to/project --check-overrides

   • Adds override-hygiene rule OA010: flags an override floor that itself admits a known-vulnerable version, surfacing floors that appear protective but are not.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Shows every known dependency path for a finding in the HTML report (capped at five paths per panel), replacing the previous single-primary-path display.
   • Adds override-hygiene rule OA010: flags an override floor that itself admits a known-vulnerable version, surfacing floors that appear protective but are not.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

6. docs update Sep 10, 2026 · issue 070

   cve-lite-cli gains cve-lite overrides command with eight override-hygiene rules, auto-fix via RFC 6902RFC 6902A JSON standard from the IETF that defines a format for describing changes to a JSON document as a sequence of operations such as add, remove, and replace, letting tools patch structured data without transmitting full replacements. patches, and JSON output.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Run all override-hygiene rules in CI and fail the build on any high-or-above finding, with JSON output for ingestion by a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or ticket system.
   copy

   $ cve-lite overrides --json --fail-on high

   Auto-fix only misplaced overrides (OA003) in a specific directory without touching other rule findings.
   copy

   $ cve-lite overrides ./overrides --fix --rule OA003

   Check for pinned overrides that have drifted from the latest published version in the registry (requires outbound network access).
   copy

   $ cve-lite overrides --check-network

   • Adds cve-lite overrides [path] subcommand that audits override files and emits severity-grouped terminal output across eight rules (OA001–OA008).⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --json flag to cve-lite overrides for structured JSON findings output, suitable for downstream tooling.
   • Adds --fail-on <severity> flag to cve-lite overrides to set the minimum severity that causes a non-zero exit (default: critical); supported scale is critical > high > medium > low > info.
   • Adds eight override-hygiene rules: OA001 (Orphaned target, high), OA002 (Floating tag, medium), OA003 (Wrong section, high), OA004 (Surpassed pin, low), OA005 (Nested ineffective override, low–critical, five sub-codes OA005.a–OA005.e), OA006 (Coupled platform binary, high/medium), OA007 (Frozen latest, low), and OA008 (Materialized vulnerable copy, critical).

   4 details in Everything

7. v1.34.0 Sep 9, 2026 · issue 069

   cve-lite-cli v1.34.0 adds SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output with --sbom spdx2.3 and a prod/dev findings split in all report formats.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.34.0 https://github.com/OWASP/cve-lite-cli.git
   # already have the repo? check out this version:
   $ git checkout v1.34.0

   └──▷ TRY IT
   Generate a full SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 SBOM with vulnerability overlays attached as SECURITY references — useful for NTIA-compliant software bills of materials in regulated environments.
   copy

   $ cve-lite /path/to/project --sbom spdx2.3

   Produce a clean dependency inventory SBOM with no vulnerability data for diffing across CI runs or submitting for attestation without exposing finding details.
   copy

   $ cve-lite /path/to/project --sbom spdx --sbom-inventory-only

   • Adds SPDX 2.3 SBOM output via --sbom spdx2.3 (also --sbom spdx); findings attach as SECURITY external references of type advisory, with severity and fix command in a package annotation; package licenses sourced from the npm lockfile at no network cost; pnpm, Yarn and Bun resolve to NOASSERTION; emits supplier, filesAnalyzed: false and DEPENDENCY_OF relationships to satisfy all seven NTIA minimum elements.
   • Adds --sbom-inventory-only flag to emit an SBOM without the vulnerability overlay, for diffing, archival and attestation workflows.
   • Adds --sbom cyclonedx as an alias path to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output (alongside the existing --cdx), now emitting spec version 1.6 with tools.components object form using publisher.
   • Adds a prod-vs-dev split line in compact and verbose terminal output and as a note in the HTML report severity card strip, showing 'N of M findings in prod dependencies' when some findings are dev-only.
   • Adds SPDX 2.3 SBOM output via --sbom spdx2.3 (also --sbom spdx); findings attach as SECURITY external references of type advisory, with severity and fix command in a package annotation; package licenses sourced from the npm lockfile at no network cost; pnpm, Yarn and Bun resolve to NOASSERTION; emits supplier, filesAnalyzed: false and DEPENDENCY_OF relationships to satisfy all seven NTIA minimum elements.
   • Adds --sbom-inventory-only flag to emit an SBOM without the vulnerability overlay, for diffing, archival and attestation workflows.
   • Adds a prod-vs-dev split line in compact and verbose terminal output and as a note in the HTML report severity card strip, showing 'N of M findings in prod dependencies' when some findings are dev-only.

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !CycloneDX output (--cdx and --sbom cyclonedx) now emits specVersion 1.6 instead of 1.4; any CI pipeline or tooling that diffs SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. or asserts on the specVersion field will need updating.
   • !metadata.tools in CycloneDX output now uses the 1.6 tools.components object form with publisher, replacing the deprecated 1.4 array of {vendor, name, version}; downstream consumers parsing metadata.tools will see a different structure.
8. docs update Sep 9, 2026 · issue 069

   cve-lite-cli gains --sbom SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. formats, plus --sbom-inventory-only for pure inventory output.

   └──▷ TRY IT
   Export an SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 SBOM with full vulnerability overlay after a scan — useful for feeding into a software supply-chainsoftware supply-chainThe dependencies, tools and processes used to build and deliver software. Compromising one part can affect the products or organizations that rely on it. pipeline or compliance tooling.
   copy

   $ cve-lite . --sbom spdx

   Generate a pure component inventory (no vulnerability data) in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. format — useful when your SBOM consumer expects only a bill-of-materialsbill-of-materialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. without vuln annotations.
   copy

   $ cve-lite . --sbom cyclonedx --sbom-inventory-only

   • Adds --sbom <format> flag to write a timestamped SBOM file; supported formats are cyclonedx (CycloneDX 1.6, .cdx.json) and spdx / spdx2.3 (SPDX 2.3, .spdx.json).
   • Adds --sbom-inventory-only flag to omit the vulnerability overlay from --sbom output, producing a pure component inventory; requires --sbom.

   2 details in Everything

9. docs update Sep 9, 2026 · issue 069
   └──▷ TRY IT
   Generate an SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with vulnerability data included during a scan, for submission to a supply-chain compliance pipeline.
   copy

   $ cve-lite . --sbom spdx

   Produce a clean software inventory (no vulnerability overlay) in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. format, suitable for sharing with a vendor or archiving as a build artifact.
   copy

   $ cve-lite . --sbom cyclonedx --sbom-inventory-only

10. docs update Sep 2, 2026 · issue 062

    cve-lite-cli adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.-based priority tiers (fix_now/fix_soon/monitor/low_priority) to terminal, JSON, and HTML outputs

    └──▷ USE IT
    Emit JSON findings with EPSS scores and priority tiers for CI or other machine-readable consumers.
    shell copy

    cve-lite . --json

    • Adds epssScores and prioritySignal fields to machine-readable JSON output when EPSS data is available for a finding.
    • Introduces four EPSS Priority Signal tiers — fix_now, fix_soon, monitor, low_priority — combining CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. severity with FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. EPSS exploitation-likelihood percentile to produce a single actionable priority per finding.
    • Adds an EPSS Priority column to HTML reports with an interactive priority legend; the column and ⚡ Fix Now inline flag also appear in terminal verbose and compact modes respectively.

    3 details in Everything

11. docs update Sep 1, 2026 · issue 062

    cve-lite-cli adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.-based priority tiers and epssScores/prioritySignal fields to JSON, terminal, and HTML outputs

    • Introduces an EPSS Priority Signal tier system — fix_now, fix_soon, monitor, low_priority — combining CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. severity with EPSS exploitation-likelihood percentile to produce a single actionable priority per finding; returns null in JSON when no CVE alias resolves against the FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. API.
    • Extends HTML report output with EPSS and EPSS Priority columns and an interactive priority legend.
    • Extends terminal full output with EPSS and EPSS Priority columns in the findings table.

    3 details in Everything

12. v1.33.0 Sep 1, 2026 · issue 062

    Adds an EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. Priority Signal combining CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. severity and EPSS percentile into four actionable tiers across terminal, JSON, and HTML outputs.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.33.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.33.0

    └──▷ TRY IT
    Triage a project by exploitation likelihood in CI — pipe JSON output and filter for packages the model rates as needing immediate action.
    copy

    $ cve-lite /path/to/project --json | jq '[.[] | select(.prioritySignal == "fix_now")]'

    • Adds a prioritySignal field to JSON output exposing four actionable tiers — fix_now (high impact + top 10% EPSS), fix_soon (high impact), monitor (lower severity + top 10% EPSS), low_priority (all else) — set to null when no EPSS data is available.
    • Surfaces the EPSS Priority Signal as a new column in the verbose terminal table (shown with --verbose) and as a column plus four-tier legend in the HTML report (--report).

    2 details in Everything

13. v1.32.0 Sep 1, 2026 · issue 061

    cve-lite-cli v1.32.0 adds license detection, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. enrichment, npm advisory fallback, and incomplete-data policy control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.32.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.32.0

    └──▷ TRY IT
    Audit a project for CVEs and copyleft/unknown licenses in one pass, failing CI on high-severity CVEs.
    copy

    $ cve-lite /path/to/project --check-licenses --fail-on high

    Treat incomplete detection data as a hard error (exit 3) so CI pipelines never silently pass on partial results.
    copy

    $ cve-lite /path/to/project --incomplete-policy error

    • Adds --incomplete-policy warn|error flag (default: warn) to control exit behavior when detection data is incomplete; error exits with code 3. GitHub Action gains an incomplete-policy input.
    • Enriches findings with FIRST.orgFIRST.orgA global forum of incident response and security teams that sets shared standards and best practices; cyber tools cite membership or its frameworks (like CVSS) to signal coordinated vulnerability handling. EPSS scores after the OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. pass: highest score shown in the terminal top-3 block, verbose table column, and HTML report detail panel; full score array included in JSON output. Skipped in offline mode and for GHSA-only findings.
    • Adds the npm registry advisory API as a secondary source for packages with zero OSV matches, closing coverage gaps for CVEs without an npm ecosystem mapping in OSV. Skips in offline mode and is non-fatal on error.

    3 details in Everything

14. docs update Aug 31, 2026 · issue 060

    cve-lite-cli adds PR creation, license scanning, incomplete-data policy, and cache-bypass flags

    └──▷ TRY IT
    Auto-fix vulnerabilities and open a PR against a non-default base branch in one step.
    copy

    $ cve-lite --fix --create-pr --base develop

    Fail CI with exit code 3 when scan data is incomplete, so partial results never silently pass.
    copy

    $ cve-lite . --incomplete-policy error

    Scan for CVEs and license issues simultaneously, emitting SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output for ingestion into a SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. pipeline.
    copy

    $ cve-lite . --check-licenses --sarif

    • Adds --incomplete-policy flag to control behavior when scan data is incomplete: warn (default) prints diagnostics but exits on findings; error exits with code 3 when detection data is incomplete.
    • Adds a flag to skip the query cache and force fresh results from OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. and the npm registry advisory API, with the next scan also re-fetching from all sources.
    • License data for npm projects is read directly from package-lock.json with no network calls (works offline); for pnpm, Yarn, and Bun projects only direct dependencies are checked.
    • Supports --check-licenses combined with --json or --sarif output formats.

    4 details in Everything

15. docs update Aug 31, 2026 · issue 060
    └──▷ TRY IT
    Auto-fix vulnerabilities and open a PR against a non-default base branch in one step.
    copy

    $ cve-lite --fix --create-pr --base develop

    Fail CI with exit code 3 when scan data is incomplete, rather than silently continuing.
    copy

    $ cve-lite . --incomplete-policy error

    Scan an npm project for both CVEs and license issues, emitting results as SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. for ingestion into a SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. pipeline.
    copy

    $ cve-lite . --check-licenses --sarif

    • --check-licenses output supports --json and --sarif formats.
16. docs update Aug 28, 2026 · issue 058

    cve-lite-cli adds --create-pr, --base, and --debug flags for automated PR creation and diagnostics

    └──▷ TRY IT
    Automatically apply fixes and open a PR against a non-default branch in one step, useful in CI pipelines targeting a release branch.
    copy

    $ cve-lite --fix --create-pr --base develop

    Capture verbose network and runtime diagnostics when troubleshooting connectivity or unexpected scan failures.
    copy

    $ cve-lite --debug

    • Adds --create-pr flag: after --fix, commits changes and opens a GitHub pull request automatically (requires gh CLI).
    • Adds --base <branch> flag to set the base branch for --create-pr (defaults to main).
    • Adds --debug flag that writes verbose runtime and network diagnostics to a timestamped log file.

    3 details in Everything

17. docs update Aug 28, 2026 · issue 058

    cve-lite-cli adds --create-pr to commit fixes and open GitHub pull requests, plus --debug logging for scan troubleshooting.

    └──▷ TRY IT
    Automatically apply fixes and open a PR against a non-default base branch — useful in CI pipelines targeting a release branch.
    copy

    $ cve-lite --fix --create-pr --base develop

    Capture verbose network and runtime diagnostics to a timestamped log file when troubleshooting scan failures.
    copy

    $ cve-lite --debug

18. v1.31.0 Aug 27, 2026 · issue 058

    HTML report now links package names to npm registry; package-registry navigation added to findings table.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.31.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.31.0

19. v1.30.0 Aug 23, 2026 · issue 054

    cve-lite-cli v1.30.0 adds a Root column across all report formats and auto-applies safe transitive fixes with --fix

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.30.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.30.0

    └──▷ TRY IT
    Auto-fix transitive vulnerabilities in-range without upgrading parents — useful in CI to land the smallest safe change.
    copy

    $ cve-lite /path/to/project --fix

    • Adds --fix auto-application of safe within-range transitive refreshes when the fix is available inside the parent's declared range, without requiring a parent-level upgrade.
    • Adds a Root column showing the top-level direct dependency behind each transitive finding, across terminal, JSON, and HTML report outputs (including multi-folder scans).
    • pnpm lockfile parsing now runs once per scan instead of up to three times, delivering approximately 14% faster warm scans on large monorepos.

    3 details in Everything

20. v1.29.0 Aug 11, 2026 · issue 042

    cve-lite-cli v1.29.0: --usage/--only-used now work in multi-folder scans, cooldown warnings in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., and expanded DM001 maintenance-risk findings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.29.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.29.0

    └──▷ TRY IT
    Fail CI on any high-severity constraint-drag finding (DM001) while also auditing override hygiene across all workspace packages.
    copy

    $ cve-lite /path/to/monorepo --check-maintenance --check-overrides --fail-on high

    • Extends --usage/--only-used flags to multi-folder scans: each subfolder now gets its own source-usage annotation and filtering, isolated from other subfolders (previously accepted but silently ignored outside single-folder mode).
    • Surfaces release-cooldown warnings in SARIF output as properties.cooldownWarning on the result, making them visible in GitHub Code Scanning.
    • Expands DM001 maintenance-risk detection (--check-maintenance): deprecated npm packages now produce their own medium-severity finding (separate from constraint-drag findings); severity is graduated — constraint drag is high, deprecation is medium; packages abandoned 2+ years show a Last release context line.
    • Renders scan completeness in terminal output (compact and verbose modes) and in HTML reports, surfacing packument-fetch failures and other scan gaps.

    4 details in Everything

21. v1.28.0 Jul 26, 2026 · issue 041

    cve-lite-cli v1.28.0 adds --check-maintenance (DM001), advisories init, and release-cooldown-aware fix warnings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.28.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.28.0

    └──▷ TRY IT
    Catch direct dependencies that are blocking a transitive CVE fix or are npm-deprecated, and fail CI on any high-severity finding.
    copy

    $ cve-lite /path/to/project --check-maintenance --fail-on high

    Bootstrap an empty offline advisory database on an air-gapped machine, then scan without any runtime API calls.
    copy

    $ cve-lite advisories init && cve-lite /path/to/project --offline

    • New --check-maintenance flag (rule DM001) flags direct dependencies that block a transitive CVE fix via major-version constraint drag, or that are deprecated on npm; renders in terminal, JSON, multi-folder, and HTML report, and counts toward --fail-on (high severity for constraint drag, medium for deprecated packages).
    • New advisories init subcommand creates an empty offline advisory database for air-gapped environments to populate manually.
    • New cooldown-aware fix resolver reads min-release-age (npm .npmrc), minimumReleaseAge (pnpm), and npmMinimalAgeGate (yarn) and warns when a recommended fix version is newer than the configured release window; advisory only, on by default, no flag or exit-code change, renders in terminal, --verbose, JSON, and HTML report (npm/pnpm/yarn; Bun not yet covered).
    • Shows skipped manifest dependencies in the HTML report and report.json.

    4 details in Everything

22. v1.27.0 Jul 14, 2026 · issue 041

    cve-lite-cli v1.27.0 adds two phantom-dependency rules, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. fingerprinting for GitHub Code Scanning, and flexible path-first argument ordering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.27.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.27.0

    └──▷ TRY IT
    Generate a SARIF report with full GitHub Code Scanning fingerprinting to upload as a code-scanning artifact in CI.
    copy

    $ cve-lite /path/to/project --sarif

    Run override hygiene auditing with auto-fix on a non-root project path using the new path-first argument order.
    copy

    $ cve-lite ./packages/api overrides --fix

    Export override hygiene findings to a timestamped JSON file for ingestion into a SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. or audit log.
    copy

    $ cve-lite /path/to/project overrides --json

    • Adds --sarif output with ruleIndex, kind: "open", and partialFingerprints fields for full GitHub Code Scanning compatibility; shared fingerprint logic extracted to src/utils/sarif.ts.
    • Adds overrides --json output written to a timestamped file, consistent with the main scan path.
    • Adds path-first argument ordering: cve-lite <path> overrides [flags] now works alongside cve-lite overrides <path> [flags].
    • New rule PD001 (Override-only phantom, high): fires when source code imports a package that is only present via an override pin, prompting declaration as a direct dependency.
    • New rule PD002 (Transitive-only phantom, medium): fires when source code imports a package that is only present as a transitive dependency, prompting an explicit declaration.

    +4 more show less

    • New rule OA009 (Stale floor detector): fires when a >= or ^ override floor is already met by every parent declaration, flagging the override as redundant.
    • OA009 safety guard suppresses the stale-floor removal suggestion when the override anchors a phantom import (PD001/PD002 interaction).
    • Adds examples/all-scenarios/ fixture that triggers all nine auto-detectable override hygiene rules in a single scan.
    • Adds a light/dark mode toggle in the HTML report, persisted to localStorage.

    9 details in Everything

23. v1.26.0 Jul 4, 2026 · release notes

    v1.26.0 adds scheduled security fix PR generation via GitHub Action inputs and override hygiene hints.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.26.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.26.0

    └──▷ HOW TO FIND IT
    Enable automated security fix PRs for a bun repository on a schedule.
    📍name: Security Fixes on: schedule: - cron: '0 0 * * 1' jobs: cve-lite: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: owasp/cve-lite-cli@v1.26.0 with: fix: true create-pr: true base-branch: main labels: security, dependencies token: ${{ secrets.GITHUB_TOKEN }}
    • Adds fix: true and create-pr: true GitHub Action inputs to enable scheduled security fix PRs for npm/pnpm/yarn/bun repos
    • Adds base-branch, labels, and token GitHub Action inputs for the fix PR workflow
    • Shows override hygiene hint when overrides/resolutions/patchedDependencies are detected without --check-overrides flag
    • Exposes --report flag as a GitHub Action input with --no-open automatically applied in CI context

    4 details in Everything

24. v1.25.0 Jun 20, 2026 · release notes

    v1.25.0 adds cve-lite overrides subcommand for audit/fix of npm/pnpm/yarn/bun override hygiene with NDJSONNDJSONA text format where each line is a self-contained JSON object, making it easy to stream, append, and parse large datasets record-by-record without loading the whole file into memory. logging and RFC 6902RFC 6902A JSON standard from the IETF that defines a format for describing changes to a JSON document as a sequence of operations such as add, remove, and replace, letting tools patch structured data without transmitting full replacements. patching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.25.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.25.0

    └──▷ USE IT
    Audit a project's lockfile for ineffective or dangerous package overrides and output structured JSON for CI consumption.
    shell copy

    cve-lite overrides ./package-lock.json --json

    Automatically repair invalid overrides in-place using safe RFC 6902 patches.
    shell copy

    cve-lite overrides ./package.json --fix

    Stream override detection events to a log file for audit trails, triggered via environment variable.
    shell copy

    CVE_LITE_AUDIT_LOG=/var/log/overrides.ndjson cve-lite overrides . --audit-log /var/log/overrides.ndjson

    • cve-lite overrides [path] subcommand audits override hygiene across npm, pnpm, yarn, and bun projects. Covers eight rules (OA001-OA008): orphaned target, floating tag, wrong section, surpassed pin, nested ineffective override, coupled platform binary, frozen latest (registry drift), and materialized vulnerable copy.
    • cve-lite overrides [path] --fix applies override-hygiene fixes as RFC 6902 patches with a chokepoint guard that prevents inventing new override keys
    • --check-overrides runs per-folder override audits in multi-folder workspace scans

    3 details in Everything

25. v1.24.0 Jun 17, 2026 · release notes

    cve-lite-cli v1.24.0 adds --sarif--sarifStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. + --report dual output for CI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.24.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.24.0

    └──▷ USE IT
    Produce SARIF for GitHub Code Scanning and an HTML report in one run.
    shell copy

    cve-lite scan --sarif --report

    Install dev dependencies as a side effect of the fix command.
    shell copy

    cve-lite fix -D

    • --sarif can now be combined with --report to write both a SARIF file and an HTML report in one scan

    1 detail in Everything

26. v1.23.0 Jun 13, 2026 · release notes

    Adds graded output for git sources in MAL advisories

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.23.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.23.0

    └──▷ TRY IT
    Identify whether a MAL advisory depends on a stable commit or a mutable branch when reviewing terminal scan results.
    copy

    $ cve-lite-cli scan <path_to_lockfile> --format terminal | grep '⚠ Git source'

    • ⚠ Git source (SHA-pinned) and ⚠ Git source (floating ref) warnings added to terminal output for MAL advisories sourced from git

    1 detail in Everything

27. v1.22.0 Jun 11, 2026 · release notes

    cve-lite-cli v1.22.0 adds dev dependency labeling and pnpm/Bun lockfile support for private registry detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.22.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.22.0

    • Terminal output and HTML reports now show direct · dev / transitive · dev labels for findings from devDependencies, with Yarn Classic and Berry parsers updated to detect dev status
    • Private registry detection (⚠ Unverifiable (private source)) is now supported for pnpm (legacy and v9), Yarn Classic, and Bun lockfiles

    2 details in Everything

28. v1.20.0 Jun 9, 2026 · release notes

    cve-lite-cli v1.20.0 adds --create-pr automation for lockfile fixes and Bun parser improvements

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.20.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.20.0

    └──▷ USE IT
    Automate vulnerability remediation by fixing lockfile and opening a PR with summary details.
    shell copy

    cve-lite-cli --fix --create-pr --base develop

    • Adds --create-pr flag to cve-lite-cli that commits lockfile changes and opens a GitHub PR via gh after running with --fix
    • Adds --base <branch> flag to specify the base branch for the --create-pr workflow (default: main)
    • Updates Bun parser to reconstruct transitive paths from package relationships, enabling within-range remediation for Bun lockfiles

    3 details in Everything

29. v1.19.0 Jun 2, 2026 · release notes

    cve-lite-cli v1.19.0 adds automatic multi-folder scanning for monorepos without a root lockfile

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.19.0

    └──▷ USE IT
    Scan a monorepo structure without a root package-lock.json, letting the tool detect and report findings per subdirectory.
    shell copy

    cve-lite . --json | jq '.[] | .subfolder'

    • cve-lite . automatically switches to multi-folder mode when no root lockfile is found but multiple lockfiles exist in subfolders
    • --json output now includes a subfolder field on each finding

    2 details in Everything

30. v1.18.2 Jun 1, 2026 · release notes

    Adds --debug flag for traceable JSONLJSONLA text format where each line is a self-contained, valid JSON object, making it easy to stream, append, and process large datasets line by line without parsing a full JSON array into memory. logs and fixes unknown-severity handling in compact output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.2 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.18.2

    └──▷ TRY IT
    Enable detailed tracing for a scan to debug network issues or cache behavior by capturing the output log path.
    copy

    $ cve-lite scan <target> --debug

    • Adds --debug flag to write a timestamped JSONL log file alongside the scan with network requests, cache hits, and runtime events; a single stderr line identifies the log file path
    • Unknown-severity findings no longer silently dropped from compact and verbose terminal output; compact mode now shows all direct unknown findings regardless of how many critical/high findings are present

    2 details in Everything

31. v1.18.1 May 27, 2026 · release notes

    v1.18.1 adds corporate SSLSSLA cryptographic protocol for encrypting network connections, now deprecated in favor of TLS but whose name persists colloquially. Cyber tools reference it when handling HTTPS or other encrypted-channel inspection and termination. proxy support via --ca-cert/config and workspace-scoped direct fix commands for npm/pnpm/yarn/bun monorepos

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.1 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.18.1

    └──▷ TRY IT
    Scan or sync advisories through a corporate MITM proxy that requires a custom CA certificate.
    copy

    $ cve-lite scan --ca-cert /path/to/corporate-ca.pem

    Persist the corporate SSL proxy certificate so all future CLI invocations use it without repeated flags.
    copy

    $ cve-lite config set ca-cert /path/to/corporate-ca.pem

    Apply a direct dependency fix to a specific workspace in a pnpm monorepo, targeting only that scope.
    copy

    $ pnpm add --filter ./packages/my-workspace lodash

    • cve-lite config set ca-cert <path> saves a PEM CA certificate path persistently in ~/.cve-lite-cli/config.json for corporate SSL proxy support
    • Adds --ca-cert <path> CLI flag to pass a PEM CA certificate for a single scan or advisory sync invocation
    • Workspace-scoped direct fix commands now include the appropriate workspace flag (npm install -w <workspace>, pnpm add --filter ./path, yarn workspace <name> add, bun add --filter <name>) for npm, pnpm, yarn, or bun workspace projects
    • GitHub Action gains a matching ca-cert input for corporate SSL proxy configuration

    4 details in Everything

32. v1.18.0 May 25, 2026 · release notes

    cve-lite-cli v1.18.0 adds OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. retry logic and pnpm/yarn/bun lockfile-refresh fix commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.18.0

    • Adds targeted retry and offline hints for OSV 429 rate-limit and 5xx server error responses
    • Adds pnpm update, yarn upgrade, and bun update commands to --fix when the parent's declared range already covers the fixed transitive dependency version
    • Adds fix coverage count ("Running these commands should fix X of Y findings") to terminal and HTML output for lockfile-refresh targets

    3 details in Everything

33. v1.17.0 May 20, 2026 · release notes

    Adds npm-shrinkwrap.json support and CVE counts in all output modes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.17.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.17.0

    • Adds npm-shrinkwrap.json support with correct precedence over package-lock.json when both are present
    • Shows CVE count alongside package count in terminal summary, compact output, verbose quick-take, and HTML report

    2 details in Everything

34. v1.16.0 May 13, 2026 · release notes

    Adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output via --cdx and GitHub Action input for cve-lite-cli v1.16.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.16.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.16.0

    └──▷ USE IT
    Generate a compliance-ready SBOM of all dependencies in the current directory.
    shell copy

    cve-lite-scan --cdx

    Enable CycloneDX output in a GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow.
    yaml copy

    - uses: cve-lite-cli/action@v1
      with:
        cdx: true

    • Adds --cdx flag to generate a CycloneDX 1.4 JSON SBOM including all lockfile packages as components
    • Adds cdx input (default false) to the GitHub Action for enabling CycloneDX output

    2 details in Everything

35. v1.15.1 May 13, 2026 · release notes

    cve-lite-cli v1.15.1 adds --usage filtering, SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, and GitHub Action inputs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.15.1 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.15.1

    • --sarif flag generates a SARIF 2.1.0SARIF 2.1.0A JSON-based file format, standardized by OASIS, for expressing static analysis results so that cyber tools from different vendors can share findings through a single, machine-readable schema. file for upload to GitHub Code Scanning
    • no-cache input added to the GitHub Action, defaulting to true in CI environments

    2 details in Everything

36. v1.15.0 May 11, 2026 · release notes

    cve-lite-cli v1.15.0 adds install-skill subcommand and timestamped JSON files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.15.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.15.0

    └──▷ TRY IT
    Automatically configure AI coding assistants in the current project to understand CVE Lite context.
    copy

    $ cve-lite-cli install-skill

    • Adds install-skill subcommand to generate AI assistant skill files for Claude Code, Codex CLI, Gemini CLI, Cursor, and GitHub Copilot.

    1 detail in Everything

37. v1.14.0 May 6, 2026 · release notes

    Adds --no-cache flag for fresh OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. queries and transitive context columns in reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.14.0

    • --no-cache flag forces a fresh OSV query for all packages in a single scan, bypassing the queryEntries cache while still writing results back so subsequent runs benefit from caching as normal. Mutually exclusive with --offline and --offline-db.
    • Transitive context column added to the HTML report findings table, showing the dependency path from each vulnerable transitive package back to a direct dependency.

    2 details in Everything

38. v1.13.0 May 6, 2026 · release notes

    cve-lite-cli v1.13.0 adds Yarn Berry lockfile parsing and verbose table output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.13.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.13.0

    • --all flag now appends the full findings table in compact mode (previously only --verbose showed it)
    • Output summary renders severity counts (Critical, High, Medium, Low, Unknown) as a box-drawing table
    • Yarn Berry (v2+) lockfile support with __metadata: detection and resolution: field extraction

    3 details in Everything

39. v1.12.1 May 2, 2026 · release notes

    cve-lite-cli v1.12.1 adds signed tarballs and new security/verification documentation sections

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.1 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.12.1

    └──▷ TRY IT
    Verify the cryptographic signature of a downloaded cve-lite-cli release tarball.
    copy

    $ gh attestation verify cve-lite-cli-X.Y.Z.tgz --repo OWASP/cve-lite-cli

    Verify the signature of an npm-installed copy of cve-lite-cli.
    copy

    $ npm audit signatures

    • Release tarballs are now cryptographically signed using GitHub's Sigstore-backed Artifact Attestations with ephemeral OIDCOIDCOpenID Connect, a sign-in protocol built on OAuth 2.0. An application uses identity information from a trusted provider instead of maintaining a separate password for each user.-issued keys.
    • README adds Security and verification section explaining tarball and npm package verification via npm audit signatures.

    2 details in Everything

40. v1.12.0 May 2, 2026 · release notes

    HTML reports show runnable fix commands and JSON output gains a runnableFixCommand field.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.12.0

    • Adds runnableFixCommand: string | null field to serialized findings for programmatic consumers.

    1 detail in Everything

41. v1.11.0 Apr 30, 2026 · release notes

    Adds npm update remediation recommendations and dependency graph context for CVE-lite-cli

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    • Builds a logical dependency graph from package-lock.json to map hoisted packages back to their actual parent chain
    • Recommends npm update <parent> for npm transitive findings when a safe child version is reachable within the current parent dependency range
    • Shows progress indicator while analyzing vulnerability findings after advisory details are loaded

    3 details in Everything

42. v1.10.0 Apr 29, 2026 · release notes

    HTML report gains search/filter control; CI docs add --all flag example.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    └──▷ USE IT
    Run CVE Lite CLI scanning all dependencies, following updated CI documentation examples.
    shell copy

    cve-lite scan --all

    • HTML report now includes a search/filter control in the findings table
    • CI integration docs include the --all flag in example commands

    2 details in Everything

43. v1.8.0 Apr 22, 2026 · release notes

    Adds usage-aware dependency analysis with --usage and --only-used flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • --usage and --only-used flags added to the CLI to enable static source code analysis for import reachability of vulnerable dependencies.
    • CLI tables now include a dedicated Usage column that displays import counts or marks entries as unused, color-coded red and green.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Tables now use a dedicated Breaking? column with a ⚠ symbol; previous annotation methods are no longer displayed in the primary output.
44. v1.7.0 Apr 17, 2026 · release notes

    cve-lite-cli v1.7.0 adds pnpm lockfile v9 parsing to eliminate false negatives

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

45. v1.6.0 Apr 17, 2026 · release notes

    cve-lite-cli v1.6.0 adds bun.lockfile parsing and --prod-only filtering with breaking change annotations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    └──▷ TRY IT
    View fix suggestions with clear breaking change indicators before upgrading major versions.
    copy

    $ cve-lite-cli fix bun.lock

    • Adds bun.lock support (JSONC format from Bun v1.1.38) with workspace dependency manifest detection for dev-only packages
    • Adds --prod-only flag to filter out development dependencies when parsing lockfiles

    2 details in Everything

46. v1.5.2 Apr 10, 2026 · release notes

    Adds conservative --fix mode for validated direct dependency remediation with automatic rescans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.2 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.5.2

    └──▷ USE IT
    Apply automated, conservative fixes to direct dependencies in a project and verify the results.
    shell copy

    cve-lite-cli --fix

    • Adds --fix flag to apply package-manager-native direct updates and automatically rescans after application
    • Adds conservative mode via --fix that targets only validated direct dependencies

    2 details in Everything

47. v1.5.1 Apr 10, 2026 · release notes

    New structured table output for fix-command verbose mode clarifies parent-upgrade remediation steps.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.1 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.5.1

    • Refines dependency classification logic so only root manifest-declared dependencies are treated as direct

    1 detail in Everything

48. v1.5.0 Apr 10, 2026 · release notes

    Adds advisory-range validation for lowest known non-vulnerable target selection in cve-lite-cli v1.5.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • Adds version-scan metrics for validated remediation targeting (scanned versions and still-vulnerable exclusions) to track which versions were scanned and excluded from vulnerability coverage
    • Improves direct remediation output with structured table rendering including package/current/target/scanned/vulnerable columns and total row for verbose summary

    2 details in Everything

49. v1.4.0 Apr 7, 2026 · release notes

    cve-lite-cli v1.4.0 adds npm fixed-version validation, unpublishable warnings, and a NestJS case study.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Add a new NestJS case study showing the local scan-fix-rescan workflow in practice

    1 detail in Everything

50. v1.3.0 Apr 5, 2026 · release notes

    v1.3.0 adds package-manager-aware suggested fix commands and explicit skipped-item output for urgent findings

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    └──▷ TRY IT
    Apply a suggested fix for a Node.js dependency based on the lockfile type
    copy

    $ npm install jsonwebtoken@4.2.2 express-jwt@2.1.0 sanitize-html@2.17.2

    • Explicit skipped-item output introduced for urgent findings that cannot be fixed confidently
    • Package-manager-aware suggested fix commands generated for urgent findings (npm install ..., pnpm add ..., yarn add ...)

    2 details in Everything

51. v1.2.0 Apr 4, 2026 · release notes

    Adds a reusable GitHub Action for CVE Lite CLI and new configuration options (verbose, fail-on)

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Run CVE Lite in CI and fail the build if high severity vulnerabilities are found.
    yaml copy

    - uses: sonukapoor/cve-lite-cli@v1.2.0
      with:
        verbose: "true"
        fail-on: high

    • Introduces a reusable first-party GitHub Action for running CVE Lite CLI in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure.
    • Adds verbose and fail-on inputs to the GitHub Action workflow
    • Supports opt-in postinstall usage, git hooks, CI, and scheduled advisory DB refreshes via workflow integration

    3 details in Everything

52. v1.1.1 Apr 4, 2026 · release notes

    Adds offline freshness reporting and stale-data warnings for local advisory DBs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

    └──▷ TRY IT
    Sync advisories to a custom location and scan offline with that specific DB file.
    copy

    $ cve-lite advisories sync --output /path/to/advisories.db
    cve-lite /path/to/project --offline-db /path/to/advisories.db

    • Adds advisory DB freshness reporting during offline scans
    • Adds stale-data warnings when the local advisory DB appears old or is missing sync metadata
    • Supports specifying an explicit path for the local advisory database via --output and --offline-db

    3 details in Everything

53. v1.1.0 Apr 4, 2026 · release notes

    Adds cve-lite advisories sync subcommand and --offline/--offline-db flags for local advisory DB management

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    └──▷ USE IT
    Sync the local advisory DB and scan a project against it without network access.
    shell copy

    cve-lite advisories sync
    cve-lite /path/to/project --offline

    Sync the DB to a custom file and scan using that specific local database.
    shell copy

    cve-lite advisories sync --output /path/to/advisories.db
    cve-lite /path/to/project --offline-db /path/to/advisories.db

    • Adds the cve-lite advisories sync subcommand to download the official OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. npm dump and build a local SQLite advisory database
    • Adds the --offline flag to enable offline scanning mode using the local advisory DB
    • Adds the --offline-db <path> flag to explicitly select a custom path for the local offline advisory database

    3 details in Everything

54. v1.0.6 Apr 2, 2026 · release notes

    CVE Lite CLI v1.0.6 adds parent upgrade guidance for transitive vulnerabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.6 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.0.6

55. v1.0.5 Mar 31, 2026 · release notes

    Adds --osv-url flag to route vulnerability lookups via internal proxies or mirrors

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.5 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.0.5

    └──▷ USE IT
    Scan for CVE details using an internal, air-gapped OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. mirror instead of the public endpoint
    shell copy

    cve-lite-cli --osv-url https://internal-mirror.example.com/osv CVE-2023-1234

    • Adds the --osv-url CLI argument to specify a configurable advisory endpoint for vulnerability lookups
    • Enables routing all advisory requests through internal proxies or mirrors by setting the --osv-url parameter

    2 details in Everything

56. v1.0.4 Mar 29, 2026 · release notes

    Adds --verbose flag to cve-lite CLI for detailed findings, dependency paths, and suggested fix plans

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.4 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout v1.0.4

    └──▷ TRY IT
    Scan a local project for dependencies with full context including dependency paths and remediation advice.
    copy

    $ cve-lite . --verbose

    Enforce a high-severity policy in CI pipelines by failing the build if high CVEs are detected with verbose context.
    copy

    $ cve-lite . --verbose --fail-on high

57. 1.0.2 Mar 28, 2026 · release notes

    First public release of CVE Lite CLI: a developer-focused scanner for JS/TS projects with SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface./JSON output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.2 https://github.com/OWASP/cve-lite-cli.git
    # already have the repo? check out this version:
    $ git checkout 1.0.2

    • Supports SARIF and JSON output formats suitable for CI pipelines and automation workflows.

    1 detail in Everything