https://cybertoolchain.io/tools/cve-lite-cli New releases and features in cve-lite-cli, tracked by The Cyber Toolchain. en Wed, 21 Oct 2026 11:53:12 GMT https://github.com/OWASP/cve-lite-cli/releases/tag/v1.40.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.40.0 Wed, 21 Oct 2026 11:53:12 GMT Adds PR-scoped delta comments via GitHub Action `delta` input and enriches `--json` output with version, timestamp, and effective options.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `delta` input to the GitHub Action so pull requests receive a single upserted comment listing only the findings that PR introduced, not the full tree; fork PRs fall back to the job summary.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • SARIF rule help markdown now leads with a link to the project so a triaging analyst can identify which tool produced each Code Scanning alert. Breaking changes: • `--ratchet` with no committed baseline now applies `--fail-on` and exits non-zero when findings match the gate, instead of writing a baseline and exiting 0 — a CI job that checks out fresh every run and never committed its baseline could previously not fail and now can. • pnpm lockfile v6 (pnpm 8 and earlier) was misparsed, causing vulnerable trees to report clean; re-scanning after upgrading may surface new findings that were silently missed before. • The recommended upgrade version for a transitive finding now resolves the parent from the finding's own dependency path, so some previously reported fix versions will change. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.38.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.38.0 Sun, 04 Oct 2026 17:24:55 GMT cve-lite-cli v1.38.0 adds contextual per-finding prioritization signals and a new override-hygiene rule OA011⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `reachability`, `exposure`, and `usage` contextual prioritization signals to each verbose finding, surfaced separately from the EPSS `prioritySignal`; `reachability` reports `path_depth_2` and above or falls back to `direct_dependency`, `exposure` flags findings whose path runs through a request-handling package, and `usage` is omitted entirely on a default scan rather than printed as `n/a`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds new override-hygiene rule `OA011` — detects an override floor that exceeds every declaring package's range — joining the `OverrideRuleId` union alongside OA001–OA010. • The `--all` findings table drops the `IDs` column; advisory IDs remain available in `--verbose`, JSON, SARIF, CycloneDX, and the HTML report. • The usage scan's 5000-file cap is now disclosed in the terminal, in `--json`, and in both HTML reporters, scoped per folder in multi-folder mode; a truncated scan records `unknown` for the contextual usage signal rather than claiming a package is unused. • Compact output now discloses withheld findings and command groups with counts and instructions (e.g. `Showing 3 of 53 findings. Run --verbose --all to see them all.`) instead of silently truncating. Breaking changes: • If you gate CI on `--check-overrides`, re-run it after upgrading: OA010 was previously unreachable from the scan path and no-oped silently, so a prior 'clean' result may not have been a genuine pass. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.37.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.37.0 Wed, 23 Sep 2026 12:24:26 GMT cve-lite-cli v1.37.0 adds `--output <dir>` to control where JSON, SARIF, and SBOM files land, with a matching GitHub Action input.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `--output <dir>` flag to direct `--json`, `--sarif`, and `--sbom` output files into a specified directory (created when missing); passing `--output` without one of those three flags is an error rather than a silent no-op.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a matching `output` input to the GitHub Action for the same directory-routing behaviour. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.36.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.36.0 Sun, 20 Sep 2026 15:46:06 GMT cve-lite-cli v1.36.0 ships the PR delta renderer as a public package and fixes two false-result bugs from v1.35.0.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Publishes the PR delta renderer as part of the distributed package, enabling external tools and CI workflows outside this repository to generate pull request comments from two scan reports.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.35.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.35.0 Wed, 16 Sep 2026 21:02:58 GMT cve-lite-cli v1.35.0 adds override-hygiene rule OA010 and full multi-path dependency display in HTML reports⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds override-hygiene rule `OA010`: flags an override floor that itself admits a known-vulnerable version, surfacing floors that appear protective but are not.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Shows every known dependency path for a finding in the HTML report (capped at five paths per panel), replacing the previous single-primary-path display. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.34.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.34.0 Wed, 09 Sep 2026 12:23:45 GMT cve-lite-cli v1.34.0 adds SPDX 2.3 SBOM output with `--sbom spdx2.3` and a prod/dev findings split in all report formats. • Adds SPDX 2.3 SBOM output via `--sbom spdx2.3` (also `--sbom spdx`); findings attach as `SECURITY` external references of type `advisory`, with severity and fix command in a package annotation; package licenses sourced from the npm lockfile at no network cost; pnpm, Yarn and Bun resolve to `NOASSERTION`; emits `supplier`, `filesAnalyzed: false` and `DEPENDENCY_OF` relationships to satisfy all seven NTIA minimum elements. • Adds `--sbom-inventory-only` flag to emit an SBOM without the vulnerability overlay, for diffing, archival and attestation workflows. • Adds `--sbom cyclonedx` as an alias path to CycloneDX output (alongside the existing `--cdx`), now emitting spec version `1.6` with `tools.components` object form using `publisher`. • Adds a prod-vs-dev split line in compact and verbose terminal output and as a note in the HTML report severity card strip, showing 'N of M findings in prod dependencies' when some findings are dev-only. Breaking changes: • CycloneDX output (`--cdx` and `--sbom cyclonedx`) now emits `specVersion` `1.6` instead of `1.4`; any CI pipeline or tooling that diffs SBOMs or asserts on the `specVersion` field will need updating. • `metadata.tools` in CycloneDX output now uses the 1.6 `tools.components` object form with `publisher`, replacing the deprecated 1.4 array of `{vendor, name, version}`; downstream consumers parsing `metadata.tools` will see a different structure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.33.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.33.0 Tue, 01 Sep 2026 22:56:58 GMT Adds an EPSS Priority Signal combining CVSS severity and EPSS percentile into four actionable tiers across terminal, JSON, and HTML outputs. • Adds a `prioritySignal` field to JSON output exposing four actionable tiers — `fix_now` (high impact + top 10% EPSS), `fix_soon` (high impact), `monitor` (lower severity + top 10% EPSS), `low_priority` (all else) — set to null when no EPSS data is available. • Surfaces the EPSS Priority Signal as a new column in the verbose terminal table (shown with `--verbose`) and as a column plus four-tier legend in the HTML report (`--report`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.32.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.32.0 Tue, 01 Sep 2026 12:43:06 GMT cve-lite-cli v1.32.0 adds license detection, EPSS enrichment, npm advisory fallback, and incomplete-data policy control • Adds `--incomplete-policy warn|error` flag (default: `warn`) to control exit behavior when detection data is incomplete; `error` exits with code 3. GitHub Action gains an `incomplete-policy` input. • Enriches findings with FIRST.org EPSS scores after the OSV pass: highest score shown in the terminal top-3 block, verbose table column, and HTML report detail panel; full score array included in JSON output. Skipped in offline mode and for GHSA-only findings. • Adds the npm registry advisory API as a secondary source for packages with zero OSV matches, closing coverage gaps for CVEs without an npm ecosystem mapping in OSV. Skips in offline mode and is non-fatal on error. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.31.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.31.0 Thu, 27 Aug 2026 13:00:16 GMT HTML report now links package names to npm registry; package-registry navigation added to findings table. • HTML report findings table now links each package name directly to its npm registry page, enabling one-click research from scan output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.30.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.30.0 Sun, 23 Aug 2026 04:47:32 GMT cve-lite-cli v1.30.0 adds a Root column across all report formats and auto-applies safe transitive fixes with `--fix` • Adds `--fix` auto-application of safe within-range transitive refreshes when the fix is available inside the parent's declared range, without requiring a parent-level upgrade. • Adds a Root column showing the top-level direct dependency behind each transitive finding, across terminal, JSON, and HTML report outputs (including multi-folder scans). • pnpm lockfile parsing now runs once per scan instead of up to three times, delivering approximately 14% faster warm scans on large monorepos. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.29.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.29.0 Tue, 11 Aug 2026 12:33:31 GMT cve-lite-cli v1.29.0: `--usage`/`--only-used` now work in multi-folder scans, cooldown warnings in SARIF, and expanded DM001 maintenance-risk findings • Extends `--usage`/`--only-used` flags to multi-folder scans: each subfolder now gets its own source-usage annotation and filtering, isolated from other subfolders (previously accepted but silently ignored outside single-folder mode). • Surfaces release-cooldown warnings in SARIF output as `properties.cooldownWarning` on the result, making them visible in GitHub Code Scanning. • Expands DM001 maintenance-risk detection (`--check-maintenance`): deprecated npm packages now produce their own `medium`-severity finding (separate from constraint-drag findings); severity is graduated — constraint drag is `high`, deprecation is `medium`; packages abandoned 2+ years show a `Last release` context line. • Renders scan completeness in terminal output (compact and verbose modes) and in HTML reports, surfacing packument-fetch failures and other scan gaps. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.28.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.28.0 Sun, 26 Jul 2026 16:36:35 GMT cve-lite-cli v1.28.0 adds `--check-maintenance` (DM001), `advisories init`, and release-cooldown-aware fix warnings • New `--check-maintenance` flag (rule `DM001`) flags direct dependencies that block a transitive CVE fix via major-version constraint drag, or that are deprecated on npm; renders in terminal, JSON, multi-folder, and HTML report, and counts toward `--fail-on` (high severity for constraint drag, medium for deprecated packages). • New `advisories init` subcommand creates an empty offline advisory database for air-gapped environments to populate manually. • New cooldown-aware fix resolver reads `min-release-age` (npm `.npmrc`), `minimumReleaseAge` (pnpm), and `npmMinimalAgeGate` (yarn) and warns when a recommended fix version is newer than the configured release window; advisory only, on by default, no flag or exit-code change, renders in terminal, `--verbose`, JSON, and HTML report (npm/pnpm/yarn; Bun not yet covered). • Shows skipped manifest dependencies in the HTML report and `report.json`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.27.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.27.0 Tue, 14 Jul 2026 12:59:45 GMT cve-lite-cli v1.27.0 adds two phantom-dependency rules, SARIF fingerprinting for GitHub Code Scanning, and flexible path-first argument ordering. • Adds `--sarif` output with `ruleIndex`, `kind: "open"`, and `partialFingerprints` fields for full GitHub Code Scanning compatibility; shared fingerprint logic extracted to `src/utils/sarif.ts`. • Adds `overrides --json` output written to a timestamped file, consistent with the main scan path. • Adds path-first argument ordering: `cve-lite <path> overrides [flags]` now works alongside `cve-lite overrides <path> [flags]`. • New rule PD001 (Override-only phantom, high): fires when source code imports a package that is only present via an override pin, prompting declaration as a direct dependency. • New rule PD002 (Transitive-only phantom, medium): fires when source code imports a package that is only present as a transitive dependency, prompting an explicit declaration. • New rule OA009 (Stale floor detector): fires when a `>=` or `^` override floor is already met by every parent declaration, flagging the override as redundant. • OA009 safety guard suppresses the stale-floor removal suggestion when the override anchors a phantom import (PD001/PD002 interaction). • Adds `examples/all-scenarios/` fixture that triggers all nine auto-detectable override hygiene rules in a single scan. • Adds a light/dark mode toggle in the HTML report, persisted to `localStorage`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.25.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.25.0 Sat, 20 Jun 2026 17:42:56 GMT v1.25.0 adds `cve-lite overrides` subcommand for audit/fix of npm/pnpm/yarn/bun override hygiene with NDJSON logging and RFC 6902 patching • `cve-lite overrides [path]` subcommand audits override hygiene across npm, pnpm, yarn, and bun projects. Covers eight rules (OA001-OA008): orphaned target, floating tag, wrong section, surpassed pin, nested ineffective override, coupled platform binary, frozen latest (registry drift), and materialized vulnerable copy. • `cve-lite overrides [path] --fix` applies override-hygiene fixes as RFC 6902 patches with a chokepoint guard that prevents inventing new override keys • `--check-overrides` runs per-folder override audits in multi-folder workspace scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.24.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.24.0 Wed, 17 Jun 2026 12:40:41 GMT cve-lite-cli v1.24.0 adds `--sarif` + `--report` dual output for CI • `--sarif` can now be combined with `--report` to write both a SARIF file and an HTML report in one scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.23.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.23.0 Sat, 13 Jun 2026 17:45:10 GMT Adds graded output for git sources in MAL advisories • ⚠ Git source (SHA-pinned) and ⚠ Git source (floating ref) warnings added to terminal output for MAL advisories sourced from git Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.22.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.22.0 Thu, 11 Jun 2026 20:51:28 GMT cve-lite-cli v1.22.0 adds dev dependency labeling and pnpm/Bun lockfile support for private registry detection • Terminal output and HTML reports now show `direct · dev` / `transitive · dev` labels for findings from devDependencies, with Yarn Classic and Berry parsers updated to detect dev status • Private registry detection (⚠ Unverifiable (private source)) is now supported for pnpm (legacy and v9), Yarn Classic, and Bun lockfiles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.20.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.20.0 Tue, 09 Jun 2026 03:20:26 GMT cve-lite-cli v1.20.0 adds `--create-pr` automation for lockfile fixes and Bun parser improvements • Adds `--create-pr` flag to `cve-lite-cli` that commits lockfile changes and opens a GitHub PR via `gh` after running with `--fix` • Adds `--base <branch>` flag to specify the base branch for the `--create-pr` workflow (default: main) • Updates Bun parser to reconstruct transitive paths from package relationships, enabling within-range remediation for Bun lockfiles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.19.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.19.0 Tue, 02 Jun 2026 02:24:15 GMT cve-lite-cli v1.19.0 adds automatic multi-folder scanning for monorepos without a root lockfile • `cve-lite .` automatically switches to multi-folder mode when no root lockfile is found but multiple lockfiles exist in subfolders • `--json` output now includes a `subfolder` field on each finding Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.18.2 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.18.2 Mon, 01 Jun 2026 11:37:24 GMT Adds --debug flag for traceable JSONL logs and fixes unknown-severity handling in compact output • Adds `--debug` flag to write a timestamped JSONL log file alongside the scan with network requests, cache hits, and runtime events; a single stderr line identifies the log file path • Unknown-severity findings no longer silently dropped from compact and verbose terminal output; compact mode now shows all direct unknown findings regardless of how many critical/high findings are present Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.18.1 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.18.1 Wed, 27 May 2026 21:21:35 GMT v1.18.1 adds corporate SSL proxy support via `--ca-cert`/config and workspace-scoped direct fix commands for npm/pnpm/yarn/bun monorepos • `cve-lite config set ca-cert <path>` saves a PEM CA certificate path persistently in `~/.cve-lite-cli/config.json` for corporate SSL proxy support • Adds `--ca-cert <path>` CLI flag to pass a PEM CA certificate for a single scan or advisory sync invocation • Workspace-scoped direct fix commands now include the appropriate workspace flag (`npm install -w <workspace>`, `pnpm add --filter ./path`, `yarn workspace <name> add`, `bun add --filter <name>`) for npm, pnpm, yarn, or bun workspace projects • GitHub Action gains a matching `ca-cert` input for corporate SSL proxy configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.18.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.18.0 Mon, 25 May 2026 19:24:14 GMT cve-lite-cli v1.18.0 adds OSV retry logic and pnpm/yarn/bun lockfile-refresh fix commands • Adds targeted retry and offline hints for OSV 429 rate-limit and 5xx server error responses • Adds `pnpm update`, `yarn upgrade`, and `bun update` commands to `--fix` when the parent's declared range already covers the fixed transitive dependency version • Adds fix coverage count ("Running these commands should fix X of Y findings") to terminal and HTML output for lockfile-refresh targets Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.16.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.16.0 Wed, 13 May 2026 09:55:08 GMT Adds CycloneDX SBOM output via `--cdx` and GitHub Action input for cve-lite-cli v1.16.0 • Adds `--cdx` flag to generate a CycloneDX 1.4 JSON SBOM including all lockfile packages as components • Adds `cdx` input (default `false`) to the GitHub Action for enabling CycloneDX output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.15.1 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.15.1 Wed, 13 May 2026 00:29:20 GMT cve-lite-cli v1.15.1 adds --usage filtering, SARIF output, and GitHub Action inputs • `--sarif` flag generates a SARIF 2.1.0 file for upload to GitHub Code Scanning • `no-cache` input added to the GitHub Action, defaulting to `true` in CI environments Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.14.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.14.0 Wed, 06 May 2026 21:58:32 GMT Adds `--no-cache` flag for fresh OSV queries and transitive context columns in reports • `--no-cache` flag forces a fresh OSV query for all packages in a single scan, bypassing the `queryEntries` cache while still writing results back so subsequent runs benefit from caching as normal. Mutually exclusive with `--offline` and `--offline-db`. • Transitive context column added to the HTML report findings table, showing the dependency path from each vulnerable transitive package back to a direct dependency. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.13.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.13.0 Wed, 06 May 2026 14:27:48 GMT cve-lite-cli v1.13.0 adds Yarn Berry lockfile parsing and verbose table output • `--all` flag now appends the full findings table in compact mode (previously only `--verbose` showed it) • Output summary renders severity counts (`Critical`, `High`, `Medium`, `Low`, `Unknown`) as a box-drawing table • Yarn Berry (v2+) lockfile support with `__metadata:` detection and `resolution:` field extraction Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.12.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.12.0 Sat, 02 May 2026 12:40:09 GMT HTML reports show runnable fix commands and JSON output gains a `runnableFixCommand` field. • Adds `runnableFixCommand: string | null` field to serialized findings for programmatic consumers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.11.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.11.0 Thu, 30 Apr 2026 20:37:35 GMT Adds `npm update` remediation recommendations and dependency graph context for CVE-lite-cli • Builds a logical dependency graph from `package-lock.json` to map hoisted packages back to their actual parent chain • Recommends `npm update <parent>` for npm transitive findings when a safe child version is reachable within the current parent dependency range • Shows progress indicator while analyzing vulnerability findings after advisory details are loaded Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.10.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.10.0 Wed, 29 Apr 2026 01:41:35 GMT HTML report gains search/filter control; CI docs add --all flag example. • HTML report now includes a search/filter control in the findings table • CI integration docs include the `--all` flag in example commands Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.8.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.8.0 Wed, 22 Apr 2026 00:18:07 GMT Adds usage-aware dependency analysis with `--usage` and `--only-used` flags • `--usage` and `--only-used` flags added to the CLI to enable static source code analysis for import reachability of vulnerable dependencies. • CLI tables now include a dedicated `Usage` column that displays import counts or marks entries as `unused`, color-coded red and green. Breaking changes: • Tables now use a dedicated `Breaking?` column with a `⚠` symbol; previous annotation methods are no longer displayed in the primary output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.6.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.6.0 Fri, 17 Apr 2026 01:22:23 GMT cve-lite-cli v1.6.0 adds bun.lockfile parsing and `--prod-only` filtering with breaking change annotations • Adds `bun.lock` support (JSONC format from Bun v1.1.38) with workspace dependency manifest detection for dev-only packages • Adds `--prod-only` flag to filter out development dependencies when parsing lockfiles Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.5.2 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.5.2 Fri, 10 Apr 2026 23:49:58 GMT Adds conservative `--fix` mode for validated direct dependency remediation with automatic rescans. • Adds `--fix` flag to apply package-manager-native direct updates and automatically rescans after application • Adds conservative mode via `--fix` that targets only validated direct dependencies Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.5.1 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.5.1 Fri, 10 Apr 2026 14:22:31 GMT New structured table output for `fix-command` verbose mode clarifies parent-upgrade remediation steps. • Refines dependency classification logic so only root manifest-declared dependencies are treated as direct Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.5.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.5.0 Fri, 10 Apr 2026 03:56:12 GMT Adds advisory-range validation for lowest known non-vulnerable target selection in cve-lite-cli v1.5.0 • Adds version-scan metrics for validated remediation targeting (scanned versions and still-vulnerable exclusions) to track which versions were scanned and excluded from vulnerability coverage • Improves `direct remediation output` with structured table rendering including package/current/target/scanned/vulnerable columns and total row for verbose summary Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.4.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.4.0 Tue, 07 Apr 2026 03:32:28 GMT cve-lite-cli v1.4.0 adds npm fixed-version validation, unpublishable warnings, and a NestJS case study. • Add a new NestJS case study showing the local scan-fix-rescan workflow in practice Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.2.0 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.2.0 Sat, 04 Apr 2026 23:36:45 GMT Adds a reusable GitHub Action for CVE Lite CLI and new configuration options (verbose, fail-on) • Introduces a **reusable first-party GitHub Action** for running CVE Lite CLI in GitHub Actions • Adds `verbose` and `fail-on` inputs to the GitHub Action workflow • Supports **opt-in postinstall usage**, git hooks, CI, and scheduled advisory DB refreshes via workflow integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.1.1 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.1.1 Sat, 04 Apr 2026 19:44:00 GMT Adds offline freshness reporting and stale-data warnings for local advisory DBs • Adds advisory DB freshness reporting during offline scans • Adds stale-data warnings when the local advisory DB appears old or is missing sync metadata • Supports specifying an explicit path for the local advisory database via `--output` and `--offline-db` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.0.5 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.0.5 Tue, 31 Mar 2026 02:27:27 GMT Adds `--osv-url` flag to route vulnerability lookups via internal proxies or mirrors • Adds the `--osv-url` CLI argument to specify a configurable advisory endpoint for vulnerability lookups • Enables routing all advisory requests through internal proxies or mirrors by setting the `--osv-url` parameter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/v1.0.4 https://github.com/OWASP/cve-lite-cli/releases/tag/v1.0.4 Sun, 29 Mar 2026 21:24:39 GMT Adds `--verbose` flag to cve-lite CLI for detailed findings, dependency paths, and suggested fix plans • Adds `--verbose` flag to control detailed output including findings table, dependency paths, and suggested fix plan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli https://github.com/OWASP/cve-lite-cli/releases/tag/1.0.2 https://github.com/OWASP/cve-lite-cli/releases/tag/1.0.2 Sat, 28 Mar 2026 01:23:16 GMT First public release of CVE Lite CLI: a developer-focused scanner for JS/TS projects with SARIF/JSON output. • Supports SARIF and JSON output formats suitable for CI pipelines and automation workflows. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/cve-lite-cli