Retire.js

No entries match these filters. Clear filters

1. 6.1.0 Oct 6, 2026 · issue 096

   Retire.js 6.1.0 improves repository validation error output and warns on ignored positional arguments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 6.1.0 https://github.com/RetireJS/retire.js.git
   # already have the repo? check out this version:
   $ git checkout 6.1.0

   • Repository validation errors (for an invalid --jsrepo, and from repository/validate) are now listed one per line with the location of each problem, instead of as a nested JSON tree.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Positional arguments (e.g. retire . or retire src/) now print a warning directing users to use --path <path> instead of being silently ignored.
   • Repository validation errors (for an invalid --jsrepo, and from repository/validate) are now listed one per line with the location of each problem, instead of as a nested JSON tree.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

2. 5.7.0 Aug 22, 2026 · issue 053

   Retire.js 5.7.0 adds CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. output with full SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license reporting and richer BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. metadata across 1.6 and 1.7 formats.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.7.0 https://github.com/RetireJS/retire.js.git
   # already have the repo? check out this version:
   $ git checkout 5.7.0

   └──▷ TRY IT
   Generate a CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.7 SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with full per-component SPDX license expressions and detection evidence for a Node.js project.
   copy

   $ retire --outputformat cyclonedxJSON1_7

   Generate a CycloneDX 1.7 VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. report (includes vulnerability detail fields) and exit 0 even if vulnerabilities are found, for use in CI pipelines that handle VEX downstream.
   copy

   $ retire --outputformat cyclonedxJSON1_7_VEX --exitwith 0

   • Adds --outputformat cyclonedxJSON1_7 and --outputformat cyclonedxJSON1_7_VEX flags for CycloneDX 1.7 SBOM output.
   • CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. and 1.7 reports now include $schema, metadata.tools (object form from spec 1.5), metadata.component (scanned path as BOM subject), dependencies (scan target linked to all detected components), evidence.identity (version-detection technique and confidence, e.g. filecontent, filename, hash, ast), and vulnerabilities[].detail (VEX variants only, when the repository supplies details).

   2 details in Everything

3. 5.6.0 Aug 22, 2026 · issue 053

   Retire.js 5.6.0 surfaces --insecure usage in JSON and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. reports so auditors can detect certificate-check bypasses.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.6.0 https://github.com/RetireJS/retire.js.git
   # already have the repo? check out this version:
   $ git checkout 5.6.0

   • Adds ignoreRepositoryCertificateErrors field to JSON reports when --insecure is set, making repository certificate-check bypasses machine-readable.
   • Adds a retirejs:ignore-repository-certificate-errors entry under metadata.properties in all CycloneDX reports when --insecure is set, surfacing the bypass in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output.

   2 details in Everything

4. 5.5.0 Aug 21, 2026 · issue 053

   Retire.js 5.5.0 adds vulnerability repository metadata to JSON and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. reports, plus source attribution in CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. output.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.5.0 https://github.com/RetireJS/retire.js.git
   # already have the repo? check out this version:
   $ git checkout 5.5.0

   • Adds vulnerabilityRepositories field to JSON report output, listing the vulnerability repositories used during the scan.
   • Adds retirejs:vulnerability-repository entries under metadata.properties in all CycloneDX report formats, surfacing which repositories backed the scan.
   • CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used.

   3 details in Everything

5. 4.3.0 May 31, 2023 · release notes

   Retire.js 4.3.0 adds support for the basePurl field in repositories to generate purls in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 4.3.0 https://github.com/RetireJS/retire.js.git
   # already have the repo? check out this version:
   $ git checkout 4.3.0

   • Adds basePurl repository configuration key to enable generating package URLs (purls) in Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. (SBOM) output

   1 detail in Everything

6. 1.0.0 Apr 7, 2015 · release notes

   Retire.js 1.0.0 adds vulnerability severity and CVE identifiers to its detection data.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 1.0.0 https://github.com/RetireJS/retire.js.git
   # already have the repo? check out this version:
   $ git checkout 1.0.0

   • Adds severity info to vulnerabilities in the core detection dataset

   1 detail in Everything