https://cybertoolchain.io/tools/retire-js New releases and features in Retire.js, tracked by The Cyber Toolchain. en Tue, 06 Oct 2026 12:32:12 GMT https://github.com/RetireJS/retire.js/releases/tag/6.1.0 https://github.com/RetireJS/retire.js/releases/tag/6.1.0 Tue, 06 Oct 2026 12:32:12 GMT Retire.js 6.1.0 improves repository validation error output and warns on ignored positional arguments.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Repository validation errors (for an invalid `--jsrepo`, and from `repository/validate`) are now listed one per line with the location of each problem, instead of as a nested JSON tree.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Positional arguments (e.g. `retire .` or `retire src/`) now print a warning directing users to use `--path <path>` instead of being silently ignored. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/retire-js https://github.com/RetireJS/retire.js/releases/tag/5.7.0 https://github.com/RetireJS/retire.js/releases/tag/5.7.0 Sat, 22 Aug 2026 07:59:41 GMT Retire.js 5.7.0 adds CycloneDX 1.7 output with full SPDX license reporting and richer BOM metadata across 1.6 and 1.7 formats. • Adds `--outputformat cyclonedxJSON1_7` and `--outputformat cyclonedxJSON1_7_VEX` flags for CycloneDX 1.7 SBOM output. • CycloneDX 1.6 and 1.7 reports now include `$schema`, `metadata.tools` (object form from spec 1.5), `metadata.component` (scanned path as BOM subject), `dependencies` (scan target linked to all detected components), `evidence.identity` (version-detection technique and confidence, e.g. `filecontent`, `filename`, `hash`, `ast`), and `vulnerabilities[].detail` (VEX variants only, when the repository supplies `details`). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/retire-js https://github.com/RetireJS/retire.js/releases/tag/5.6.0 https://github.com/RetireJS/retire.js/releases/tag/5.6.0 Sat, 22 Aug 2026 07:12:57 GMT Retire.js 5.6.0 surfaces `--insecure` usage in JSON and CycloneDX reports so auditors can detect certificate-check bypasses. • Adds `ignoreRepositoryCertificateErrors` field to JSON reports when `--insecure` is set, making repository certificate-check bypasses machine-readable. • Adds a `retirejs:ignore-repository-certificate-errors` entry under `metadata.properties` in all CycloneDX reports when `--insecure` is set, surfacing the bypass in SBOM output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/retire-js https://github.com/RetireJS/retire.js/releases/tag/5.5.0 https://github.com/RetireJS/retire.js/releases/tag/5.5.0 Fri, 21 Aug 2026 11:48:11 GMT Retire.js 5.5.0 adds vulnerability repository metadata to JSON and CycloneDX reports, plus source attribution in CycloneDX 1.6 VEX output. • Adds `vulnerabilityRepositories` field to JSON report output, listing the vulnerability repositories used during the scan. • Adds `retirejs:vulnerability-repository` entries under `metadata.properties` in all CycloneDX report formats, surfacing which repositories backed the scan. • CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/retire-js https://github.com/RetireJS/retire.js/releases/tag/4.3.0 https://github.com/RetireJS/retire.js/releases/tag/4.3.0 Wed, 31 May 2023 09:50:06 GMT Retire.js 4.3.0 adds support for the basePurl field in repositories to generate purls in SBOM output • Adds `basePurl` repository configuration key to enable generating package URLs (purls) in Software Bill of Materials (SBOM) output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/retire-js