OWASP/cve-lite-cli

Added

• --cdx writes a CycloneDX 1.4 JSON SBOM (cve-lite-scan-<timestamp>.cdx.json) to the current directory. The SBOM includes all lockfile packages as components — not just vulnerable ones — making it suitable as a compliance artifact even on a clean scan. Vulnerability data is attached for any CVE findings, deduplicated by CVE ID with multiple affects references when the same CVE affects more than one package. Runnable fix commands are included as recommendations when available.
• GitHub Action gains a cdx input (default "false") to enable CycloneDX SBOM output from the Action.
• Self-scan CI workflow now generates a SARIF file and uploads findings to GitHub Code Scanning via github/codeql-action/upload-sarif.

Fixed

• --sarif and --cdx now suppress terminal table output, matching the behaviour of --json. Running any export flag shows only the spinner progress and the saved file path. Use --verbose alongside an export flag to restore full terminal output.

Changed

• Output file writing (JSON, SARIF, CycloneDX) extracted from index.ts into a dedicated write-outputs.ts dispatcher module, keeping index.ts lean as new export formats are added.

Validation

• npm test
• npm run build