OWASP/cve-lite-cli

v1.20.0 Feature

This release adds 3 notable features for engineering teams evaluating rollout.

Published 1mo Vulnerability Scanning

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

security cve javascript nodejs owasp security-tools

Summary

AI summary

Added GitHub PR creation flag and improved Yarn Classic dependency path reconstruction.

Type	Severity	Summary	CVE
Feature
Feature	Low	Adds `--create-pr` flag to commit lockfile changes and open a GitHub PR Adds `--create-pr` flag to commit lockfile changes and open a GitHub PR Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Low	Adds `--base <branch>` flag to set the base branch for PR creation (default: main) Adds `--base <branch>` flag to set the base branch for PR creation (default: main) Source: llm_adapter@2026-06-09 Confidence: high	—
Feature	Low	Updates Bun parser to reconstruct transitive paths from package relationships for within‑range remediation in Bun lockfiles Updates Bun parser to reconstruct transitive paths from package relationships for within‑range remediation in Bun lockfiles Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Fixes Yarn Classic parser to reconstruct full transitive dependency paths using BFS and correctly suggest `yarn upgrade <pkg>` for deep chains Fixes Yarn Classic parser to reconstruct full transitive dependency paths using BFS and correctly suggest `yarn upgrade <pkg>` for deep chains Source: llm_adapter@2026-06-09 Confidence: high	—
Bugfix	Medium	Fixes MAL- advisories from private registries to surface as "Unverifiable (private source)" instead of false‑positive "Malicious" findings Fixes MAL- advisories from private registries to surface as "Unverifiable (private source)" instead of false‑positive "Malicious" findings Source: llm_adapter@2026-06-09 Confidence: high	—

Full changelog

--create-pr flag: after --fix, commits lockfile changes and opens a GitHub PR via gh with a descriptive title listing upgraded packages and vulnerability count
--base <branch> flag to set the base branch for --create-pr (default: main)
Bun parser updated to reconstruct transitive paths from package relationships; within-range remediation now works for Bun lockfiles
pnpm-within-range, deep-chain-no-fix, pnpm-aliased-chain regression fixtures
CamoFox Browser case study
mal-private-registry example fixture demonstrating unverifiable MAL- output for private registry packages

Yarn Classic parser now reconstructs full transitive dependency paths using BFS graph walk; within-range resolver correctly suggests yarn upgrade <pkg> for deep chains
MAL- advisories for packages resolved from a private registry now surface as "Unverifiable (private source)" instead of a false-positive "Malicious" finding

@coder-Yash886 - Yarn parser path reconstruction fix, bun-within-range fixture
@Ayush7614 - pnpm-within-range, deep-chain-no-fix, pnpm-aliased-chain fixtures, CamoFox Browser case study
@nkgotcode - fixture remediation scan tests

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track OWASP/cve-lite-cli

Get notified when new releases ship.

About OWASP/cve-lite-cli