OWASP/cve-lite-cli

v1.23.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo Vulnerability Scanning

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

security cve javascript nodejs owasp security-tools

Summary

AI summary

CVE detail fetches now run concurrently for 2.2x faster performance, SHA-pinned git source warnings added, and validation scripts updated.

Changes in this release

Type	Severity	Summary	CVE
Feature	Low	Added graded output for MAL‑advisories: terminal shows ⚠ Git source (SHA‑pinned) or ⚠ Git source (floating ref) with resolved URL; HTML report shows orange badge variant Added graded output for MAL‑advisories: terminal shows ⚠ Git source (SHA‑pinned) or ⚠ Git source (floating ref) with resolved URL; HTML report shows orange badge variant Source: llm_adapter@2026-06-13 Confidence: low	—
Feature	Low	Added graded output for MAL-advisories from git sources in terminal and HTML report. Added graded output for MAL-advisories from git sources in terminal and HTML report. Source: granite4.1:30b@2026-06-13-audit Confidence: low	—
Performance	Medium	CVE detail fetches now run concurrently — 2.2x faster on cold cache for large lockfiles (28.4s → 12.7s) CVE detail fetches now run concurrently — 2.2x faster on cold cache for large lockfiles (28.4s → 12.7s) Source: llm_adapter@2026-06-13 Confidence: high	—
Performance	Medium	Packument cache pre-warmed before transitive remediation loop to eliminate serial npm registry round-trips Packument cache pre-warmed before transitive remediation loop to eliminate serial npm registry round-trips Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Medium	Error handling and cleanup for SARIF, CycloneDX, and HTML report file writes; preserves pre‑existing directories on write failure Error handling and cleanup for SARIF, CycloneDX, and HTML report file writes; preserves pre‑existing directories on write failure Source: llm_adapter@2026-06-13 Confidence: high	—
Bugfix	Medium	Removed duplicate `db.close()` call in osv-sync catch block to avoid masking original error Removed duplicate `db.close()` call in osv-sync catch block to avoid masking original error Source: llm_adapter@2026-06-13 Confidence: high	—

Full changelog

Added

Graded output for MAL- advisories from git sources: terminal shows ⚠ Git source (SHA-pinned) or ⚠ Git source (floating ref) with resolved URL; HTML report shows orange badge variant

Fixed

Error handling and cleanup for SARIF, CycloneDX, and HTML report file writes; pre-existing directories preserved on write failure
Duplicate db.close() call removed from osv-sync catch block that could mask original error

Performance

CVE detail fetches now run concurrently — 2.2x faster on cold cache for large lockfiles (28.4s → 12.7s on a 170-CVE scan)
Packument cache pre-warmed before transitive remediation loop to eliminate serial npm registry round-trips

Validation

npm test
npm run build

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OWASP/cve-lite-cli

Get notified when new releases ship.

About OWASP/cve-lite-cli

All releases →