OWASP/cve-lite-cli

v1.23.1 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 1mo Vulnerability Scanning

✓ No known CVEs patched

✓ No known CVEs patched in this version

Topics

security cve javascript nodejs owasp security-tools

Summary

AI summary

Minor fixes and improvements.

Type	Severity	Summary	CVE
Performance
Performance	Medium	npm lockfile graph construction complexity reduced from O(EV) to O(E) npm lockfile graph construction complexity reduced from O(EV) to O(E) Source: llm_adapter@2026-06-15 Confidence: high	—
Performance	Medium	Lockfile graph nodes and arrays are pre-frozen at construction time; redundant uniquePathArrays removed Lockfile graph nodes and arrays are pre-frozen at construction time; redundant uniquePathArrays removed Source: llm_adapter@2026-06-15 Confidence: high	—
Performance	Medium	Remediation package lookup replaced with Map for O(1) access Remediation package lookup replaced with Map for O(1) access Source: llm_adapter@2026-06-15 Confidence: high	—

Full changelog

npm lockfile graph construction reduced from O(E*V) to O(E) using Set accumulators for edge lists
npm lockfile graph nodes and arrays pre-frozen at construction time; redundant uniquePathArrays removed
Remediation package lookup replaced with Map for O(1) access

Four new case studies: Strapi (Yarn Berry, 2,887 packages), Twenty (Yarn Berry, 5,451 packages), Presenton (dual npm lockfiles), Payload CMS (pnpm, 2,602 packages)
OWASP Lab Project status reflected across all project docs: README, CONTRIBUTING, comparison page, case studies index, and press page

SARIF, CycloneDX, and HTML reporter file-write cleanup refactored for clarity; test spy coverage refined
Case study contribution scope clarified in CONTRIBUTING: contributors submit case-study files only, shared index files maintained by maintainer

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track OWASP/cve-lite-cli

Get notified when new releases ship.

About OWASP/cve-lite-cli