OWASP/cve-lite-cli

v1.24.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 1mo Vulnerability Scanning

✓ No known CVEs patched

This release patches 1 known CVE

Topics

security cve javascript nodejs owasp security-tools

Summary

AI summary

Added SARIF output support for CI pipelines.

Full changelog

--sarif can now be combined with --report to write both a SARIF file and an HTML report in one scan - useful for CI pipelines that upload to GitHub Code Scanning and also attach an HTML artifact for human review

Fix commands now include -D flag for dev dependencies (npm install -D, pnpm add -D, yarn add -D, bun add --dev); mixed dev/prod batches split into separate commands
GitHub Action now installs cve-lite-cli via npm install --prefix and appends the bin dir to $GITHUB_PATH, fixing cve-lite: not found errors on npm 10.x runners where npx cannot resolve a binary name different from the package name

Upgrade jest to 30.4.1; add .cve-lite/baseline.json to suppress unfixable [email protected] transitive dev dep (GHSA-h67p-54hq-rp68)

dep: GHSA-h67p-54hq-rp68 – suppress unfixable [email protected] transitive dev dependency via .cve-lite/baseline.json

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track OWASP/cve-lite-cli

Get notified when new releases ship.

About OWASP/cve-lite-cli