Skip to content

OWASP/cve-lite-cli

v1.27.0 Breaking

This release includes breaking changes for platform teams planning a safe upgrade.

Published 12d Vulnerability Scanning
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →

✓ No known CVEs patched in this version

Topics

security cve javascript nodejs owasp security-tools

Summary

AI summary

Added light/dark theme toggle in HTML report and OA009 stale floor detector with safety guard.

Changes in this release

Feature Low

Adds light/dark mode toggle in HTML report, persisted to localStorage

Adds light/dark mode toggle in HTML report, persisted to localStorage

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds SARIF 2.1.0 output with ruleIndex, kind: "open", and partialFingerprints for GitHub Code Scanning

Adds SARIF 2.1.0 output with ruleIndex, kind: "open", and partialFingerprints for GitHub Code Scanning

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds OA009 stale floor detector to flag redundant >=/^ overrides

Adds OA009 stale floor detector to flag redundant >=/^ overrides

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds empty container pruning after --fix removes last override entry

Adds empty container pruning after --fix removes last override entry

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds path‑first argument ordering for cve-lite command (both permutations accepted)

Adds path‑first argument ordering for cve-lite command (both permutations accepted)

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds PD001 and PD002 phantom‑dependency rules (high and medium severity)

Adds PD001 and PD002 phantom‑dependency rules (high and medium severity)

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Adds OA009 safety guard to suppress stale‑floor removal when anchor is a phantom import

Adds OA009 safety guard to suppress stale‑floor removal when anchor is a phantom import

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Makes overrides --json write to a timestamped file matching main scan output path

Makes overrides --json write to a timestamped file matching main scan output path

Source: llm_adapter@2026-07-14

Confidence: high

 —
Feature Low

Updates GitHub Action runners to Node 24

Updates GitHub Action runners to Node 24

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix Medium

Includes scanned path in hint commands when the path is not "."

Includes scanned path in hint commands when the path is not "."

Source: llm_adapter@2026-07-14

Confidence: high

 —
Bugfix Medium

Fixes overrides --fix output table to no longer show findings that were just fixed

Fixes overrides --fix output table to no longer show findings that were just fixed

Source: llm_adapter@2026-07-14

Confidence: low

 —
Bugfix Medium

Fixes audit‑log file descriptor leak by returning ExitCode instead of calling process.exit() in handleMultiFolderScan

Fixes audit‑log file descriptor leak by returning ExitCode instead of calling process.exit() in handleMultiFolderScan

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Bugfix Low

Prevents fixed findings from appearing in the overrides --fix output table

Prevents fixed findings from appearing in the overrides --fix output table

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Refactor Low

Adds `close(): void` method to DebugSession type for explicit session lifecycle signalling

Adds `close(): void` method to DebugSession type for explicit session lifecycle signalling

Source: granite4.1:30b@2026-07-15-audit

Confidence: low

 —
Full changelog

Added

  • Light/dark mode toggle in HTML report: one-click switch between themes, persisted to localStorage
  • SARIF 2.1.0 output now includes ruleIndex, kind: "open", and partialFingerprints for full GitHub Code Scanning compatibility; shared sarifFingerprintHash utility extracted to src/utils/sarif.ts
  • OA009 stale floor detector: fires when a >= or ^ override floor is already met by every parent declaration, making the override redundant
  • Empty container pruning: after --fix removes the last override entry, the now-empty overrides/pnpm.overrides object is also removed
  • Path-first argument ordering: cve-lite <path> overrides [flags] now works alongside cve-lite overrides <path> [flags]
  • reachesFailOn shared helper extracted to src/utils/severity.ts; fixes missing unknown severity rank and closes --fail-on asymmetry between scan and overrides paths
  • PD001 (Override-only phantom, high): fires when source code imports a package only present via an override pin - declare it as a dependency
  • PD002 (Transitive-only phantom, medium): fires when source code imports a package only present as a transitive dependency - declare it explicitly
  • OA009 safety guard: suppresses stale-floor removal suggestion when the override anchors a phantom import
  • overrides --json now writes to a timestamped file consistent with the main scan path
  • examples/all-scenarios/ fixture triggering all nine auto-detectable override hygiene rules in one scan
  • Fix-all tip: when 2+ rules are auto-fixable, hint block leads with cve-lite overrides --fix to apply all at once

Fixed

  • overrides --fix output table no longer shows findings that were just fixed
  • Hint commands after the findings table now include the scanned path when it is not .
  • Double blank line before Override Hygiene section in standalone overrides command removed
  • handleMultiFolderScan now returns ExitCode instead of calling process.exit(), fixing audit-log fd leak

Changed

  • DebugSession type gains a close(): void method for explicit session lifecycle signalling; both enabled and disabled paths implement it as a no-op
  • GitHub Action: fix mode suppresses exit 1, propagates exit 2/3, warns on fail-on + fix combination
  • GitHub Action runners updated to Node 24

Validation

  • npm test
  • npm run build

Contributors

  • coder-Yash886 - GitHub Action fix mode support (#828)
View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track OWASP/cve-lite-cli

Get notified when new releases ship.

Sign up free

About OWASP/cve-lite-cli

All releases →

Related context

Beta — feedback welcome: [email protected]