OWASP/cve-lite-cli v1.24.0

v1.24.0 - Dual SARIF and HTML output, dev dependency fix flags, and Action binary fix

on GitHub

Added

• --sarif can now be combined with --report to write both a SARIF file and an HTML report in one scan - useful for CI pipelines that upload to GitHub Code Scanning and also attach an HTML artifact for human review

Fixed

• Fix commands now include -D flag for dev dependencies (npm install -D, pnpm add -D, yarn add -D, bun add --dev); mixed dev/prod batches split into separate commands
• GitHub Action now installs cve-lite-cli via npm install --prefix and appends the bin dir to $GITHUB_PATH, fixing cve-lite: not found errors on npm 10.x runners where npx cannot resolve a binary name different from the package name

Changed

• Upgrade jest to 30.4.1; add .cve-lite/baseline.json to suppress unfixable js-yaml@3.14.2 transitive dev dep (GHSA-h67p-54hq-rp68)

Docs

• Socket CLI comparison expanded with structured sections and concrete examples

Validation

• npm test
• npm run build

Contributors

• @raj-krr