OWASP/cve-lite-cli v1.35.0

v1.35.0 - SBOM dependency graphs complete for SPDX

on GitHub

Added

• OA010, a new override-hygiene rule: an override floor that itself admits a known-vulnerable version is now flagged, so a floor that looks protective but is not gets surfaced rather than trusted.
• Every known dependency path for a finding is shown in the HTML report, rather than only the primary one, so a package pulled in through several routes shows each route instead of implying a single parent. Capped at five paths per panel.

Fixed

• SBOM dependency graphs are now resolved from the lockfile graph for Yarn, Bun and pnpm, instead of being rebuilt from display paths capped at five paths of ten segments. Large trees were losing most of their edges, which weakens the document against the NTIA minimum elements. Yarn was by far the worst: one 5452-package project had 4239 packages with no parent edge at all, and now has 13569 edges with a single parentless package, the root project. This covers SPDX output only. CycloneDX emits no dependencies array for any package manager and is unchanged.
• Bun dependency paths were largely fabricated rather than truncated. On a real 20-workspace monorepo, 1406 of 1518 packages fell through to a fallback asserting they were direct dependencies of the root. Packages never reached drops from 1406 to 15. Behaviour change: Bun dev/prod classification becomes correct where it was approximate, so --prod-only results can shift for Bun projects.
• A copy-run fix command could name a version the scan had already determined was still vulnerable, because a package entering the fix plan twice could keep a stale command from the losing entry.
• Bun fix commands emitted an empty --filter argument for the root workspace, producing a command that fails if pasted.
• The terminal tables are now drawn from one shared column registry rather than three independent renderers, fixing four defects: the same section title rendering differently shaped tables in different projects, a section rendering no table at all, tables with identical columns rendering at different widths, and the fix-command tables disagreeing with the findings table about the same package.
• An unreadable lockfile or package.json no longer reports a bare JSON parser error.

Changed

• src/index.ts is down from 973 lines to 191, with the scan flow moved into src/scan/single-scan.ts and four small src/cli/ modules. Behaviour verified identical across 95 paired CLI invocations.
• Lockfile handling is driven from a handler table rather than duplicated if-chains, so the compiler now requires a handler for every supported lockfile name.

Validation

• npm test
• npm run build

Contributors

• @rksharma-owg for showing every known dependency path in the HTML report (#1128)
• @coder-Yash886 for the src/index.ts lean-down (#1129)
• @Ayush7614, who diagnosed the root cause and proposed most of the design for #232 back in June, which #1128 implements
• @osfv for diagnosing the cross-wiring behind #1007, which #1142 fixes
• @alamb-hex for reporting both defects in #966