OWASP/cve-lite-cli v1.36.0

v1.36.0 - False results fixed, and the delta renderer ships

on GitHub

Upgrade note. Two of the fixes below are false results that shipped in 1.35.0: a clean "no vulnerabilities found" on a repository that has them, and a second scan of the same project reporting roughly half the CVEs of the first while changing the recommended fix command to a larger, breaking upgrade. Both are worth upgrading for.

Added

• The PR delta renderer is now part of the published package, so tools other than this repository's own workflows can turn two scan reports into a pull request comment.

Fixed

• A repository with more than one lockfile at its root could report a false all-clear. Selection took whichever filename came first in the priority list and never looked at the others, so a stale package-lock.json left behind by an npm to pnpm migration outranked the pnpm-lock.yaml that described the project. Measured on a 106,000-star repository: an 847 byte package-lock.json describing one package beat a 175KB pnpm-lock.yaml describing 504, and the scan printed Scan complete. No known vulnerabilities found. on a tree with four vulnerable packages and twenty CVEs. Selection now prefers the lockfile named by packageManager in the root package.json when that file is present, and the scan names the lockfile it used, says why, and lists the others.

• Scanning the same project twice returned fewer vulnerabilities the second time, and recommended a different version to install. With no change to any input: shipping-api went from 94 CVEs to 47, juice-shop from 251 to 125. The npm registry advisory source builds complete advisory records but the cache stored only their ids, so the first scan resolved everything and every scan after restored bare ids, looked for them in OSV, which does not hold that namespace, and dropped them silently. The worse half was the remediation output: with half the advisories gone the validator re-derived its targets and escalated, so axios 0.21.2 became 0.33.0 and newly flagged breaking. Fixed by caching the advisories themselves.

• Compact and verbose reported different headline counts for the same scan, one saying 7 urgent issues found and the other 11 vulnerabilities found, with nothing to indicate they were different units. Verbose's noun was also wrong: findings are vulnerable packages, and that scan carried 94 advisories across its 11 packages. Both modes now close with the same sentence.

• An unreadable or unparseable lockfile reported a corporate SSL proxy hint and never named the file at fault. Local read failures are now excluded from that hint, and the error names the file. Genuine network errors still get the hint.

• Parent-update targets no longer merge into install targets, so a fix command stops naming a version that belongs to a different package.

Validation

• npm test
• npm run build

Contributors

• @osfv
• @MRX-72