OWASP/cve-lite-cli v1.37.0

v1.37.0 - Choose where output files land, and stop calling fixable findings unfixable

on GitHub

Upgrade note. 1.36.1 could report a finding that has a confirmed fix as having no safe upgrade at all, and describe the package as possibly unmaintained, in the same scan that named the fix. If you act on the fix plan, take this release.

Added

• --output <dir> sets the directory for the --json, --sarif and --sbom files. They previously always landed in the working directory under a timestamped name, so a CI job had to glob and rename before it could hand a path to the next step. Relative paths resolve against the working directory and the directory is created when missing; the default is unchanged. --output without one of those three flags is an error rather than a silent no-op, and a flag-like value is rejected. The GitHub Action gains a matching output input.

Fixed

• A finding carrying a confirmed fix version could be routed to the skipped list as having no safe upgrade, with the package described as possibly unmaintained, in the same scan that named the fix. The confirmation pass advanced one candidate counter and not the other, so for a single-version window the two compared equal and the plan read that as "every version is vulnerable". The counters now describe the same set, and the decision no longer rests on comparing them.

• Our own semver range handling rejected most legal range syntax. Compound ranges (>=1.18.0 <2), unions, wildcards and hyphen ranges all read as invalid, which made override hygiene report a correct bounded override as though it were pinned to latest, and caused two other override rules to skip such overrides without evaluating them. Separately, a pre-release version had its tag stripped before comparison, so a vulnerable 1.2.3-beta.1 was not matched by an advisory covering <1.2.3.

• Advisory fix versions written with fewer than three components were discarded, and a finding whose every candidate was discarded reported "no fix available". fixed: "1.22" now resolves to 1.22.0. Values that are not versions are still rejected, so a commit hash cannot become a recommended upgrade target.

• The offline advisory database stored GIT ranges, whose boundaries are commit hashes, as if they were versions, so a range could fail to exclude and a patched version could be reported as vulnerable.

• --no-cache did not bypass every cache. The npm advisory block and the advisory detail block read their caches regardless of the flag.

• Override hygiene said "copyies" for the plural and listed versions in lexicographic order.

Changed

• The two PR dependency-delta workflows are removed. They had been disabled since the GitHub App took over posting those comments.

Validation

• npm test
• npm run build

Contributors

• @bennycode - --output <dir>, first contribution
• @prx-my - override hygiene plural and version ordering, OA010 docs
• @alex-powell - parent-update fix target shape
• @MRX-72 - EPSS enrichment batching