github OWASP/cve-lite-cli v1.41.0
v1.41.0 - Custom OSV endpoint fix, npm alias scanning and SBOM dependency scope
on GitHub

latest release: v1
4 hours ago

Upgrade note. This release contains a security fix for custom --osv-url endpoints (GHSA-mrvp-qgq4-c66g); upgrade if you point the scanner at your own OSV mirror. The minimum supported Node.js version is now 22, and CI tests Node 22 alongside Node 24. SARIF locations from a subdirectory scan now carry the folder path, so if you add that prefix yourself, drop that step or the path doubles. Projects that ship an npm-shrinkwrap.json now get fix commands and complete SBOM dependency links where they previously got neither.

Security

  • A custom --osv-url is now checked at connection time, not only at startup. The address was validated once, and the request then looked the name up again, so a hostname whose DNS answer changed in between could pass the check with a public address and then connect to a private one. Every connection to a custom OSV host now resolves the name itself, refuses it if any returned address is private or reserved unless --allow-private-osv-url is set, and connects only to the addresses it just checked. Official OSV hosts are unchanged.

Added

  • --output - writes the JSON, SARIF or SBOM report to standard output for piping into other tools, with banners and messages kept off the stream. Asking for more than one format with --output - is rejected.
  • --output accepts a file path as well as a directory, so CI can write to a stable filename. A path that already exists as a file, or ends in a recognised report extension, is written to directly; anything else keeps the directory behaviour.
  • --debug produces one diagnostic bundle meant for attaching to an issue: an environment record, a machine-readable event stream and a summary of the project's shape, with home paths, tokens and private registry hosts left out. Package and workspace names are kept, so check them before attaching from a private project. A directory that cannot be written no longer turns a working scan into a crash, and the failure now names the file and the cause.
  • The scan JSON carries the verified parent-upgrade chain for a transitive finding: which direct dependency to move, from which version to which, and the safe version that results.
  • SBOMs keep the difference between development and production dependencies. SPDX marks dev-only edges as DEV_DEPENDENCY_OF, and CycloneDX components carry scope (optional for dev, required for production).
  • First steps of experimental Python support: PyPI versions are read and ordered by PEP 440, and package URLs can be built per ecosystem. No Python lockfile is scanned yet, and Python packages do not appear in SBOMs.

Changed

  • The supported Node.js floor moves from 20 to 22, and CI now runs the full suite on Node 22.
  • An SPDX SBOM whose dependency links had to be rebuilt from recorded paths now says so, in a terminal warning and a document-level note, since those links may be incomplete.
  • The multi-folder section headers take their wording from the same place as the gate classes, so the two can no longer drift apart.

Fixed

  • A package installed under an npm alias is scanned as the package it really is. An alias such as http-client for axios@0.21.1 used to match no advisories and pass --fail-on high on a vulnerable tree. Fix commands keep the alias spec.
  • --only-used and the phantom-dependency checks read .mts and .cts files, so a vulnerable package imported only from them is no longer dropped.
  • A partial scan no longer writes a SARIF log that reads as clean. A finding whose advisory details could not be fetched is reported as a warning-level result telling you to re-run, and the run is marked unsuccessful, so Code Scanning does not close open alerts.
  • npm-shrinkwrap.json is treated as the npm lockfile it is everywhere: fix commands, transitive remediation and SBOM dependency links. When a project holds both npm lockfiles, at the root or in a nested folder, the shrinkwrap is read, as npm does.
  • The override-hygiene rules read the same root lockfile the scan reads, so findings and override targets no longer describe two different trees.
  • A within-range update is offered only when every parent holding the installed copy accepts the target version, and a parent upgrade is no longer offered when another dependency would keep the vulnerable copy installed. In both cases the command used to run and change nothing.
  • The transitive remediation modules evaluate version ranges with one shared implementation, so a range such as 1.2.x no longer makes every comparison silently false.
  • --fix no longer runs a second command hidden in a workspace path, since commands are now built as argument lists.
  • cve-lite advisories sync keeps the existing advisory database until its replacement is fully downloaded and checked, so a failed refresh no longer leaves offline scans with nothing to read.
  • SARIF from a subdirectory scan points at that subdirectory's lockfile instead of a same-named file at the repository root.
  • An unrecognised --fail-on value is rejected instead of quietly falling back to critical. moderate, npm audit's name for medium, used to give a passing build.
  • A flag that takes a value no longer swallows the next flag when its value is left out. --offline-db, --cache-dir, --osv-url, --audit-log, --rule, --min-severity, --search-depth, --batch-size, --ca-cert and config set ca-cert all stop with <flag> requires a <noun> argument.
  • --sbom= with an empty value stops with the list of supported SBOM formats instead of being accepted as an unknown format.
  • An invalid --batch-size is rejected instead of running out of memory.
  • A 0.0.x patch upgrade is marked as breaking, since a caret range there pins the patch: ^0.0.3 accepts only 0.0.3.
  • Shared JSON artefacts no longer record the absolute path of the machine that produced them.
  • A flag-conflict error no longer prints an unrelated corporate SSL proxy hint.
  • Queued OSV advisory batches no longer start after one of them has failed.
  • The Release workflow no longer interpolates the release tag into a shell command.
  • Editor swap, undo and autosave files are ignored by git.

Tests

  • The SPDX tests validate generated documents against the official SPDX 2.3 JSON schema.
  • CI type-checks test files: a pull request's new and changed tests must be clean, and no other file may gain a type error.
  • New direct coverage for the finding helpers, the phantom-dependency helpers, the typo-correction helpers, the registry remediation route and the usage-scan file cap.

Docs

  • New "Who uses CVE Lite CLI?" page listing public repositories that run, recommend or package the tool, each linked to its evidence, plus teaching use at the Polytechnic of Leiria.
  • The homepage privacy line now says what is sent online and that source code and lockfiles stay on your machine.
  • The CLI reference lists the shipped override-hygiene rules, OA001-OA011 and PD001-PD002, and SARIF is documented as shipped.
  • The SBOM docs explain why pnpm, Yarn and Bun components carry NOASSERTION, and the troubleshooting and getting started pages name Bun and npm-shrinkwrap.json.
  • Links point at OWASP/cve-lite-cli, the case study logos are served from the site, and the navigation links CVE Lite Classroom.

Validation

  • npm test
  • npm run build

Contributors

Check out latest releases or
releases around OWASP/cve-lite-cli v1.41.0

Don't miss a new cve-lite-cli release

NewReleases is sending notifications on new releases.

Get notifications