From cc6dd3c8b69b6059eb9c0ca7038e916395f2a538 Mon Sep 17 00:00:00 2001 From: Sonu Kapoor Date: Sun, 26 Jul 2026 12:33:43 -0400 Subject: [PATCH] release: v1.28.0 --- CHANGELOG.md | 27 +++++++++++++++++++++++++++ package-lock.json | 4 ++-- package.json | 2 +- website/docusaurus.config.ts | 2 +- 4 files changed, 31 insertions(+), 4 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index eece17c1..9e214736 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,33 @@ All notable changes to CVE Lite CLI will be documented in this file. +## [1.28.0] - 2026-07-26 + +### Added +- Cooldown-aware fix resolver: warns when a recommended fix version is newer than the project's configured release cooldown (npm `min-release-age`, pnpm `minimumReleaseAge`, yarn `npmMinimalAgeGate`); advisory only (no flag, no exit-code change, on by default), renders in terminal, `--verbose`, JSON, and HTML report; npm/pnpm/yarn, Bun not yet covered (#872) +- `--check-maintenance` (DM001) maintenance risk detector: flags direct dependencies that block a transitive CVE fix via a major-version constraint drag, or that are deprecated on npm; renders in terminal, JSON, multi-folder, and HTML report, and counts toward `--fail-on` (#854) +- `advisories init` command to create an empty offline advisory database for air-gapped users to populate themselves (#847) +- Show skipped manifest dependencies in the HTML report and report.json (#841) + +### Fixed +- Verify parent-upgrade recommendations actually resolve the vulnerable package before recommending them: the resolver walks the dependency path and only recommends a parent upgrade when the terminal package resolves to a fixed version or is dropped from the path; it returns no recommendation when no version fixes it (no more false `jest@30.4.2` for a `brace-expansion` finding), and marks unverifiable suggestions, excluding them from the "should fix all findings" claim (#899) +- Expire OSV detail cache records via `CACHE_TTL_MS` so refined advisories are refetched instead of served stale; a stale detail no longer forces an unnecessary major bump over an available within-range fix. Cache format bumped to v4 with transparent v1-v3 migration (#865) +- Preserve vulnerability evidence when advisory detail lookups fail: transient `getVuln` failures (timeout/DNS) now retry instead of being cached as a confirmed miss; only real 404/410 responses are negatively cached. Surfaces `unresolvedAdvisoryIds` in JSON/HTML output and warns (#869) +- Count multi-folder `--check-overrides` findings toward `--fail-on`; previously only single-folder mode gated on them, so a multi-folder CI scan silently passed on high override findings (#874) +- GitHub Action: omit `--no-cache` when offline mode is active (`offline` / `offline-db` / `sync-advisories`), so the Action no longer fails the CLI's flag validation on the first run (#875) +- Apply `--ca-cert` to the main scan path via a cert-aware fetch using `node:https`; `NODE_EXTRA_CA_CERTS` alone is unreliable in Node.js 18+ with undici (#840) +- Remove a dead null guard and de-collide the skipped-deps icon in the HTML report (#849) + +### Changed +- Unify the Override Hygiene and Maintenance Risk HTML report tables with the main Findings table styling (#854) +- Extract the cache TTL magic number to a named `CACHE_TTL_MS` constant (#846) + +### Docs +- Add a Release Cooldown Awareness docs page, README section, and homepage pill and FeatureCard (#872) +- Add a maintenance-risk (DM001) documentation section (#894) +- Document the `advisories init` command in the CLI reference and offline advisory DB guide (#853) +- Add a Renovate comparison page (#838) + ## [1.27.0] - 2026-07-14 ### Added diff --git a/package-lock.json b/package-lock.json index b0ba97d3..b4863a7d 100644 --- a/package-lock.json +++ b/package-lock.json @@ -1,12 +1,12 @@ { "name": "cve-lite-cli", - "version": "1.27.0", + "version": "1.28.0", "lockfileVersion": 3, "requires": true, "packages": { "": { "name": "cve-lite-cli", - "version": "1.27.0", + "version": "1.28.0", "license": "MIT", "dependencies": { "better-sqlite3": "^12.8.0", diff --git a/package.json b/package.json index 597fe686..dfcd9be9 100644 --- a/package.json +++ b/package.json @@ -1,6 +1,6 @@ { "name": "cve-lite-cli", - "version": "1.27.0", + "version": "1.28.0", "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV", "type": "module", "bin": { diff --git a/website/docusaurus.config.ts b/website/docusaurus.config.ts index aba06fa7..2b5c13da 100644 --- a/website/docusaurus.config.ts +++ b/website/docusaurus.config.ts @@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer'; import type {Config} from '@docusaurus/types'; import type * as Preset from '@docusaurus/preset-classic'; -const latestVersion = 'v1.27.0'; +const latestVersion = 'v1.28.0'; const config: Config = { title: 'CVE Lite CLI',