release: v1.28.0

CHANGELOG.md

@@ -2,6 +2,33 @@
 
 All notable changes to CVE Lite CLI will be documented in this file.
 
+## [1.28.0] - 2026-07-26
+
+### Added
+- Cooldown-aware fix resolver: warns when a recommended fix version is newer than the project's configured release cooldown (npm `min-release-age`, pnpm `minimumReleaseAge`, yarn `npmMinimalAgeGate`); advisory only (no flag, no exit-code change, on by default), renders in terminal, `--verbose`, JSON, and HTML report; npm/pnpm/yarn, Bun not yet covered (#872)
+- `--check-maintenance` (DM001) maintenance risk detector: flags direct dependencies that block a transitive CVE fix via a major-version constraint drag, or that are deprecated on npm; renders in terminal, JSON, multi-folder, and HTML report, and counts toward `--fail-on` (#854)
+- `advisories init` command to create an empty offline advisory database for air-gapped users to populate themselves (#847)
+- Show skipped manifest dependencies in the HTML report and report.json (#841)
+
+### Fixed
+- Verify parent-upgrade recommendations actually resolve the vulnerable package before recommending them: the resolver walks the dependency path and only recommends a parent upgrade when the terminal package resolves to a fixed version or is dropped from the path; it returns no recommendation when no version fixes it (no more false `jest@30.4.2` for a `brace-expansion` finding), and marks unverifiable suggestions, excluding them from the "should fix all findings" claim (#899)
+- Expire OSV detail cache records via `CACHE_TTL_MS` so refined advisories are refetched instead of served stale; a stale detail no longer forces an unnecessary major bump over an available within-range fix. Cache format bumped to v4 with transparent v1-v3 migration (#865)
+- Preserve vulnerability evidence when advisory detail lookups fail: transient `getVuln` failures (timeout/DNS) now retry instead of being cached as a confirmed miss; only real 404/410 responses are negatively cached. Surfaces `unresolvedAdvisoryIds` in JSON/HTML output and warns (#869)
+- Count multi-folder `--check-overrides` findings toward `--fail-on`; previously only single-folder mode gated on them, so a multi-folder CI scan silently passed on high override findings (#874)
+- GitHub Action: omit `--no-cache` when offline mode is active (`offline` / `offline-db` / `sync-advisories`), so the Action no longer fails the CLI's flag validation on the first run (#875)
+- Apply `--ca-cert` to the main scan path via a cert-aware fetch using `node:https`; `NODE_EXTRA_CA_CERTS` alone is unreliable in Node.js 18+ with undici (#840)
+- Remove a dead null guard and de-collide the skipped-deps icon in the HTML report (#849)
+
+### Changed
+- Unify the Override Hygiene and Maintenance Risk HTML report tables with the main Findings table styling (#854)
+- Extract the cache TTL magic number to a named `CACHE_TTL_MS` constant (#846)
+
+### Docs
+- Add a Release Cooldown Awareness docs page, README section, and homepage pill and FeatureCard (#872)
+- Add a maintenance-risk (DM001) documentation section (#894)
+- Document the `advisories init` command in the CLI reference and offline advisory DB guide (#853)
+- Add a Renovate comparison page (#838)
+
 ## [1.27.0] - 2026-07-14
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.27.0",
+  "version": "1.28.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {

website/docusaurus.config.ts

@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.27.0';
+const latestVersion = 'v1.28.0';
 
 const config: Config = {
   title: 'CVE Lite CLI',