Issues

• fix(debug): a failed debug write names neither the file nor the cause

  bug
  OWASP/cve-lite-cli#1395 · Filter by author sonukapoor opened on Oct 23, 2026

• fix(cli): four more value flags swallow the next flag when given without a value, silently dropping both

  bughelp wanted
  OWASP/cve-lite-cli#1391 · Filter by author sonukapoor opened on Oct 22, 2026

• ci: the release tag is interpolated into a shell command, so a crafted tag runs in the publishing job and can pass the version guard

  bugciin-house
  OWASP/cve-lite-cli#1388 · Filter by author sonukapoor opened on Oct 22, 2026

• fix(fix): workspace path with && is treated as a command separator under --fix

  OWASP/cve-lite-cli#1385 · Filter by author alex-powell opened on Oct 22, 2026

• fix(cli): --batch-size 0 or a negative value crashes the scan with a heap out of memory error

  OWASP/cve-lite-cli#1383 · Filter by author alex-powell opened on Oct 22, 2026

• fix(cli): a value flag given without its value swallows the next flag, so --json or --offline is silently dropped

  OWASP/cve-lite-cli#1381 · Filter by author alex-powell opened on Oct 22, 2026

• fix(sarif): a subdirectory scan reports its findings against the root lockfile, so Code Scanning alerts land on the wrong file

  bugin-house
  OWASP/cve-lite-cli#1380 · Filter by author sonukapoor opened on Oct 22, 2026

• ci: publish to npm from the release workflow using trusted publishing

  cienhancementin-house
  OWASP/cve-lite-cli#1378 · Filter by author sonukapoor opened on Oct 21, 2026

• [Docs] Getting Started omits Bun from supported lockfile list

  OWASP/cve-lite-cli#1377 · Filter by author prx-my opened on Oct 21, 2026

• [Docs] Analog and Ghost case study logos are broken (404)

  OWASP/cve-lite-cli#1376 · Filter by author prx-my opened on Oct 21, 2026

• [Docs] Links still point to pre-transfer sonukapoor/cve-lite-cli repository

  OWASP/cve-lite-cli#1375 · Filter by author prx-my opened on Oct 21, 2026

• [Docs] SARIF output is documented as unreleased

  OWASP/cve-lite-cli#1374 · Filter by author prx-my opened on Oct 21, 2026

• [Docs] Override hygiene rule ranges and count are outdated

  OWASP/cve-lite-cli#1373 · Filter by author prx-my opened on Oct 21, 2026

• test: nothing type-checks the test tree, so a green suite proves less than it looks

  enhancementhelp wanted
  OWASP/cve-lite-cli#1364 · Filter by author sonukapoor opened on Oct 21, 2026
  2

• fix(ratchet): a multi-folder ratchet run still writes no --json or --sarif report

  bugin-house
  OWASP/cve-lite-cli#1363 · Filter by author sonukapoor opened on Oct 21, 2026

• fix(sarif): a partial scan writes a SARIF report that cannot be told from a clean one

  bugin-house
  OWASP/cve-lite-cli#1362 · Filter by author sonukapoor opened on Oct 21, 2026

• ci: we declare Node >=20 and only ever test Node 24, so the floor we claim is untested

  bughelp wanted
  OWASP/cve-lite-cli#1356 · Filter by author sonukapoor opened on Oct 19, 2026
  2

• fix(overrides): the override-hygiene network checks query public npm regardless of the project's registry

  bugin-house
  OWASP/cve-lite-cli#1348 · Filter by author sonukapoor opened on Oct 16, 2026

• fix(remediation): do not substitute a fix version we cannot justify against a non-npm registry

  bugin-house
  OWASP/cve-lite-cli#1347 · Filter by author sonukapoor opened on Oct 16, 2026

• fix(remediation): a lockfile-only monorepo scan loses remediation for every finding under a workspace member

  bugin-house
  OWASP/cve-lite-cli#1345 · Filter by author sonukapoor opened on Oct 16, 2026

• fix(scan): a scan that finds nothing to parse exits 0, even under --fail-on

  bughelp wanted
  OWASP/cve-lite-cli#1344 · Filter by author sonukapoor opened on Oct 16, 2026
  1

• [Bug] Breaking? not flagged for 0.0.x patch upgrades (^0.0.4 does not admit 0.0.5)

  bug
  OWASP/cve-lite-cli#1339 · Filter by author alex-powell opened on Oct 15, 2026

• refactor(fail-on): multi-folder section headers still hardcode the gate-class labels

  enhancementgood first issuehelp wanted
  OWASP/cve-lite-cli#1335 · Filter by author sonukapoor opened on Oct 14, 2026
  1

• fix(json): scan payload records an absolute projectPath, leaking the machine's home directory

  bughelp wanted
  OWASP/cve-lite-cli#1333 · Filter by author sonukapoor opened on Oct 14, 2026

• fix(oa011): 0.x ranges collapse to major 0, so a caret pinning the minor is never enforced

  bugin-house
  OWASP/cve-lite-cli#1329 · Filter by author sonukapoor opened on Oct 11, 2026