Issues

• fix(gitignore): vim and emacs litter beside CLAUDE.md is still committable

  buggood first issuehelp wanted
  OWASP/cve-lite-cli#1267 · Filter by author sonukapoor opened on Oct 2, 2026
  5

• fix(gitignore): .claude/ is not ignored, only a machine-local exclude keeps it out

  buggood first issuehelp wanted
  OWASP/cve-lite-cli#1266 · Filter by author sonukapoor opened on Oct 2, 2026
  1

• fix(version): positionAgainstRange throws on a version component above MAX_SAFE_INTEGER

  buggood first issuehelp wanted
  OWASP/cve-lite-cli#1265 · Filter by author sonukapoor opened on Oct 2, 2026
  1

• fix(report): report.json lost lockfileSource when it was unified with --json

  buggood first issuehelp wanted
  OWASP/cve-lite-cli#1263 · Filter by author sonukapoor opened on Oct 2, 2026

• chore(adopter-scan): match vendored Juice Shop at any depth, not a fixed path list

  in-house
  OWASP/cve-lite-cli#1260 · Filter by author sonukapoor opened on Oct 1, 2026

• test(usage): pin the three places a truncated usage scan is rendered for a human

  good first issuehelp wanted
  OWASP/cve-lite-cli#1259 · Filter by author sonukapoor opened on Oct 1, 2026

• chore(overrides): three behaviour-neutral tidy-ups in the OA008 detector and version utils

  good first issuehelp wanted
  OWASP/cve-lite-cli#1256 · Filter by author sonukapoor opened on Sep 30, 2026
  1

• test(version): pin the prerelease fix in positionAgainstRange so it cannot silently regress

  first-timers-onlygood first issue
  OWASP/cve-lite-cli#1255 · Filter by author sonukapoor opened on Sep 30, 2026
  1

• Self Fix PRs never run CI, so automated security fixes cannot merge on their own

  enhancementin-house
  OWASP/cve-lite-cli#1253 · Filter by author sonukapoor opened on Sep 30, 2026

• self-scan: a new dev-only transitive advisory turns every open PR red with no action available to authors

  in-house
  OWASP/cve-lite-cli#1252 · Filter by author sonukapoor opened on Sep 30, 2026
  1

• fix(gitignore): local-only maintainer notes are ignored by exact name, so backups are not

  bughelp wanted
  OWASP/cve-lite-cli#1245 · Filter by author sonukapoor opened on Sep 29, 2026
  2

• refactor(sarif): replace the eight positional parameters with an options object

  enhancementhelp wanted
  OWASP/cve-lite-cli#1244 · Filter by author sonukapoor opened on Sep 29, 2026
  1

• fix(report): HTML fix commands embed a cwd-relative path, so they are not runnable

  bughelp wanted
  OWASP/cve-lite-cli#1243 · Filter by author sonukapoor opened on Sep 29, 2026
  1

• Replace better-sqlite3 with the built-in node:sqlite

  enhancementin-house
  OWASP/cve-lite-cli#1237 · Filter by author sonukapoor opened on Sep 26, 2026
  

• parentDeclarations requires node_modules, so OA009 and OA011 silently no-op on a lockfile-only scan

  bugin-house
  OWASP/cve-lite-cli#1232 · Filter by author sonukapoor opened on Sep 24, 2026
  3

• OA010 is unreachable from the documented scan path and no-ops silently

  bugin-house
  OWASP/cve-lite-cli#1222 · Filter by author sonukapoor opened on Sep 22, 2026
  1

• [Bug] editing the delta comment in place means nobody is told when a PR gets worse

  bugin-house
  OWASP/cve-lite-cli#1188 · Filter by author sonukapoor opened on Sep 20, 2026
  1

• [Feature] delta input on the Action, so adopters get the PR comment

  enhancement
  OWASP/cve-lite-cli#1158 · Filter by author sonukapoor opened on Sep 17, 2026
  2

  

• fix: isSslCertificateError skips the outer message whenever the error has a cause

  bugin-house
  OWASP/cve-lite-cli#1147 · Filter by author sonukapoor opened on Sep 16, 2026

• fix(advisories): a mid-download failure in advisories sync loses the network hint and says only 'terminated'

  bugin-house
  OWASP/cve-lite-cli#1138 · Filter by author sonukapoor opened on Sep 15, 2026

• feat(cyclonedx): emit the dependencies array, which currently has no dependency graph at all

  enhancementin-house
  OWASP/cve-lite-cli#1135 · Filter by author sonukapoor opened on Sep 14, 2026

• fix(spdx): a package.json with no name drops every root-anchored edge and the DESCRIBES relationship

  bugin-house
  OWASP/cve-lite-cli#1134 · Filter by author sonukapoor opened on Sep 14, 2026

• perf(usage): stripComments makes import extraction ~11x slower

  enhancementin-house
  OWASP/cve-lite-cli#1120 · Filter by author sonukapoor opened on Sep 11, 2026

• fix(workspaces): packages/** and prefix globs are not matched by workspace expansion

  bugin-house
  OWASP/cve-lite-cli#1119 · Filter by author sonukapoor opened on Sep 11, 2026

• feat(scanner): return partial findings on scan timeout via AbortSignal

  enhancementin-house
  OWASP/cve-lite-cli#1105 · Filter by author sonukapoor opened on Sep 8, 2026