Issues

• refactor(remediation): collapse the two parent-candidate resolvers that have drifted apart

  in-houserefactor
  OWASP/cve-lite-cli#1352 · Filter by author sonukapoor opened on Oct 17, 2026

• fix(overrides): the override-hygiene network checks query public npm regardless of the project's registry

  bugin-house
  OWASP/cve-lite-cli#1348 · Filter by author sonukapoor opened on Oct 16, 2026

• fix(remediation): do not substitute a fix version we cannot justify against a non-npm registry

  bugin-house
  OWASP/cve-lite-cli#1347 · Filter by author sonukapoor opened on Oct 16, 2026

• fix(remediation): a lockfile-only monorepo scan loses remediation for every finding under a workspace member

  bugin-house
  OWASP/cve-lite-cli#1345 · Filter by author sonukapoor opened on Oct 16, 2026

• fix(scan): a scan that finds nothing to parse exits 0, even under --fail-on

  bughelp wanted
  OWASP/cve-lite-cli#1344 · Filter by author sonukapoor opened on Oct 16, 2026
  1

• [Bug] pnpm lockfile v6 keys (/name@version) are not parsed, so pnpm 8 projects scan clean

  bug
  OWASP/cve-lite-cli#1341 · Filter by author alex-powell opened on Oct 15, 2026
  1

• [Bug] Breaking? not flagged for 0.0.x patch upgrades (^0.0.4 does not admit 0.0.5)

  bug
  OWASP/cve-lite-cli#1339 · Filter by author alex-powell opened on Oct 15, 2026

• refactor(fail-on): multi-folder section headers still hardcode the gate-class labels

  enhancementgood first issuehelp wanted
  OWASP/cve-lite-cli#1335 · Filter by author sonukapoor opened on Oct 14, 2026
  1

• fix(cli): flag-conflict errors print an unrelated corporate SSL proxy hint

  buggood first issuehelp wanted
  OWASP/cve-lite-cli#1334 · Filter by author sonukapoor opened on Oct 14, 2026
  2

• fix(json): scan payload records an absolute projectPath, leaking the machine's home directory

  bughelp wanted
  OWASP/cve-lite-cli#1333 · Filter by author sonukapoor opened on Oct 14, 2026

• fix(ratchet): a first ratchet run exits 1 with no report file and no printed reason

  bugin-house
  OWASP/cve-lite-cli#1332 · Filter by author sonukapoor opened on Oct 14, 2026

• fix(oa011): 0.x ranges collapse to major 0, so a caret pinning the minor is never enforced

  bugin-house
  OWASP/cve-lite-cli#1329 · Filter by author sonukapoor opened on Oct 11, 2026

• fix(oa011): exact-version override pins are skipped, so a pin outside a parent's declared range is never reported

  bugin-house
  OWASP/cve-lite-cli#1328 · Filter by author sonukapoor opened on Oct 11, 2026

• feat(scan): cannot scan a published npm package, since a tarball carries no lockfile

  enhancementin-house
  OWASP/cve-lite-cli#1325 · Filter by author sonukapoor opened on Oct 11, 2026
  1

• feat(json): scan output omits chainResolution, so it cannot explain a fix command

  enhancementhelp wanted
  OWASP/cve-lite-cli#1323 · Filter by author sonukapoor opened on Oct 11, 2026
  2

• fix(output): --sarif writes no file when --ratchet suppresses every finding

  bugin-house
  OWASP/cve-lite-cli#1315 · Filter by author sonukapoor opened on Oct 10, 2026

• fix(parsers): Yarn and Bun name a workspace member as the upgrade target in fix-plan wording

  bugin-house
  OWASP/cve-lite-cli#1310 · Filter by author sonukapoor opened on Oct 9, 2026

• feat(debug): make --debug produce one diagnostic bundle that is safe to attach

  enhancementhelp wanted
  OWASP/cve-lite-cli#1309 · Filter by author sonukapoor opened on Oct 9, 2026
  2

• runWithConcurrency starts OSV requests after scan failure

  bug
  OWASP/cve-lite-cli#1298 · Filter by author luojiyin1987 opened on Oct 8, 2026

• fix(ratchet): --ratchet with no committed baseline is a silent permanent pass in CI

  bughelp wanted
  OWASP/cve-lite-cli#1293 · Filter by author sonukapoor opened on Oct 5, 2026
  2

• fix(remediation): within-range update commands list targets the command does not move

  bugin-house
  OWASP/cve-lite-cli#1291 · Filter by author sonukapoor opened on Oct 4, 2026
  1

• fix(gitignore): vim and emacs litter beside CLAUDE.md is still committable

  buggood first issuehelp wanted
  OWASP/cve-lite-cli#1267 · Filter by author sonukapoor opened on Oct 2, 2026
  5

• chore(adopter-scan): match vendored Juice Shop at any depth, not a fixed path list

  in-house
  OWASP/cve-lite-cli#1260 · Filter by author sonukapoor opened on Oct 1, 2026

• test(usage): pin the three places a truncated usage scan is rendered for a human

  good first issuehelp wanted
  OWASP/cve-lite-cli#1259 · Filter by author sonukapoor opened on Oct 1, 2026
  2

• test(version): pin the prerelease fix in positionAgainstRange so it cannot silently regress

  first-timers-onlygood first issue
  OWASP/cve-lite-cli#1255 · Filter by author sonukapoor opened on Sep 30, 2026
  1