Skip to content

fix(pkg): use version-aware vulnerability advisories - #44

Merged
jlitola merged 1 commit into
mainfrom
maize-aardwolf
Apr 28, 2026
Merged

fix(pkg): use version-aware vulnerability advisories#44
jlitola merged 1 commit into
mainfrom
maize-aardwolf

Conversation

@jlitola

@jlitola jlitola commented Apr 28, 2026

Copy link
Copy Markdown
Contributor

Summary

  • Query version-aware affected advisories for package vulnerability checks instead of deprecated ambiguous vulnerability fields.
  • Surface affected, historical, and total advisory counts plus new advisory metadata in CLI/MCP JSON.
  • Improve terminal wording for inspected-version risk and historical-only advisories.

Validation

  • bun test
  • bun run build
  • bun run typecheck
  • bun run dev pkg vulns npm:lodash@4.17.20 --json
  • bun run dev pkg vulns npm:lodash --json
  • bun run dev pkg vulns npm:lodash --no-color

Query affected advisories from the backend so safe versions report historical advisories separately from active risk. Update CLI and MCP output to preserve version-specific metadata while keeping terminal wording focused on inspected-version impact.
@jlitola
jlitola merged commit b4de967 into main Apr 28, 2026
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant