CVE Lite: Apply → Commit → Push parity + remediation audit trail (#107) - #108
Merged
Conversation
…, #106) cve-lite was invoked online-only. When the live OSV API is unreachable (air-gapped/restricted networks), the CLI writes no output file and the scan silently returned zero findings — masking real CVEs (e.g. qs@6.15.1 GHSA-q8mj-m7cp-5q26 / CVE-2026-8723, which the pnpm-audit Patches view flagged but CVE Lite did not). - runCveLiteRaw now tries online first, then falls back to an offline scan against the synced advisory DB (--offline-db). Throws on total failure instead of returning [] so callers surface a real error (the runner marks the source failed; the page route returns 500). Extracted a pure, unit-tested buildCveLiteCommand helper. - readDbStatus() read osv-vulns.json, but `advisories sync` writes advisories.db, so a successful Sync DB never reflected in the status indicator. Point both (and the offline scan) at one shared CVE_LITE_DB_PATH constant = ~/.cache/cve-lite/advisories.db. Verified: tsc clean; 99 tests pass (+5 builder tests); runCveLiteRaw against hexops now returns findingCount 1 surfacing qs@6.15.1 → fixed 6.15.2. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…107) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…d remediation-commit (#107) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…sent (#107) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
…portedOnly) (#107) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… commit (#107) A transitive-only advisory fixed via 'Fix all direct' (cve-lite --fix) is a no-op, leaving nothing to commit; the banner used to appear anyway and dead-end on 'No changes to commit'. Gate it on git-dirty state and explain the transitive case. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
alamb-hex
added a commit
that referenced
this pull request
May 24, 2026
… dropped by #108 squash The pnpm.overrides qs fix from f3a5789 (PR #108) was lost when #108 was squash-merged, so main regressed to qs@6.15.1 (GHSA-q8mj-m7cp-5q26 / CVE-2026-8723, qs DoS; transitive via @modelcontextprotocol/sdk -> express). The cve-lite scan reads pnpm-lock.yaml (resolved-lockfile mode), so it correctly flagged the regression even though a half-finished dashboard apply had left node_modules at 6.15.2. Re-add the override as a minimum-safe-version floor (>=6.15.2) rather than an exact pin, so it can't become a stale downgrade pin or block a future qs security patch. Resolves to a single qs@6.15.2; lockfile change is qs-only. Verified: cve-lite offline scan (OSV advisories.db) findingCount 0; no qs, CVE-2026-8723, or GHSA-q8mj-m7cp-5q26 in the report. qs@6.15.2 is the sole copy in both pnpm-lock.yaml and node_modules. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
/security), scoped to the selected project, reusing the existing/git-commitand/git-pushendpoints andgeneratePatchCommitMessage. No diff review; editable generated commit message; push stays a deliberate click.security_remediation_appliedlog on apply (both per-finding Apply and Fix all direct), plussource: 'cve-lite'+ advisory IDs folded into the existingcommit_created/push_completedlog meta. Net: this CVE → this commit → pushed.cve-lite --fixcan't touch) explains itself instead of dead-ending on "No changes to commit".--offline-db) when the OSV API is unreachable (previously it failed silently and reported zero findings), and the DB-status indicator readsadvisories.db— the fileadvisories syncactually writes.Changes
src/lib/security/remediation-commit.ts(+ tests) — pure helper deriving commit packages + de-duped advisory IDs fromFindingRow(remediationFromRow,remediationFromRows).src/components/security/cve-lite/pending-commit-banner.tsx— self-contained Commit/Push banner.src/app/security/page.tsx— apply→commit→push wiring, audit context, dirty-gated banner.update,cve-lite/[id]/fix,git-commit,git-pushroutes — optionalauditContext/source/advisories→ logs (backward compatible; Patches page unaffected).src/lib/security/cve-lite-view.ts— extract sharedFIX_SEVERITY_ORDER.src/lib/security/sources/cve-lite.ts+cve-lite-db.ts— online→offline fallback + correct DB path (CVE Lite scan silently returns zero findings when OSV API is unreachable (online-only) — misses qs/CVE-2026-8723 #105/CVE Lite DB status reads osv-vulns.json but Sync DB writes advisories.db — successful syncs never reflected #106).Test plan
pnpm typecheckcleanpnpm vitest run— 105 tests pass (incl. newremediation-commit+ builder tests)pnpm buildsucceedspnpm.overrideswritten → Commit → Push, and confirm thesecurity_remediation_applied+commit_created/push_completedlog trail carriessource: 'cve-lite'+ advisory IDsCloses #105, #106, #107.
🤖 Generated with Claude Code