OWASP · sonukapoor · Sep 9, 2026 · Sep 9, 2026
@@ -2,6 +2,47 @@
 
 All notable changes to CVE Lite CLI will be documented in this file.
 
+## [1.34.0] - 2026-09-09
+
+> **Upgrade note: offline scans will report more findings for pre-release installs.**
+> Four fixes in this release (version comparison, fix-version selection, published-fix
+> resolution, and affected-range lower bounds) all correct cases where a pre-release
+> install was wrongly cleared. If you run canary, rc or beta versions and keep a
+> `--ratchet` baseline, expect new findings on the first scan after upgrading. That is
+> the fix working, not a regression. One of these cases silently cleared
+> CVE-2025-29927, a critical middleware auth bypass.
+
+### Added
+
+- SPDX 2.3 SBOM output via `--sbom <format>` (`cyclonedx` | `spdx` | `spdx2.3`), with `--cdx` kept as a permanent alias. Findings attach as SECURITY external references of type `advisory`; severity and the runnable fix command go into a package annotation, because SPDX 2.3 has no vulnerability model and `referenceLocator` must be a URI. Package licenses come from the npm lockfile at no network cost; pnpm, Yarn and Bun resolve to NOASSERTION. Emits `supplier`, `filesAnalyzed: false` and `DEPENDENCY_OF` relationships so the document carries all seven NTIA minimum elements. Adds `--sbom-inventory-only` to drop the overlay for diffing, archival and attestation
+- Prod vs dev split line below the severity summary: when some findings are dev-only, a contextual line "N of M findings in prod dependencies" appears in compact and verbose terminal output and as a note below the severity card strip in the HTML report. Silent when all findings are prod or when the dev flag is unavailable
+
+### Changed
+
+- **CycloneDX output moved from spec version 1.4 to 1.6.** `--cdx` and `--sbom cyclonedx` are unchanged in usage, but the emitted `specVersion` field is now `1.6`. This is visible to anyone diffing SBOMs in CI or asserting on the version
+- `metadata.tools` now uses the CycloneDX 1.6 `tools.components` object form with `publisher`, replacing the deprecated 1.4 array of `{vendor, name, version}`
+- Clarified `shouldFailForIncompleteScan` behaviour: only `"error"` triggers a non-zero exit; `"warn"` (the default) surfaces the diagnostic but lets the scan succeed
+- Documented that exit code 3 also covers `--incomplete-policy=error` incomplete scans
+
+### Fixed
+
+- `compareVersions` ranked a pre-release above its associated release, violating semver 11.3. An installed pre-release sitting below the fix version was reported not vulnerable, so a `next` canary silently cleared CVE-2025-29927, a critical middleware auth bypass. Build metadata is now ignored per semver 10
+- `findFirstFixedVersion` returned the lowest fix across every advisory range without checking which range contained the installed version, so an advisory patching two branches reported the other branch's fix. `minimist@1.2.5` was told to "upgrade" to `0.2.4`, a downgrade across a major boundary
+- `resolvePublishedFixVersion` built its candidate list without filtering pre-releases, so when an advisory's fixed-version hint was unpublished it could recommend a higher pre-release as the fix. `npm install <pkg>@1.2.4-beta.1` was being emitted as a verified high-severity remediation
+- Making `compareVersions` semver-correct fixed the upper bound of an affected range but broke the lower one: a pre-release of the introduced version sorted below it and fell outside its own range, so a `1.2.0-beta.1` install stopped being reported. The relaxation deliberately cannot widen a pre-release lower bound, because OSV declares plenty of those and widening them would pull in earlier canaries the advisory excluded
+- SBOM dependency graph was reconstructed from `PackageRef.paths`, which are capped at five per package, so large trees lost edges and packages whose surviving routes traversed excluded packages were left with no parent at all. Edges now come from the npm lock graph, which is complete and untouched by the display cap. Workspace members and parents filtered out by `--prod-only` now anchor to the root instead of orphaning the package. Measured on a large monorepo: DEPENDENCY_OF edges 2664 to 4082, packages with no parent 111 to 1. pnpm, Yarn and Bun keep the path-derived fallback
+- OSV batch result count mismatch is now detected instead of silently producing zero vulnerability IDs for the unmatched packages, with a per-row identity check so index scrambling cannot misattribute vulnerabilities
+- Same package@version no longer appears as two separate rows when OSV and the npm supplemental advisory pass both have findings for it; all vulnerability IDs from both sources merge into a single finding
+- fflate upgraded from 0.8.2 to 0.8.3, resolving CVE-2026-45820
+- js-yaml upgraded from 3.15.1 to 3.15.2, resolving GHSA-2883-xcg3-v3hh
+
+### Docs
+
+- New SPDX SBOM guide, plus README usage line, comparison row and guide links; cli-reference rows for `--sbom` and `--sbom-inventory-only`; CycloneDX page cross-linked
+- reading-output: documented the `Fix Now` badge in compact mode, EPSS and EPSS Priority columns in the verbose findings table, and four-tier triage guidance
+- html-report: documented the EPSS percentile column, EPSS Priority Signal column, detail badge breakdown, and interactive priority legend
+- `examples/open-source-friday-demo/`: a deliberately vulnerable Express service and run of show for the GitHub Open Source Friday stream
+
 ## [1.33.0] - 2026-09-01
 
 ### Added

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.33.0",
+  "version": "1.34.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {

@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.33.0';
+const latestVersion = 'v1.34.0';
 
 const config: Config = {
   title: 'CVE Lite CLI',