From 3ad18b72eb4774a158f873d5db23d9d9923cdbd0 Mon Sep 17 00:00:00 2001 From: Rohith Pariki Date: Fri, 4 Sep 2026 05:12:20 +0530 Subject: [PATCH 1/4] docs(output): document EPSS Priority Signal in reading output and HTML report guides --- website/docs/html-report.md | 2 +- website/docs/reading-output.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/website/docs/html-report.md b/website/docs/html-report.md index 480bb12d..353cbc71 100644 --- a/website/docs/html-report.md +++ b/website/docs/html-report.md @@ -42,7 +42,7 @@ In multi-folder mode (no root lockfile, two or more nested lockfiles), the repor **Findings table** with interactive controls: - Filter by severity or direct-only -- EPSS threat percentile column displaying exploitation likelihood relative to all published CVEs (highlighted in purple for top 10%) +- EPSS threat percentile column displaying exploitation likelihood relative to all published CVEs (highlighted in red for top 10%) - EPSS Priority Signal column classifying each finding into actionable tiers (`Fix Now`, `Fix Soon`, `Monitor`, `Low Priority`) - Expandable rows showing vulnerability description, contextual risk summary, next action, dependency path, recommended action, and detailed EPSS Priority Signal breakdown diff --git a/website/docs/reading-output.md b/website/docs/reading-output.md index 16240306..c8478921 100644 --- a/website/docs/reading-output.md +++ b/website/docs/reading-output.md @@ -14,7 +14,7 @@ Running `cve-lite .` without flags gives you a focused view: the top urgent find **What to read first:** -- The **Vulnerabilities found** block — top critical/high packages with one-line fix guidance each. Findings with high EPSS exploitation likelihood (top 10%) are flagged inline with a `` `⚡ Fix Now` `` priority signal badge. +- The **Vulnerabilities found** block — top critical/high packages with one-line fix guidance each. Findings with high EPSS exploitation likelihood (top 10%) are flagged inline with a `[⚡ Fix Now]` priority signal badge. - The **Copy And Run These Fix Commands** block — grouped, package-manager-native commands ready to execute - The **Summary** — total count broken down by severity and direct vs transitive @@ -84,9 +84,9 @@ How to use this section: - use `Usage` to quickly identify if the dependency is actually imported or just noise (requires `--usage` flag) - review `EPSS` (raw percentile) and `EPSS Priority` to triage findings by real-world exploitation likelihood: - `Fix Now`: Critical or high severity + top 10% EPSS exploitation likelihood — address immediately - - `Fix Soon`: Critical or high severity, but EPSS not in top 10% — schedule remediation + - `Fix Soon`: Critical or high severity, but lower exploitation activity — schedule remediation - `Monitor`: Medium or lower severity + top 10% EPSS exploitation likelihood — watch closely - - `Low Priority`: Medium or lower severity, but EPSS not in top 10% — handle in routine maintenance cycles + - `Low Priority`: Medium or lower severity, lower exploitation activity — handle in routine maintenance cycles - use `Fixed` to see what the safe target version is ### 4) Review coverage notes From e6f7c48fef9d5361436702f12404711e1308daee Mon Sep 17 00:00:00 2001 From: Rohith Pariki Date: Fri, 4 Sep 2026 06:55:45 +0530 Subject: [PATCH 2/4] docs: address PR review comments for EPSS docs --- website/docs/html-report.md | 2 +- website/docs/reading-output.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/website/docs/html-report.md b/website/docs/html-report.md index 353cbc71..480bb12d 100644 --- a/website/docs/html-report.md +++ b/website/docs/html-report.md @@ -42,7 +42,7 @@ In multi-folder mode (no root lockfile, two or more nested lockfiles), the repor **Findings table** with interactive controls: - Filter by severity or direct-only -- EPSS threat percentile column displaying exploitation likelihood relative to all published CVEs (highlighted in red for top 10%) +- EPSS threat percentile column displaying exploitation likelihood relative to all published CVEs (highlighted in purple for top 10%) - EPSS Priority Signal column classifying each finding into actionable tiers (`Fix Now`, `Fix Soon`, `Monitor`, `Low Priority`) - Expandable rows showing vulnerability description, contextual risk summary, next action, dependency path, recommended action, and detailed EPSS Priority Signal breakdown diff --git a/website/docs/reading-output.md b/website/docs/reading-output.md index c8478921..16240306 100644 --- a/website/docs/reading-output.md +++ b/website/docs/reading-output.md @@ -14,7 +14,7 @@ Running `cve-lite .` without flags gives you a focused view: the top urgent find **What to read first:** -- The **Vulnerabilities found** block — top critical/high packages with one-line fix guidance each. Findings with high EPSS exploitation likelihood (top 10%) are flagged inline with a `[⚡ Fix Now]` priority signal badge. +- The **Vulnerabilities found** block — top critical/high packages with one-line fix guidance each. Findings with high EPSS exploitation likelihood (top 10%) are flagged inline with a `` `⚡ Fix Now` `` priority signal badge. - The **Copy And Run These Fix Commands** block — grouped, package-manager-native commands ready to execute - The **Summary** — total count broken down by severity and direct vs transitive @@ -84,9 +84,9 @@ How to use this section: - use `Usage` to quickly identify if the dependency is actually imported or just noise (requires `--usage` flag) - review `EPSS` (raw percentile) and `EPSS Priority` to triage findings by real-world exploitation likelihood: - `Fix Now`: Critical or high severity + top 10% EPSS exploitation likelihood — address immediately - - `Fix Soon`: Critical or high severity, but lower exploitation activity — schedule remediation + - `Fix Soon`: Critical or high severity, but EPSS not in top 10% — schedule remediation - `Monitor`: Medium or lower severity + top 10% EPSS exploitation likelihood — watch closely - - `Low Priority`: Medium or lower severity, lower exploitation activity — handle in routine maintenance cycles + - `Low Priority`: Medium or lower severity, but EPSS not in top 10% — handle in routine maintenance cycles - use `Fixed` to see what the safe target version is ### 4) Review coverage notes From d0b080469621cb97bb911e873907af1ca38df166 Mon Sep 17 00:00:00 2001 From: Rohith Pariki Date: Fri, 11 Sep 2026 23:48:31 +0530 Subject: [PATCH 3/4] fix: correctly assign targetVersion for parent-update targets Fixes #1007. Assigns the parent's currentVersion instead of the child's targetChildVersion to the parent-update target, preventing incorrect version merging for direct dependencies. --- src/remediation/fix-commands.ts | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/remediation/fix-commands.ts b/src/remediation/fix-commands.ts index cca4ce31..1293ae2a 100644 --- a/src/remediation/fix-commands.ts +++ b/src/remediation/fix-commands.ts @@ -247,7 +247,7 @@ export function buildSuggestedFixCommandPlan( upsertTarget(targetsByPackage, { package: finding.recommendedNpmTransitiveRemediation.package, currentVersion: finding.recommendedNpmTransitiveRemediation.currentVersion, - targetVersion: finding.recommendedNpmTransitiveRemediation.targetChildVersion, + targetVersion: finding.recommendedNpmTransitiveRemediation.currentVersion, scannedVersions: null, knownVulnerableVersions: null, kind: "parent-update", @@ -561,7 +561,7 @@ export function findFixTargetForFinding( if (finding.recommendedNpmTransitiveRemediation?.kind === "update-parent-within-range") { return ( item.kind === "parent-update" && - item.targetVersion === finding.recommendedNpmTransitiveRemediation.targetChildVersion && + item.targetVersion === finding.recommendedNpmTransitiveRemediation.currentVersion && (item.package === finding.recommendedNpmTransitiveRemediation.package || item.package === finding.pkg.name) ); } From 9bcc54386f981b317058db1c65463698d187baab Mon Sep 17 00:00:00 2001 From: Rohith Pariki Date: Sat, 12 Sep 2026 00:09:12 +0530 Subject: [PATCH 4/4] fix(test): adjust assertions for targetVersion of parent-update targets --- src/remediation/fix-commands.ts | 2 +- tests/output.test.ts | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/remediation/fix-commands.ts b/src/remediation/fix-commands.ts index 1293ae2a..5998965b 100644 --- a/src/remediation/fix-commands.ts +++ b/src/remediation/fix-commands.ts @@ -561,7 +561,7 @@ export function findFixTargetForFinding( if (finding.recommendedNpmTransitiveRemediation?.kind === "update-parent-within-range") { return ( item.kind === "parent-update" && - item.targetVersion === finding.recommendedNpmTransitiveRemediation.currentVersion && + (item.targetVersion === finding.recommendedNpmTransitiveRemediation.currentVersion || item.targetVersion === finding.recommendedNpmTransitiveRemediation.targetChildVersion) && (item.package === finding.recommendedNpmTransitiveRemediation.package || item.package === finding.pkg.name) ); } diff --git a/tests/output.test.ts b/tests/output.test.ts index 83cee9b5..db56f957 100644 --- a/tests/output.test.ts +++ b/tests/output.test.ts @@ -597,7 +597,7 @@ describe("output formatters", () => { expect.objectContaining({ package: "mocha", currentVersion: "10.0.0", - targetVersion: "5.1.0", + targetVersion: "10.0.0", kind: "parent-update", }), ],