chore: prepare 1.4.0 release

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to CVE Lite CLI will be documented in this file.
 
+## [1.4.0] - 2026-04-06
+
+### Added
+- npm registry validation for direct fixed-version hints before surfacing copy-and-run commands
+- nearest-published fallback handling for unpublished npm fixed-version hints, with a dedicated registry-adjusted command section
+- explicit warning output for unpublishable fixed-version hints that cannot be turned into runnable commands
+- new NestJS case study documenting the local scan-fix-rescan workflow on a mainstream framework repository
+
+### Changed
+- Suggested fix commands now cover more than the urgent path, including additional direct fixes when confident targets are available
+- Verbose and compact output now highlight copy-and-run remediation commands more prominently and explain when the top-priority issue has no confident automatic command yet
+- README now positions the local remediation loop more clearly against slower pipeline-only scanning workflows
+- Case study and README content now emphasize how local caching keeps consecutive rescans fast during iterative remediation
+
 ## [1.2.0] - 2026-04-04
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.3.0",
+  "version": "1.4.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {