VulnFuse v0.4.2

Highlights

• Accepts JSON reports with a leading UTF-8 BOM, including common Windows PowerShell stdin and file workflows.
• Includes the v0.4.1 mixed-tool coverage fix: CSV and multi-run SARIF reports are attributed to every actual scanner, including zero-finding SARIF runs.
• Keeps Trivy and CycloneDX producer versions separate from report schema/specification versions.

Install the CLI

npm install --global https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.2/vulnfuse-core-0.4.2.tgz https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.2/vulnfuse-0.4.2.tgz
vulnfuse --version

Verification

The release workflow passed the full repository verification on Node 24. Independent post-release checks recomputed every SHA-256, installed the public tarballs in a fresh project, reproduced the PowerShell BOM path, verified mixed CSV and empty multi-run SARIF attribution, inspected the Node 24 Action archive, and confirmed the CycloneDX 1.5 SBOM identifies VulnFuse 0.4.2.

Coverage and overlap remain evidence-attribution measures, not scanner-accuracy or false-positive verdicts.

VulnFuse v0.4.1

What's Changed

• fix: attribute mixed-tool reports correctly by @CAOShurong in #6

Full Changelog: v0.4.0...v0.4.1

VulnFuse v0.4.0

VulnFuse v0.4.0 turns scanner disagreement into inspectable evidence instead of a misleading count comparison.

Highlights

• Per-tool coverage: reports, source findings, correlated clusters, clusters seen only by one scanner, and clusters shared with another scanner.
• Pairwise overlap: shared and union cluster counts plus Jaccard overlap for every scanner pair (bounded at 20 tools).
• Review everywhere: the matrix is available in canonical JSON, Markdown, the self-contained HTML report, the local browser workbench, and GitHub Action job summaries.
• Useful filters: narrow the workbench or portable report by scanner, one-tool evidence, or multi-tool evidence.
• Automation outputs: the Action now exposes single-tool and multi-tool counts for downstream policy.

The interpretation is deliberately conservative: a finding reported by one tool is a review lead, not proof of a false positive; agreement is evidence coverage, not a correctness vote.

Try it

Open the local-only browser workbench and choose Load safe demo.

Install the checksummed CLI packages directly from this release (Node.js 22.12+):

npm install --global https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.0/vulnfuse-core-0.4.0.tgz https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.0/vulnfuse-0.4.0.tgz
vulnfuse --version

GitHub Action:

- uses: CAOShurong/vulnfuse@v0.4.0
  with:
    reports: reports/*.json
    format: html

Verification and provenance

CI covers Node 22 and 24, Windows CLI execution, clean installation from packed tarballs, the bundled Node 24 Action, and CodeQL. Release assets include a CycloneDX 1.5 SBOM and SHA256SUMS.txt.

Full changelog: v0.3.0...v0.4.0

VulnFuse v0.3.0

Portable offline vulnerability review

VulnFuse v0.3.0 turns correlated scanner evidence and baseline changes into one self-contained HTML file. A reviewer can open it locally, search findings, filter by severity/state/asset, expand source evidence, and follow safe advisory links without deploying a dashboard or uploading reports.

Highlights

• HTML export across the core library, CLI, GitHub Action, and browser workbench
• plain correlation and new / updated / absent / unchanged baseline views
• local search, filters, expand/collapse controls, merge reasons, blockers, source records, and references
• deterministic output with no timestamps, CDN assets, analytics, external fonts, or automatic network requests
• refreshed repository social preview

Security boundary

Report-controlled text and attributes are escaped, non-HTTP(S) references are not rendered as links, report data never enters the fixed script/style blocks, and the document ships with a restrictive Content Security Policy. The HTML still contains scanner evidence, so protect it like the source reports.

Install from this release

npm install --global https://github.com/CAOShurong/vulnfuse/releases/download/v0.3.0/vulnfuse-core-0.3.0.tgz https://github.com/CAOShurong/vulnfuse/releases/download/v0.3.0/vulnfuse-0.3.0.tgz
vulnfuse --version

Use SHA256SUMS.txt to verify the package, Action archive, and CycloneDX SBOM assets.

Validation

The release passed Node 22 and 24 verification, Windows CLI smoke tests, a clean tarball install, bundled Action execution, Pages deployment, CodeQL, 37 local tests, and independent post-release checksum/fresh-install checks.

Full changelog: v0.2.0...v0.3.0

VulnFuse v0.2.0

VulnFuse v0.2.0 adds explainable cross-run baseline comparison to the core library, CLI, GitHub Action, and local-only browser workbench.

Highlights

• Label correlated vulnerability clusters as new, updated, unchanged, or absent.
• Fail CI only when a genuinely new cluster reaches a chosen severity with --fail-on-new or the fail-on-new Action input.
• Export the comparison as JSON, SARIF, CSV, or Markdown. SARIF results include the standard baselineState field and stable partial fingerprints.
• Inspect changed evidence, match scores, and source records instead of relying on an opaque yes/no diff.
• Keep reports local: the hosted workbench performs parsing, matching, comparison, and export inside the browser.
• Bound cluster and source-record comparisons before adversarial inputs can trigger excessive work.

Try it

Open the safe baseline demo in the hosted workbench: https://caoshurong.github.io/vulnfuse/

Install the two checksummed CLI packages from this release, or use CAOShurong/vulnfuse@v0.2.0 in a GitHub Actions workflow. The README contains complete examples for both paths.

Release assets

• vulnfuse-core-0.2.0.tgz and vulnfuse-0.2.0.tgz
• vulnfuse-action-v0.2.0.tar.gz
• CycloneDX SBOM
• SHA256SUMS.txt

Absent means a finding was not observed in the current input set; it is not proof that the vulnerability was remediated.

Full changelog: v0.1.1...v0.2.0

VulnFuse v0.1.1

VulnFuse v0.1.1 is the security-hardening release recommended for all CLI, library, browser, and GitHub Action users.

Security and correctness

• Replaces trailing identifier punctuation cleanup with a linear scan, avoiding pathological regular-expression work on attacker-controlled report text.
• Uses delimiter-aware Markdown code spans so component values containing backticks or backslashes cannot break the generated report structure.
• Keeps CodeQL focused on authored TypeScript while dependency audit and bundle-drift CI continue to verify the committed Action bundle.
• Adds regression coverage for the hardened identifier and Markdown paths.

Distribution and maintenance

• Adds a verified command for installing the paired CLI and core packages directly from this GitHub release.
• Defers incompatible TypeScript major updates while continuing minor and patch updates.
• Ships the CLI, reusable core, Node 24 Action archive, CycloneDX SBOM, and SHA-256 checksums.

Use the hosted workbench, follow the CLI and Action quick start, or read the v0.1.1 changelog.

Full comparison: v0.1.0...v0.1.1

VulnFuse v0.1.0

VulnFuse v0.1.0 is the first public release of a local-first, explainable correlation layer for vulnerability scanner reports.

Highlights

• Reads SARIF 2.1, Trivy, Grype, Snyk, CycloneDX VDR/VEX, OSV-Scanner, CSV, and prior VulnFuse JSON.
• Preserves every source record while explaining each merge score and each hard blocker.
• Supports separate same-asset and root-cause correlation scopes.
• Ships a browser-only workbench, Node.js CLI, reusable core library, and Node 24 GitHub Action.
• Exports canonical JSON, SARIF, CSV, and Markdown without a hosted API, AI model, telemetry, or report upload.

Release artifacts

• vulnfuse-0.1.0.tgz — installable CLI package.
• vulnfuse-core-0.1.0.tgz — installable core library package.
• vulnfuse-action-v0.1.0.tar.gz — source plus the committed Action bundle.
• vulnfuse-sbom.cdx.json — CycloneDX software bill of materials.
• SHA256SUMS.txt — checksums for every artifact above.

Use the hosted workbench, follow the CLI and Action quick start, or inspect the matching policy.

Full changelog: https://github.com/CAOShurong/vulnfuse/blob/v0.1.0/CHANGELOG.md