Skip to content

VulnFuse v0.2.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 05:30
· 7 commits to main since this release
v0.2.0
75bcd1b
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

VulnFuse v0.2.0 adds explainable cross-run baseline comparison to the core library, CLI, GitHub Action, and local-only browser workbench.

Highlights

  • Label correlated vulnerability clusters as new, updated, unchanged, or absent.
  • Fail CI only when a genuinely new cluster reaches a chosen severity with --fail-on-new or the fail-on-new Action input.
  • Export the comparison as JSON, SARIF, CSV, or Markdown. SARIF results include the standard baselineState field and stable partial fingerprints.
  • Inspect changed evidence, match scores, and source records instead of relying on an opaque yes/no diff.
  • Keep reports local: the hosted workbench performs parsing, matching, comparison, and export inside the browser.
  • Bound cluster and source-record comparisons before adversarial inputs can trigger excessive work.

Try it

Open the safe baseline demo in the hosted workbench: https://caoshurong.github.io/vulnfuse/

Install the two checksummed CLI packages from this release, or use CAOShurong/vulnfuse@v0.2.0 in a GitHub Actions workflow. The README contains complete examples for both paths.

Release assets

  • vulnfuse-core-0.2.0.tgz and vulnfuse-0.2.0.tgz
  • vulnfuse-action-v0.2.0.tar.gz
  • CycloneDX SBOM
  • SHA256SUMS.txt

Absent means a finding was not observed in the current input set; it is not proof that the vulnerability was remediated.

Full changelog: v0.1.1...v0.2.0

Assets 7
Loading