Skip to content

VulnFuse v0.3.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 06:07
· 5 commits to main since this release
v0.3.0
aa8c468
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Portable offline vulnerability review

VulnFuse v0.3.0 turns correlated scanner evidence and baseline changes into one self-contained HTML file. A reviewer can open it locally, search findings, filter by severity/state/asset, expand source evidence, and follow safe advisory links without deploying a dashboard or uploading reports.

Highlights

  • HTML export across the core library, CLI, GitHub Action, and browser workbench
  • plain correlation and new / updated / absent / unchanged baseline views
  • local search, filters, expand/collapse controls, merge reasons, blockers, source records, and references
  • deterministic output with no timestamps, CDN assets, analytics, external fonts, or automatic network requests
  • refreshed repository social preview

Security boundary

Report-controlled text and attributes are escaped, non-HTTP(S) references are not rendered as links, report data never enters the fixed script/style blocks, and the document ships with a restrictive Content Security Policy. The HTML still contains scanner evidence, so protect it like the source reports.

Install from this release

npm install --global https://github.com/CAOShurong/vulnfuse/releases/download/v0.3.0/vulnfuse-core-0.3.0.tgz https://github.com/CAOShurong/vulnfuse/releases/download/v0.3.0/vulnfuse-0.3.0.tgz
vulnfuse --version

Use SHA256SUMS.txt to verify the package, Action archive, and CycloneDX SBOM assets.

Validation

The release passed Node 22 and 24 verification, Windows CLI smoke tests, a clean tarball install, bundled Action execution, Pages deployment, CodeQL, 37 local tests, and independent post-release checksum/fresh-install checks.

Full changelog: v0.2.0...v0.3.0

Assets 7
Loading