Skip to content

VulnFuse v0.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 06:44
· 4 commits to main since this release
v0.4.0
e9cb37a
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

VulnFuse v0.4.0 turns scanner disagreement into inspectable evidence instead of a misleading count comparison.

Highlights

  • Per-tool coverage: reports, source findings, correlated clusters, clusters seen only by one scanner, and clusters shared with another scanner.
  • Pairwise overlap: shared and union cluster counts plus Jaccard overlap for every scanner pair (bounded at 20 tools).
  • Review everywhere: the matrix is available in canonical JSON, Markdown, the self-contained HTML report, the local browser workbench, and GitHub Action job summaries.
  • Useful filters: narrow the workbench or portable report by scanner, one-tool evidence, or multi-tool evidence.
  • Automation outputs: the Action now exposes single-tool and multi-tool counts for downstream policy.

The interpretation is deliberately conservative: a finding reported by one tool is a review lead, not proof of a false positive; agreement is evidence coverage, not a correctness vote.

Try it

Open the local-only browser workbench and choose Load safe demo.

Install the checksummed CLI packages directly from this release (Node.js 22.12+):

npm install --global https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.0/vulnfuse-core-0.4.0.tgz https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.0/vulnfuse-0.4.0.tgz
vulnfuse --version

GitHub Action:

- uses: CAOShurong/vulnfuse@v0.4.0
  with:
    reports: reports/*.json
    format: html

Verification and provenance

CI covers Node 22 and 24, Windows CLI execution, clean installation from packed tarballs, the bundled Node 24 Action, and CodeQL. Release assets include a CycloneDX 1.5 SBOM and SHA256SUMS.txt.

Full changelog: v0.3.0...v0.4.0

Assets 7
Loading