Skip to content

VulnFuse v0.4.2

Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 09 Aug 07:28
v0.4.2
b021815
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Highlights

  • Accepts JSON reports with a leading UTF-8 BOM, including common Windows PowerShell stdin and file workflows.
  • Includes the v0.4.1 mixed-tool coverage fix: CSV and multi-run SARIF reports are attributed to every actual scanner, including zero-finding SARIF runs.
  • Keeps Trivy and CycloneDX producer versions separate from report schema/specification versions.

Install the CLI

npm install --global https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.2/vulnfuse-core-0.4.2.tgz https://github.com/CAOShurong/vulnfuse/releases/download/v0.4.2/vulnfuse-0.4.2.tgz
vulnfuse --version

Verification

The release workflow passed the full repository verification on Node 24. Independent post-release checks recomputed every SHA-256, installed the public tarballs in a fresh project, reproduced the PowerShell BOM path, verified mixed CSV and empty multi-run SARIF attribution, inspected the Node 24 Action archive, and confirmed the CycloneDX 1.5 SBOM identifies VulnFuse 0.4.2.

Coverage and overlap remain evidence-attribution measures, not scanner-accuracy or false-positive verdicts.

Assets 7
Loading