v1.29.0 - Parent-dependency attribution fixes and multi-folder scan improvements

Added

• Honor --usage/--only-used in multi-folder scans - previously accepted (and exposed in the GitHub Action) but silently ignored outside single-folder mode; each subfolder now gets its own source-usage annotation and filtering, isolated from other subfolders
• Surface release-cooldown warnings in SARIF output, exposed as properties.cooldownWarning on the result, so they reach GitHub Code Scanning
• Include DM001 maintenance-risk findings (--check-maintenance) in SARIF output as a dedicated cve-lite-cli-maintenance extension component so GitHub Code Scanning surfaces them
• Expand DM001 maintenance risk (--check-maintenance): deprecated npm packages now surface as their own medium finding (not just an annotation on a drag finding), severity is graduated (constraint drag high, deprecation medium), and a Last release context line is shown for packages abandoned 2+ years - release age is context, never a severity signal on its own. Projects with deprecated direct dependencies will see new medium findings under --check-maintenance (opt-in, advisory)
• Render scan completeness in output: a partial-scan banner/status line in terminal (compact and verbose modes) and a completeness banner in the HTML report, surfacing packument-fetch failures and other scan gaps

Fixed

• Multi-folder --report now writes report.json alongside index.html (matching single-folder artifact shape) and renders override hygiene / maintenance risk panels per folder when --check-overrides/--check-maintenance are set
• Use a callable FetchLike type for injected fetch implementations so clean builds do not break on Node 24, where typeof fetch gains a static preconnect member
• Guard OSV-derived data handling against malformed advisory records so one bad advisory can no longer crash the whole scan
• Reject --fix combined with --sarif or --cdx - previously these silently applied fixes, exited 0, and wrote no output file
• Fix the scan-complete status line printing "vulnerabilitys" when the finding count is not 1
• npm parser: attribute transitive dependencies reached only through a workspace package's dependencies or through a peer dependency, so they no longer report "No parent identified" despite a real parent chain existing
• Update js-yaml to 3.15.1 to clear GHSA-5p4m-2wfm-xmqj
• Yarn parser: correct dev/prod classification for workspace and shared dependencies, fixing workspace-devDependency chains, root/workspace name collisions, and production dependencies also pulled in by a devDependency
• pnpm v9 parser: classify dev/prod by production reachability instead of an aggregated devDependency name set, fixing a monorepo package wrongly marked dev when it was a production dependency in another workspace
• Bun parser: classify dev/prod by production reachability rather than direct declaration only, fixing dev-only transitives leaking into production-scoped results
• Yarn parser: classify dev/prod by production reachability over the full dependency graph instead of the display-capped path list, fixing a production dependency being wrongly marked dev when its path was dropped by the display cap

Changed

• Multi-folder HTML report: replace the unicode chevron on folder sections with an inline SVG chevron that rotates on open, matching the single-folder report

Docs

• Pin actions/checkout to an immutable commit SHA in the README's GitHub Action workflow example
• Document the native GitHub Action inputs for override hygiene in the CI-integration section, with YAML examples and an input reference table
• Fix the mobile navbar drawer opening clipped to the navbar height on the website

Validation

• npm test
• npm run build

Contributors

Thank you to everyone who contributed to this release:

• @Ayush7614
• @luojiyin1987
• @rksharma-owg
• @RohithPariki
• @felipeofdev-ai