Release v1.30.0 - Root column, auto within-range fixes, and Node 26 support · OWASP/cve-lite-cli

Added

Root column showing the top-level direct dependency behind each transitive finding, across terminal, JSON, and HTML report (including multi-folder). HTML detail view Parent: label renamed to Root: for consistency
--fix now auto-applies safe within-range transitive refreshes when the fix is available within the parent's declared range, without requiring a parent-level upgrade

pnpm scan performance: lockfile parsed once per scan instead of up to three times - approximately 14% faster warm scan on large monorepos
--fix unapplied-fix summary is now honest and categorized - each skipped fix includes a reason
Workspace --fix commands scoped to the declaring workspace member rather than the root
Transitive risk message refactored for clarity and reuse across terminal and HTML output

npm transitive remediation: resolves the correct installed instance of an intermediate package when the same package name appears at multiple versions in the tree
Ratchet rejects incomplete scan data, preventing a partial scan from generating a misleadingly clean baseline
OSV batch query: a 200 response with no results array now throws a descriptive error instead of crashing
Parent-update "Recommended target" column shows the resolved version instead of the literal install command
Quick take summary verb now agrees with the finding count
0.x cross-minor upgrades flagged as breaking in the Breaking? column, HTML report, and --fix confirmation
Node 26 compatibility: better-sqlite3 bumped to 12.11.1, engines tightened to >=20

New comprehensive best-practices guide: "Dependency Security for JS/TS: A Practical Guide"
"Used by" adopters section added to homepage and README
CONTRIBUTING.md now documents the full advisories sync step needed before running E2E tests