Skip to content

v1.33.0 - EPSS Priority Signal

Latest
Latest

Choose a tag to compare

View all tags
@sonukapoor sonukapoor released this 01 Sep 22:56
v1.33.0
This tag was signed with the committer’s verified signature.
sonukapoor Sonu Kapoor
GPG key ID: 3306B2C5600CA6DB
Verified
Learn about vigilant mode.
d747ab8
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • EPSS Priority Signal: combines CVSS severity with EPSS exploitation likelihood percentile into four actionable tiers - fix_now (high impact + top 10% EPSS), fix_soon (high impact), monitor (lower severity + top 10% EPSS), low_priority (all else). Surfaces as an EPSS Priority column in the verbose terminal table, a prioritySignal field in JSON output, and a column plus four-tier legend in the HTML report. Null when no EPSS data is available.

Fixed

  • Scan header now counts unique packages (by name@version) rather than advisory rows; the same package appearing under multiple advisory sources was previously counted twice.

Validation

  • npm test
  • npm run build
Assets 3
Loading