v1.34.0 - SPDX SBOM output and four pre-release false-negative fixes

Upgrade note: offline scans will report more findings for pre-release installs.
Four fixes in this release (version comparison, fix-version selection, published-fix resolution, and affected-range lower bounds) all correct cases where a pre-release install was wrongly cleared. If you run canary, rc or beta versions and keep a --ratchet baseline, expect new findings on the first scan after upgrading. That is the fix working, not a regression. One of these cases silently cleared CVE-2025-29927, a critical middleware auth bypass.

Added

• SPDX 2.3 SBOM output via --sbom <format> (cyclonedx | spdx | spdx2.3), with --cdx kept as a permanent alias. Findings attach as SECURITY external references of type advisory; severity and the runnable fix command go into a package annotation, because SPDX 2.3 has no vulnerability model and referenceLocator must be a URI. Package licenses come from the npm lockfile at no network cost; pnpm, Yarn and Bun resolve to NOASSERTION. Emits supplier, filesAnalyzed: false and DEPENDENCY_OF relationships so the document carries all seven NTIA minimum elements. Adds --sbom-inventory-only to drop the overlay for diffing, archival and attestation
• Prod vs dev split line below the severity summary: when some findings are dev-only, a contextual line "N of M findings in prod dependencies" appears in compact and verbose terminal output and as a note below the severity card strip in the HTML report

Changed

• CycloneDX output moved from spec version 1.4 to 1.6. --cdx and --sbom cyclonedx are unchanged in usage, but the emitted specVersion field is now 1.6. This is visible to anyone diffing SBOMs in CI or asserting on the version
• metadata.tools now uses the CycloneDX 1.6 tools.components object form with publisher, replacing the deprecated 1.4 array of {vendor, name, version}
• Clarified shouldFailForIncompleteScan behaviour: only "error" triggers a non-zero exit; "warn" (the default) surfaces the diagnostic but lets the scan succeed

Fixed

• compareVersions ranked a pre-release above its associated release, violating semver 11.3. An installed pre-release sitting below the fix version was reported not vulnerable, so a next canary silently cleared CVE-2025-29927, a critical middleware auth bypass. Build metadata is now ignored per semver 10
• findFirstFixedVersion returned the lowest fix across every advisory range without checking which range contained the installed version, so an advisory patching two branches reported the other branch's fix. minimist@1.2.5 was told to "upgrade" to 0.2.4, a downgrade across a major boundary
• resolvePublishedFixVersion built its candidate list without filtering pre-releases, so an unpublished fixed-version hint could surface a higher pre-release as the recommended fix
• A pre-release of an advisory's introduced version sorted below it and fell outside its own affected range, so a 1.2.0-beta.1 install stopped being reported
• SBOM dependency graph was reconstructed from dependency paths capped at five per package, so large trees lost edges and some packages ended up with no parent at all. Edges now come from the npm lock graph, which is complete. Measured on a large monorepo: DEPENDENCY_OF edges 2664 to 4082, packages with no parent 111 to 1
• OSV batch result count mismatch is now detected instead of silently producing zero vulnerability IDs for the unmatched packages
• Same package@version no longer appears as two separate rows when OSV and the npm supplemental advisory pass both have findings for it
• fflate upgraded from 0.8.2 to 0.8.3, resolving CVE-2026-45820
• js-yaml upgraded from 3.15.1 to 3.15.2, resolving GHSA-2883-xcg3-v3hh

Validation

• npm test
• npm run build

Contributors

• @RohithPariki
• @WilliamK112
• @SomSamantray
• @rksharma-owg
• @AbdaullahAG
• @XiaoZ-0218
• @chiliec
• @Retsumdk
• @cnYui (reported the pre-release comparison bug fixed in this release)