Skip to content

5.5.0

Choose a tag to compare

View all tags
@eoftedal eoftedal released this 21 Aug 11:48
· 4 commits to master since this release
5.5.0
2ab6772
This commit was signed with the committer’s verified signature.
eoftedal Erlend Oftedal
SSH Key Fingerprint: ZNw4WHa1GU31EGWSuwsjwKvoL//8KqBNPqWm0knVALc
Verified
Learn about vigilant mode.

[5.5.0]

Improvements

  • Include the vulnerability repositories used for the scan in the output: as vulnerabilityRepositories in the JSON report, and as retirejs:vulnerability-repository entries under metadata.properties in all CycloneDX reports.
  • CycloneDX 1.6 VEX output now identifies Retire.js as the source of each vulnerability and rating, including the repository URL when a single repository is used.

Bugfixes

  • CycloneDX 1.6 VEX output was not schema valid: ratings[].source was a string rather than an object, and version ranges were reported as affects[].range rather than nested under affects[].versions[].
Assets 2
Loading