PatchTriage v0.1.0 – Initial Public Release

Highlights

• Initial public release of PatchTriage
• SSVC (CERT/CC Deployer Model) based vulnerability prioritization
• Support for Trivy, Grype, osv-scanner, CycloneDX, and SPDX
• Integration with NVD, CISA KEV, EPSS, and OSV
• Deterministic evidence-driven remediation decisions
• Local-first architecture with optional AI-assisted explanations
• No cloud dependency or API keys required

What's Included

• Vulnerability ingestion
• Finding deduplication
• Official SSVC decision engine
• Explainable remediation planning
• Offline demo environment

Known Limitations

• Reachability analysis is under active development.
• Runtime context integration is planned for a future release.