v0.3.1

Notable changes

Changed

• Internal: the audit render/--fail-on pipeline, previously duplicated across
  the audit purl, linux and docker subcommands, is now a single shared
  renderer (no user-facing change).

Changelog

• 9b58931 refactor(cmd): group shared audit flags into auditOptions
• 056d123 refactor(cmd): implemented renderAudit
• 494224b style(version): indent heredoc

v0.3.0

Notable changes

Added

• ssvc calculate <CVE-ID...> command: compute SSVC decisions in bulk following
  the CISA methodology (Track / Track* / Attend / Act), with a decision legend in
  the text report. Reads CVEs from arguments, --file or stdin.
• audit linux and audit docker commands (EXPERIMENTAL): audit the installed
  packages of a Linux system (local or over SSH) or a Docker image/container.
  Collection runs a fixed, read-only command set and supports Debian/Ubuntu,
  the RHEL family, SUSE, Alpine and Slackware.
• SARIF 2.1.0 export for the audit commands (--output=sarif), suitable for
  GitHub Code Scanning and other SARIF consumers.
• CSV export of the per-advisory audit details (--output=csv) for spreadsheets.
• Accepted-risk ignore file (.secdbignore, --ignore-file): exclude findings
  from the --fail-on exit code (and mark them as suppressed in SARIF) without
  removing them from the report.
• --fail-on=<severity>: exit non-zero when a vulnerability at or above the given
  severity is found, for use in CI pipelines.
• --show-unfixed: vulnerabilities that have no available fix are hidden by
  default (the report warns how many were hidden); this flag lists them and marks
  each advisory as having no fix available.

Changed

• The audit details view (--view=details) is now one card per advisory,
  severity-sorted and with a provenance footer, instead of a wide table.
• Richer cve text report: web permalinks to the SecDB GUI, a References section,
  and prose word-wrapped to the terminal width.
• Audit text reports now lead with a metadata header (input source, packages
  scanned, target) and print progress to stderr only when attached to a terminal.
• Internal: the HTTP client was reorganized and a generic report container now
  backs the text renderers (no user-facing change).

Changelog

• 4cd27c5 feat(audit): add CSV export via template (--output=csv)
• 2313020 feat(audit): add Linux and Docker package auditing (EXPERIMENTAL)
• c6cdb18 feat(audit): add SARIF export and ".secdbignore" file support
• 99472a5 feat(audit): hide unfixed vulnerabilities by default and add --show-unfixed
• 511c5a5 feat(audit): improved "audit purl" command
• 56bb487 feat(audit): improved Audit template
• 9a6f404 feat(audit): redesign details view as advisory
• a31d6ad feat(audit): refactor reports
• 6ac7006 feat(cve): improved text output and word-wrap
• 32f9443 feat(output): improved text wrapping
• 7ca8b8a feat(report): add generic report container for text renderers
• 6d0e76c feat(ssvc): color the Track decision, add CISA decision legends and tidy calculate flags
• 9c13202 feat: add ssvc calculate (bulk) command
• 30f1617 feat: improve status message
• 37c5cb4 refactor(client): increase timeout, response struct
• a126fac refactor(client): split client.go
• e3347ac style(audit): tidy the ignore
• 0677d12 style(version): tidy the version command example

v0.2.0

Notable changes

Added

• CycloneDX SBOM input for audit purl via --sbom (JSON): every package URL in
  the BOM is collected and audited.
• Package URL validation: malformed PURLs are detected and skipped.
• Global --debug flag for structured logging to stderr.

Changelog

• 4e3ff25 docs(audit): fix audit purl help examples
• 0af9d0f feat(audit): add support for CycloneDX BOM
• 8631102 feat(audit): validate PURL strings using packageurl-go
• 1604805 feat(cli): add global --debug flag for structured logging

v0.1.0

Initial public release of the ZEN SecDB CLI.

Changelog

• 37b712b First release of ZEN SecDB CLI