SecuLens 1.5.1 - PHP 8.5 deprecation output and dependency updates

1.5.1

• Update commander to 15 and @renovatebot/pep440 to 5. Node.js 22.12 or later is now required (commander 15 does not support earlier 22.x releases).
• No change to findings or report output.

SecuLens 1.5.0 - CVSS 4.0 and Prioritization

1.5.0

• Calculate CVSS 4.0 scores from CVSS_V4 vectors using FIRST's published tables. Advisories with only a CVSS 4 vector are no longer Unrated.
• Add optional customer-context prioritization (P1 to P4) through context in the policy file. Severity is unchanged, and each finding records the factors, effects, sources and justifications behind its priority.
• Report schema 1.2 adds priority to findings. seculens validate --kind report still accepts schema 1.1 reports.
• Word reports list higher priorities first and show the priority evidence.

SecuLens 1.4.0 - Composer Version Semantics

• Packagist matching now follows Composer version normalization: one to four numeric parts (e.g. 5.4.0.1), build metadata ignored, and stability order dev < alpha < beta < RC < stable < patch (a, b, pl, p aliases and -dev suffixes included).
• Branch versions such as dev-main and 1.x-dev remain unassessed, and other unrecognized Composer syntax is reported as unknown instead of guessed.
• Add a shared Composer version test corpus (composer-versions.json) used identically by the TypeScript, Python and PHP implementations.

SecuLens 1.3.0 - Version alignment

• Align the release version with SecuLens for Python 1.3.0 (which now requires Python 3.11+). No functional changes.

SecuLens 1.2.0 - Offline SBOM & Report Schema Validation

• Add seculens validate for offline JSON Schema validation of SPDX 2.2/2.3 and CycloneDX 1.4–1.7 SBOMs and SecuLens reports (--kind report).
• Bundle the official upstream SPDX and CycloneDX schemas with source hashes and licenses, plus the cross-language report schema report-1.1.schema.json.
• Export validateDocument / validate_document / Validation::validate from the library API.

SecuLens 1.1.0 - Supply Chain Protection & Model Context Protocol (MCP) Server

What's Changed in SecuLens 1.1.0

🛡️ Supply Chain Threat Protection

• Lifecycle Script Detection (SC-LIFECYCLE-SCRIPT): Scans package.json, package-lock.json, and composer.json for install scripts (preinstall, install, postinstall, etc.) to prevent arbitrary execution during dependency installation.
• Supply-Chain AST Static Analysis: Detects hazardous patterns including dynamic process spawning (child_process / subprocess), environment variable enumeration (process.env, os.environ, $_ENV), and sensitive path references (~/.ssh, id_rsa, ~/.aws).

🤖 Model Context Protocol (MCP) stdio Server

• Introduces seculens mcp command across TypeScript, Python, and PHP implementations with zero external dependencies.
• Fully compatible with Claude Desktop, Cursor, Antigravity, and other AI agents.
• Exposes tools: seculens_scan, seculens_analyze, seculens_check_license, and seculens_generate_report.

🔍 Lockfile Integrity & Cool-off Checks

• Lockfile Integrity Verification: Flags hash mismatches between SBOM and lockfiles (SC-INTEGRITY-MISMATCH) and insecure HTTP resolution URLs (SC-INSECURE-REGISTRY-URL).
• Release Age (Cool-off) Check (--cool-off): Flags packages released within a specified threshold (e.g. 7 days) to guard against zero-day compromised releases.
• Transitive Dependency Depth: Automatically calculates and assigns depth levels to dependency components.

⚙️ Automation & Security

• Added weekly Dependabot automated dependency update configuration.
• Added GitHub Actions pull request dependency review workflow.
• Reinforced .gitignore across all ecosystems.

SecuLens 1.0.0

SecuLens 1.0.0 aligns the release version across the independent Python, JavaScript/TypeScript and PHP implementations.

• SPDX and CycloneDX SBOM assessment, native OSV vulnerability matching and license policy evaluation.
• Language-native AST review and complexity checks.
• English-default/Japanese interactive wizard and customer Word reports with a cover, severity summary and finding tables.
• Includes the output file safety fixes from the preceding maintenance release.

Language-specific AST rules, supported language versions and SBOM generation adapters are documented in each implementation's README. Findings are assessment evidence, not a guarantee of security or legal compliance.

SecuLens 0.3.2

Protect CLI report and SBOM output from destination symlink overwrite by replacing generated files from a private temporary location. New report files use restrictive Unix permissions.

Python and TypeScript SBOM generation now has a five-minute timeout. PHP local JSON input/output rejects URL and stream wrapper paths.

Regression tests cover preservation of symlink target files. Dependency audits reported no known vulnerabilities in the installed dependencies at review time; this is not a guarantee of absence of unknown defects.

SecuLens 0.3.1 — masahiroid

Move the SecuLens repositories and package links to masahiroid.

Python: https://github.com/masahiroid/seculens-python
TypeScript: https://github.com/masahiroid/seculens

Includes the bilingual interactive wizard and customer Word reporting from 0.3.0. PyPI publisher settings use owner masahiroid, repository seculens-python, workflow publish.yml, environment pypi.

SecuLens 0.3.0 — Interactive Wizard

Run seculens without arguments to launch interactive setup. English is the default; select ja for Japanese, or run seculens wizard --lang ja. The selected language also applies to the Word report.

Choose assessment of an existing SBOM or SBOM generation. Enter database, optional policy / source review, customer / target / preparer, report style and output settings, then review and confirm. Customer report layout is the wizard default. Existing scan / sbom options remain available.

Invalid input paths and choices prompt again. EOF, declined execution and Ctrl+C cancel safely. OSV package-name / ecosystem disclosure is shown before fetching. Python generation requires Syft; TypeScript generation uses npm.

Validated: Python 54 tests; TypeScript 27 tests; actual terminal interaction; independent package-install runs produce Japanese Word reports from the bare command.