NoVul 0.1.2

Fewer false positives

• requirements.txt. Only == pins count as exact versions. Lower bounds such as Pillow>=10.0 are estimated now. A requirements*.txt next to a uv.lock or poetry.lock is skipped. Lines that come in through -r are not counted twice.
• Estimated versions. An estimated version no longer shows just because its advisory is actively exploited.
• Global packages. Test fixtures and build stubs inside a package (such as resolve/test/.../package.json) are not installed packages.
• Secrets. ${VAR} references, YOUR_API_KEY placeholders, test files and --cov= lines are not secrets.

Findings that were missed

• Virtualenvs. For a project with a .venv or venv and no lockfile, NoVul reads the installed versions from the venv.
• Bun. NoVul checks a standalone Bun for advisories. brew vulns skips the oven-sh/bun tap.

Other

• A repository can't hide a package from NoVul with a decoy lockfile, or with -r pointing to a file that NoVul doesn't scan. Malicious packages are never dropped.

• A finding keeps its id and mute when its advisory gets a CVE id.

• The agent prompt and the MCP description say that fixed_version, direct and fix_command can be null.

Full Changelog: v0.1.1...v0.1.2

NoVul 0.1.1

New

• Private mode (Settings). NoVul downloads the OSV databases for your languages (approximately 250 MB, one time each day) and checks your packages on your Mac. No data from your projects leaves your Mac. Homebrew packages are not checked in this mode.
• EPSS scores, end-of-life dates and AI-tool advisories now download as full lists, so these requests do not send data from your Mac.

Fixed

• Long commands in a fix row now wrap inside the box. The Copy and Run fix buttons stay visible.

Docs

• The README now uses ASD-STE100 Simplified Technical English.

Full Changelog: v0.1.0...v0.1.1

NoVul 0.1.0

Full Changelog: https://github.com/misbahsy/novul/commits/v0.1.0