CveDeck 0.8.11

0.8.10 fixed three guards that could not see what they guarded. This release is
what happened when that question was asked of the checks themselves.

No database migration. Pull and restart.

The fleet table was making the claim the host page stopped making

0.8.10 fixed the host page, which had been reporting "None actively exploited"
for a host where one finding of forty-one had been checked. Its notes described
the fleet view as already strict.

The fleet view is strict about the feed, not about the host. Its Exploited
column asked whether any feed was usable fleet-wide, and then printed the host's
KEV count — so a host holding unchecked findings got a confident 0, one
screen up from the page that had just stopped saying it. Feed health cannot
answer that question: a host re-scanned while a feed was down carries unchecked
findings however healthy the feed looks by the time you load the page.

The column now carries the same four states as the host page: a count when
something is confirmed, a plain zero only when every finding was checked,
0 so far when some were and none are listed, and a dash when none were
checked at all. GET /api/machines gained kev_unchecked_count, so anything
reading the API can make the same distinction.

Three tables had labels nothing read, and the guard skipped them

The discovery sweep's host table and both of the Settings page's — API tokens
and pinned host keys — carried complete, correct data-label attributes that
did nothing, because none of them sat inside the container that reads those
attributes at phone width. All three now reflow into cards like every other
table in the product.

The check that should have caught this began:

if (!text.includes("table-container")) continue;

That is: examine a table only if it is already in the card system. A table left
out of the card system — the thing the rule exists to prevent — was out of scope
for the rule by construction. It selects on <table now, and a companion check
requires every table to be in the card system at all.

The emoji rule beside it scanned the components and not the stylesheet, which is
the one file that can put a pictograph on screen through content: and so
bypass the palette entirely. There were no offenders; the hole is closed while
it is still empty.

A comparator that was correct by specification accident

compareBySeverity returned NaN for any two findings without a CVSS score,
which is every pair in the Unscored band. It behaved only because
Array.prototype.sort coerces a NaN comparison to zero — which happens to be
the right answer.

Found by mutation: inverting the ordering rule left all 412 frontend tests
green. The rule it implements — a finding whose advisory published a severity
band but no number leads its band, rather than falling to the bottom of a list
sorted by a number it does not have — had no test at all. Both are explicit now,
and both are pinned.

The demo can show the state it could not

0.8.10 added a partially-checked presentation and the demo fixture could not
produce one: every seeded host either carried confirmed exploited findings or
had never been checked at all.

cache-01.lan is now a host scanned again while the KEV feed was unusable. The
findings it already had are enriched; the ones that scan added were never
checked, and those are the four the catalogue lists as exploited. So every
number that can honestly be computed about that host reads zero, and the host
genuinely carries four actively exploited findings. That is the case worth being
able to see.

Also

• Contributors are now told how their change gets published. This
  repository's history is published as snapshots, so a contributor's commit
  cannot survive into it as their commit. CONTRIBUTING.md says so plainly
  now, along with the credit actually on offer — by name in the changelog —
  rather than leaving it to be discovered after the work is done.
• Dependabot groups React with its own renderer and both type packages. A
  major had moved react and @types/react to 19 while leaving react-dom and
  @types/react-dom at 18, producing a lockfile npm could not resolve. It read
  as "React 19 is hard"; it was a group that split a set which must move
  together.
• Dependencies: alembic 1.20.0, SQLAlchemy 2.0.54, uvicorn 0.53.0, psycopg
  3.3.5, hypothesis 6.168.0, fast-check 4.10, vitest 5.0.1. TypeScript 7 and
  React 19 are deliberately not taken here; each is its own change.

Upgrading

docker pull ghcr.io/reprodev/cvedeck:0.8.11

Full changelog: https://github.com/reprodev/cvedeck/blob/main/CHANGELOG.md