Skip to content

kit 1.16.0

Choose a tag to compare

View all tags
@sandstream sandstream released this 24 Jul 22:22
v1.16.0
9c42830
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • SARIF + OSV ingestion adapter — one parser per format, not per tool (kit ingest <sarif|osv> <file>). SARIF 2.1.0 (semgrep/CodeQL/Trivy/Grype/…) and OSV-scanner JSON normalize into kit's SecurityCheckResult shape: SARIF maps security-severity (CVSS) → severity with a level fallback and lifts CWE-NNN rule tags into a citation; OSV maps package vulnerabilities to dependency findings with an OWASP-A06 citation. Pure (string → findings), fixture-tested; kit ingest prints them severity-sorted (--json for the raw list). Ingesting the format means any SARIF/OSV-emitting scanner feeds kit's finding ledger uniformly. (#48)

Full changelog: https://github.com/sandstream/kit/blob/v1.16.0/CHANGELOG.md

Verify this release:

git tag -v v1.16.0
npm audit signatures
Assets 4
Loading