Skip to content

kit 1.20.0

Choose a tag to compare

View all tags
@sandstream sandstream released this 24 Jul 22:22
v1.20.0
b2af228
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Added

  • Scanner-runner registry (kit scan) — runs external scanners and merges them into one local verdict. kit's consolidation play: a data-driven registry (Snyk, Trivy, Grype, Semgrep, OSV-scanner) runs each applicable+installed scanner (resolved mise-first; cleanly skipped when not installed / its token is missing / not applicable), pipes the SARIF/OSV output through the #48 ingest adapter, and merges + dedups the results — the same CVE/GHSA reported by multiple scanners collapses to one row with max severity and the union of which scanners flagged it. Local-first, zero-server, deterministic. Pure registry/merge/dedup fixture-tested; orchestration is dependency-injected. Complements kit check's native scanners (socket/semgrep/trivy/osv/trufflehog/bumblebee). (#62)

Full changelog: https://github.com/sandstream/kit/blob/v1.20.0/CHANGELOG.md

Verify this release:

git tag -v v1.20.0
npm audit signatures
Assets 4
Loading