Release notes: Vibgrate CLI 2026.1005.1 — JUnit reports and EPSS/KEV for smarter vuln triage

[vibgrate-team]

What's new in 2026.1005.1

Shipped 5 Oct 2026. Full release: https://github.com/vibgrate/cli/releases/tag/v2026.1005.1 · Changelog: https://vibgrate.com/changelog/cli/2026.1005.1

Headline: CI-ready vulnerability output you can actually triage

This cut is about making vg scan results easier to act on in CI. vg scan --junit <file> now writes a deterministic JUnit XML report alongside the other formats, so findings show up in the test views your CI already has. --vulns --format json adds EPSS score, EPSS percentile and CISA KEV flags when available, so you can sort by "likely to be exploited" rather than just severity. SARIF now writes one result per package and advisory, which makes code-scanning dashboards much less noisy.

Baselines got more transparent too: vg scan --baseline now records the findings that matched the baseline (with detailed JSON), so you can see what was suppressed and why.

Also in this cut

New

• vg scan --junit <file> for deterministic JUnit XML
• EPSS / KEV fields in vg scan --vulns --format json when available
• vg scan --baseline records baseline-matched findings in JSON
• vg scan --vulns --offline --package-manifest documents the local manifest shape, with stable findings order
• DOCS.md lists command messages and the next command to run for each

Improved

• vg sbom export docs explain how resolved versions are identified
• SARIF output writes one result per package and advisory

Fixed

• vg scan and vg report correctly show when a vulnerability has a fix available
• Direct Go modules without a v version prefix are handled in the code graph
• License findings in JSON and SARIF include the manifest's repository path

Security

• Sensitive details are redacted from registry and upload error messages

Try it

npm install -g @vibgrate/cli
vg --version                          # expect 2026.1005.1
vg scan --vulns --format json         # look for epss / kev fields
vg scan --junit vibgrate-junit.xml    # feed this to your CI test report

No-install try: npx @vibgrate/cli scan

Benchmarks (honest)

Two-arm benchmark vs 2026.1003.3 on the pinned corpus (236 metrics compared). Extraction held steady (19 languages, 26,499 definitions, 18,833 call edges, locate accuracy 0.94, dependency detection 0.96). Startup median ~727 → ~730 ms. Regressions are published, not omitted: agent tokens with vg on comparable tasks rose 578,766 → 636,808 (+10.0%) and median tool calls per task went 6 → 7 (+16.7%). We're looking into both. Details: https://vibgrate.com/cli/benchmarks

Discuss

• Wiring --junit into your CI? Tell us which system (GitHub Actions, GitLab, Jenkins…) and whether the report renders the way you'd expect.
• Is EPSS / KEV changing how you prioritise fixes? We'd love to hear what you sort by.
• Docs gaps? Grab a good first issue or reply here.
• Roadmap thread: Public roadmap: make vibgrate/cli easy to discover, try, and contribute to #144

— maintainers (vibgrate-team)