{"source":"https://contributable.vercel.app","licence":"CC BY 4.0","methodology":"https://contributable.vercel.app/methodology","v":2,"owner":"OWASP","name":"cve-lite-cli","updatedAt":"2026-10-11T05:43:16.176Z","coveredSince":"2025-10-04T17:22:49.007Z","facts":{"owner":"OWASP","name":"cve-lite-cli","description":"Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance.","stars":762,"forks":165,"archived":false,"isFork":false,"license":"MIT","defaultBranch":"main","pushedAt":"2026-10-10T13:07:46Z","createdAt":"2026-03-27T21:27:59Z","topics":["appsec","cve","javascript","nodejs","owasp","security","security-tools","cve-scanning","dependency-scanner","npm","pnpm","sca","vulnerability","vulnerability-scanner","cybersecurity","cyclonedx","fast","sbom-enabled","fix-command"],"languages":{"TypeScript":2410123,"MDX":46001,"CSS":22313,"JavaScript":20468},"frameworks":["Jest","TypeScript"],"commits90d":217,"releases365d":30,"lastReleaseAt":"2026-10-08T11:47:30Z","gettingStarted":{"contributing":true,"codeOfConduct":true,"issueTemplates":true,"devcontainer":false,"cla":"none","channels":[{"kind":"slack","url":"https://owasp.org/slack/invite"}],"policy":null}},"metrics":{"computedAt":"2026-10-11T05:43:16.176Z","outsidePulls":{"cohort":{"n":72,"merged":59,"closedUnmerged":13,"open":0,"mergeRate":0.8194444444444444,"openShare":0,"evidence":{"merged":[1114,1113,1102,1096,1094,1093,1092,1084,1072,1069,1046,1045,1044,1039,1038,1034,1033,1022,1021,1014],"closedUnmerged":[1037,1010,940,939,938,911,906,890,864,863,766,746,710],"open":[]}},"firstTimers":{"n":45,"merged":35,"closedUnmerged":10,"open":0,"mergeRate":0.7777777777777778,"openShare":0,"evidence":{"merged":[1102,1094,1093,1084,1069,1045,1044,1039,1038,1034,1033,1022,1021,1006,1005,1004,998,996,992,985],"closedUnmerged":[1037,1010,938,911,906,864,863,766,746,710],"open":[]}},"year":{"n":120,"merged":101,"closedUnmerged":19,"open":0,"mergeRate":0.8416666666666667,"openShare":0,"evidence":{"merged":[1114,1113,1102,1096,1094,1093,1092,1084,1072,1069,1046,1045,1044,1039,1038,1034,1033,1022,1021,1014],"closedUnmerged":[1037,1010,940,939,938,911,906,890,864,863,766,746,710,608,607,476,469,441,405],"open":[]}}},"pullFirstResponse":{"n":72,"answered":70,"waiting":2,"medianHours":18.08972222222222,"p75Hours":38.88388888888889,"within48h":0.8333333333333334,"within7d":0.9305555555555556,"curve":[{"hours":0.21138888888888888,"waiting":0.9861111111111112},{"hours":0.5861111111111111,"waiting":0.9722222222222223},{"hours":0.9108333333333334,"waiting":0.9444444444444446},{"hours":1.1058333333333332,"waiting":0.9305555555555558},{"hours":2.4072222222222224,"waiting":0.902777777777778},{"hours":2.9252777777777776,"waiting":0.8888888888888892},{"hours":3.7525,"waiting":0.8611111111111115},{"hours":4.6066666666666665,"waiting":0.8472222222222227},{"hours":5.039166666666667,"waiting":0.8194444444444448},{"hours":5.81,"waiting":0.8055555555555559},{"hours":6.373333333333333,"waiting":0.777777777777778},{"hours":8.115833333333333,"waiting":0.7638888888888891},{"hours":8.634722222222223,"waiting":0.7361111111111113},{"hours":8.718055555555555,"waiting":0.7222222222222224},{"hours":9.280277777777778,"waiting":0.6944444444444445},{"hours":10.077777777777778,"waiting":0.6805555555555556},{"hours":11.149166666666666,"waiting":0.6666666666666666},{"hours":12.665,"waiting":0.6388888888888887},{"hours":12.730277777777777,"waiting":0.6249999999999999},{"hours":12.939444444444444,"waiting":0.5972222222222221},{"hours":15.142777777777777,"waiting":0.5833333333333331},{"hours":16.91888888888889,"waiting":0.5555555555555552},{"hours":17.394444444444446,"waiting":0.5416666666666664},{"hours":17.578611111111112,"waiting":0.5138888888888887},{"hours":18.08972222222222,"waiting":0.4999999999999999},{"hours":20.113888888888887,"waiting":0.4722222222222221},{"hours":20.190277777777776,"waiting":0.4583333333333332},{"hours":21.48611111111111,"waiting":0.4305555555555554},{"hours":21.674166666666668,"waiting":0.4166666666666665},{"hours":23.413333333333334,"waiting":0.3888888888888888},{"hours":23.68,"waiting":0.3749999999999999},{"hours":25.295555555555556,"waiting":0.34722222222222215},{"hours":25.573055555555555,"waiting":0.33333333333333326},{"hours":27.175833333333333,"waiting":0.31944444444444436},{"hours":37.76083333333333,"waiting":0.2916666666666666},{"hours":37.799166666666665,"waiting":0.2777777777777777},{"hours":38.88388888888889,"waiting":0.24999999999999992},{"hours":39.721111111111114,"waiting":0.23611111111111102},{"hours":40.89805555555556,"waiting":0.20833333333333323},{"hours":44.23833333333334,"waiting":0.19444444444444436},{"hours":46.742777777777775,"waiting":0.16666666666666663},{"hours":61.873333333333335,"waiting":0.15277777777777773},{"hours":74.18666666666667,"waiting":0.12499999999999996},{"hours":86.03916666666667,"waiting":0.11111111111111106},{"hours":92.02055555555556,"waiting":0.0833333333333333},{"hours":141.16805555555555,"waiting":0.06944444444444442},{"hours":181.14638888888888,"waiting":0.04166666666666666},{"hours":214.80805555555557,"waiting":0.027777777777777776}],"evidence":{"answered":[1114,1113,1102,1096,1094,1093,1092,1084,1072,1069,1046,1045,1044,1039,1038,1037,1034,1033,1022,1021],"waiting":[911,906]}},"timeToMerge":{"n":72,"merged":59,"medianHours":87.25722222222223,"evidence":[1114,1113,1102,1096,1094,1093,1092,1084,1072,1069,1046,1045,1044,1039,1038,1034,1033,1022,1021,1014]},"issueFirstResponse":{"n":217,"answered":77,"waiting":140,"medianHours":null,"p75Hours":null,"within48h":0.2626728110599075,"within7d":0.35023041474654304,"curve":[{"hours":0.03916666666666667,"waiting":0.9953917050691244},{"hours":0.13555555555555557,"waiting":0.9861751152073733},{"hours":0.13694444444444445,"waiting":0.9815668202764978},{"hours":0.4513888888888889,"waiting":0.9723502304147466},{"hours":0.5111111111111111,"waiting":0.9677419354838709},{"hours":0.5666666666666667,"waiting":0.9585253456221198},{"hours":0.5786111111111111,"waiting":0.9539170506912442},{"hours":0.8322222222222222,"waiting":0.9447004608294931},{"hours":0.9522222222222222,"waiting":0.9400921658986175},{"hours":1.2408333333333332,"waiting":0.9308755760368664},{"hours":1.3416666666666666,"waiting":0.9262672811059909},{"hours":1.8525,"waiting":0.9170506912442398},{"hours":1.9344444444444444,"waiting":0.9124423963133642},{"hours":3.058611111111111,"waiting":0.9032258064516131},{"hours":3.12,"waiting":0.8986175115207375},{"hours":3.3933333333333335,"waiting":0.8894009216589864},{"hours":3.46,"waiting":0.8847926267281109},{"hours":6.9816666666666665,"waiting":0.8755760368663598},{"hours":10.47,"waiting":0.8709677419354842},{"hours":12.555833333333334,"waiting":0.861751152073733},{"hours":12.835277777777778,"waiting":0.8571428571428574},{"hours":14.156944444444445,"waiting":0.8479262672811063},{"hours":15.261666666666667,"waiting":0.8433179723502308},{"hours":16.103055555555557,"waiting":0.8341013824884796},{"hours":16.97111111111111,"waiting":0.8294930875576041},{"hours":21.920833333333334,"waiting":0.8156682027649774},{"hours":25.570555555555554,"waiting":0.8110599078341019},{"hours":28.076944444444443,"waiting":0.8018433179723506},{"hours":28.435833333333335,"waiting":0.797235023041475},{"hours":33.85583333333334,"waiting":0.7880184331797238},{"hours":34.845,"waiting":0.7834101382488482},{"hours":36.24333333333333,"waiting":0.7741935483870971},{"hours":36.243611111111115,"waiting":0.7511520737327192},{"hours":43.977777777777774,"waiting":0.7419354838709681},{"hours":46.57138888888889,"waiting":0.7373271889400925},{"hours":50.86083333333333,"waiting":0.7281105990783414},{"hours":55.65555555555556,"waiting":0.7235023041474659},{"hours":61.875277777777775,"waiting":0.7142857142857147},{"hours":67.90638888888888,"waiting":0.7096774193548392},{"hours":71.67416666666666,"waiting":0.7004608294930881},{"hours":72.75305555555556,"waiting":0.6958525345622125},{"hours":77.79972222222223,"waiting":0.6866359447004614},{"hours":84.83583333333333,"waiting":0.6820276497695859},{"hours":100.07027777777778,"waiting":0.6728110599078347},{"hours":114.52111111111111,"waiting":0.6682027649769592},{"hours":162.15166666666667,"waiting":0.6589861751152081},{"hours":166.1888888888889,"waiting":0.6543778801843325},{"hours":261.6797222222222,"waiting":0.6451612903225814}],"evidence":{"answered":[1088,1087,1082,1080,1077,1057,1055,1042,1030,1029,1028,1027,1026,1025,1024,1023,1020,1012,1007,1003],"waiting":[1116,1110,1109,1108,1107,1105,1103,1097,1091,1090,1089,1086,1083,1081,1079,1078,1075,1071,1066,1063]}},"starter":{"counts":{"available":0,"claimed":1,"in-progress":10,"stale":0},"helpWantedAvailable":1,"issues":[{"n":1309,"title":"feat(debug): make --debug produce one diagnostic bundle that is safe to attach","state":"available","label":"help-wanted","createdAt":"2026-10-09T21:01:12Z","updatedAt":"2026-10-09T21:13:19Z"},{"n":1296,"title":"feat(json): record cliVersion, scannedAt and the effective options in the --json payload","state":"in-progress","label":"beginner","createdAt":"2026-10-07T22:14:52Z","updatedAt":"2026-10-07T23:20:51Z"},{"n":1293,"title":"fix(ratchet): --ratchet with no committed baseline is a silent permanent pass in CI","state":"in-progress","label":"help-wanted","createdAt":"2026-10-05T11:39:22Z","updatedAt":"2026-10-09T12:58:07Z"},{"n":1283,"title":"chore: replace the em dashes in shipped source and output strings","state":"in-progress","label":"beginner","createdAt":"2026-10-03T16:57:09Z","updatedAt":"2026-10-03T16:59:26Z"},{"n":1275,"title":"test: pin the --fix suppression of the --fail-on gate line","state":"in-progress","label":"beginner","createdAt":"2026-10-03T14:51:03Z","updatedAt":"2026-10-03T15:19:09Z"},{"n":1274,"title":"refactor: share the --fail-on gate-class labels between the two scan paths","state":"in-progress","label":"beginner","createdAt":"2026-10-03T14:51:02Z","updatedAt":"2026-10-03T14:51:02Z"},{"n":1267,"title":"fix(gitignore): vim and emacs litter beside CLAUDE.md is still committable","state":"in-progress","label":"beginner","createdAt":"2026-10-02T12:24:28Z","updatedAt":"2026-10-02T22:38:39Z"},{"n":1266,"title":"fix(gitignore): .claude/ is not ignored, only a machine-local exclude keeps it out","state":"in-progress","label":"beginner","createdAt":"2026-10-02T12:24:09Z","updatedAt":"2026-10-03T10:10:51Z"},{"n":1259,"title":"test(usage): pin the three places a truncated usage scan is rendered for a human","state":"in-progress","label":"beginner","createdAt":"2026-10-01T21:33:00Z","updatedAt":"2026-10-04T13:39:59Z"},{"n":1255,"title":"test(version): pin the prerelease fix in positionAgainstRange so it cannot silently regress","state":"in-progress","label":"beginner","createdAt":"2026-09-30T12:51:30Z","updatedAt":"2026-10-02T12:14:11Z"},{"n":1244,"title":"refactor(sarif): replace the eight positional parameters with an options object","state":"in-progress","label":"help-wanted","createdAt":"2026-09-29T02:14:51Z","updatedAt":"2026-10-02T12:26:04Z"},{"n":1088,"title":"test: add coverage for phantom-utils (getDeclaredPackages and installCmd)","state":"in-progress","label":"beginner","createdAt":"2026-09-05T20:16:37Z","updatedAt":"2026-09-13T03:26:28Z"},{"n":912,"title":"docs: complete the Docusaurus (pnpm monorepo) case study","state":"claimed","label":"beginner","createdAt":"2026-07-28T12:34:39Z","updatedAt":"2026-08-24T12:43:06Z"},{"n":420,"title":"chore: fix TypeScript code quality violations from May 2026 audit","state":"in-progress","label":"beginner","createdAt":"2026-05-23T15:13:44Z","updatedAt":"2026-09-27T13:44:49Z"}]},"responseWindow":{"hours":[0,0,0,0,0,0,0,0,0,0,0,3,26,2,4,0,8,0,0,0,0,2,0,2,0,2,0,0,0,0,0,0,0,0,0,17,28,0,0,1,5,0,1,0,1,1,0,1,2,0,0,0,0,0,0,0,0,0,0,19,22,1,1,1,4,10,0,0,0,1,1,3,0,0,0,0,0,0,0,0,0,0,0,12,20,9,2,2,3,1,0,1,0,2,0,4,1,0,0,0,0,0,0,0,1,0,0,13,27,2,0,2,0,1,0,0,0,4,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,8,7,8,1,1,0,6,3,1,0,0,0,0,0,0,15,0,0,0,0,1,0,0,1,4,10,10,6,7,0,0,0,0,0,0],"people":4,"replies":365},"activeMaintainers":4},"series":[{"week":"2025-10-12","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-10-19","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-10-26","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-11-02","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-11-09","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-11-16","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-11-23","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-11-30","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-12-07","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-12-14","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-12-21","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2025-12-28","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-01-04","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-01-11","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-01-18","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-01-25","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-02-01","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-02-08","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-02-15","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-02-22","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-03-01","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-03-08","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-03-15","opened":0,"merged":0,"answered7d":0,"activity":0},{"week":"2026-03-22","opened":0,"merged":0,"answered7d":0,"activity":9},{"week":"2026-03-29","opened":0,"merged":0,"answered7d":0,"activity":47},{"week":"2026-04-05","opened":0,"merged":0,"answered7d":0,"activity":30},{"week":"2026-04-12","opened":4,"merged":4,"answered7d":4,"activity":32},{"week":"2026-04-19","opened":1,"merged":1,"answered7d":1,"activity":17},{"week":"2026-04-26","opened":3,"merged":3,"answered7d":3,"activity":33},{"week":"2026-05-03","opened":0,"merged":0,"answered7d":0,"activity":15},{"week":"2026-05-10","opened":0,"merged":0,"answered7d":0,"activity":14},{"week":"2026-05-17","opened":10,"merged":9,"answered7d":10,"activity":40},{"week":"2026-05-24","opened":14,"merged":11,"answered7d":14,"activity":101},{"week":"2026-05-31","opened":6,"merged":6,"answered7d":6,"activity":87},{"week":"2026-06-07","opened":10,"merged":8,"answered7d":10,"activity":119},{"week":"2026-06-14","opened":7,"merged":6,"answered7d":7,"activity":97},{"week":"2026-06-21","opened":5,"merged":3,"answered7d":5,"activity":97},{"week":"2026-06-28","opened":3,"merged":3,"answered7d":3,"activity":51},{"week":"2026-07-05","opened":3,"merged":3,"answered7d":3,"activity":37},{"week":"2026-07-12","opened":5,"merged":5,"answered7d":4,"activity":16},{"week":"2026-07-19","opened":10,"merged":7,"answered7d":10,"activity":41},{"week":"2026-07-26","opened":3,"merged":1,"answered7d":1,"activity":53},{"week":"2026-08-02","opened":6,"merged":3,"answered7d":6,"activity":50},{"week":"2026-08-09","opened":8,"merged":8,"answered7d":6,"activity":35},{"week":"2026-08-16","opened":9,"merged":7,"answered7d":9,"activity":63},{"week":"2026-08-23","opened":3,"merged":3,"answered7d":3,"activity":28},{"week":"2026-08-30","opened":6,"merged":6,"answered7d":6,"activity":29},{"week":"2026-09-06","opened":6,"merged":4,"answered7d":6,"activity":39},{"week":"2026-09-13","opened":11,"merged":5,"answered7d":7,"activity":51},{"week":"2026-09-20","opened":15,"merged":15,"answered7d":15,"activity":85},{"week":"2026-09-27","opened":15,"merged":6,"answered7d":13,"activity":61},{"week":"2026-10-04","opened":3,"merged":0,"answered7d":1,"activity":38}],"trend":{"flag":"slowed-down","recentMedianHours":41.83722222222222,"previousMedianHours":16.339444444444446,"recentN":44,"previousN":24,"openedThisWeek":3,"openedLastWeek":15},"programs":[{"program":"gsoc","slug":"owasp-foundation","name":"OWASP Foundation","years":[2024,2025,2026]}]}