From f1f5c645e4a108c6b7f5d7e9a3d38471a1f33a35 Mon Sep 17 00:00:00 2001
From: Sonu Kapoor <sonukapoor@gmail.com>
Date: Thu, 27 Aug 2026 08:53:59 -0400
Subject: [PATCH] release: v1.31.0

---
 CHANGELOG.md                 | 21 +++++++++++++++++++++
 package-lock.json            |  6 +++---
 package.json                 |  2 +-
 website/docusaurus.config.ts |  2 +-
 4 files changed, 26 insertions(+), 5 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index f23369e3..6f23aacb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,27 @@
 
 All notable changes to CVE Lite CLI will be documented in this file.
 
+## [1.31.0] - 2026-08-27
+
+### Added
+
+- HTML report: package names in the findings table now link directly to the npm registry page for each package (#1021, @bharatmalik-cs)
+
+### Fixed
+
+- GitHub Action: scan step now truly informational when `fail-on` is not configured - the CLI's internal default was applying even when the action input was left empty, causing the step to exit 1 on critical findings regardless of the user's intent; split the run block into three paths so only real errors (exit > 1) propagate in the no-fail-on case; same fix applied to the overrides audit step which had the identical root cause; `reachesFailOn` now returns false for an empty `failOn` string (#1048, closes #1047)
+- Scanner: `findFirstFixedVersion` now scopes its search to the specific package being evaluated, preventing a multi-package advisory from incorrectly surfacing a fix version meant for a different package in the same advisory (#1044, @vaibhav8a, closes #1042)
+- pnpm v9: strip the leading slash from package keys in `pnpm-lock.yaml` so packages are resolved correctly and findings are not missed (#1014, @Kunal241207, closes #1012)
+- Flag validation: conflict and missing-argument errors now include the correct flag name and a concrete suggestion for how to proceed (#1022, @Anikesh348, closes #401)
+
+### Tests
+
+- Add SARIF fingerprint hash coverage (#1045, @ramcharan07-gh)
+
+### Docs
+
+- CLI reference: document `--create-pr`, `--base`, and `--debug` flags (#998, @Kakashi15-pix, closes #993)
+
 ## [1.30.0] - 2026-08-23
 
 ### Added
diff --git a/package-lock.json b/package-lock.json
index 2b2233db..6b381f0e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -1,12 +1,12 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "cve-lite-cli",
-      "version": "1.30.0",
+      "version": "1.31.0",
       "license": "MIT",
       "dependencies": {
         "better-sqlite3": "^12.8.0",
@@ -27,7 +27,7 @@
         "typescript": "^5.8.2"
       },
       "engines": {
-        "node": ">=18"
+        "node": ">=20"
       }
     },
     "node_modules/@babel/code-frame": {
diff --git a/package.json b/package.json
index 08785bea..5f1820d3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {
diff --git a/website/docusaurus.config.ts b/website/docusaurus.config.ts
index 2af4ef14..7518a704 100644
--- a/website/docusaurus.config.ts
+++ b/website/docusaurus.config.ts
@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.30.0';
+const latestVersion = 'v1.31.0';
 
 const config: Config = {
   title: 'CVE Lite CLI',