release: v1.31.0

CHANGELOG.md

@@ -2,6 +2,27 @@
 
 All notable changes to CVE Lite CLI will be documented in this file.
 
+## [1.31.0] - 2026-08-27
+
+### Added
+
+- HTML report: package names in the findings table now link directly to the npm registry page for each package (#1021, @bharatmalik-cs)
+
+### Fixed
+
+- GitHub Action: scan step now truly informational when `fail-on` is not configured - the CLI's internal default was applying even when the action input was left empty, causing the step to exit 1 on critical findings regardless of the user's intent; split the run block into three paths so only real errors (exit > 1) propagate in the no-fail-on case; same fix applied to the overrides audit step which had the identical root cause; `reachesFailOn` now returns false for an empty `failOn` string (#1048, closes #1047)
+- Scanner: `findFirstFixedVersion` now scopes its search to the specific package being evaluated, preventing a multi-package advisory from incorrectly surfacing a fix version meant for a different package in the same advisory (#1044, @vaibhav8a, closes #1042)
+- pnpm v9: strip the leading slash from package keys in `pnpm-lock.yaml` so packages are resolved correctly and findings are not missed (#1014, @Kunal241207, closes #1012)
+- Flag validation: conflict and missing-argument errors now include the correct flag name and a concrete suggestion for how to proceed (#1022, @Anikesh348, closes #401)
+
+### Tests
+
+- Add SARIF fingerprint hash coverage (#1045, @ramcharan07-gh)
+
+### Docs
+
+- CLI reference: document `--create-pr`, `--base`, and `--debug` flags (#998, @Kakashi15-pix, closes #993)
+
 ## [1.30.0] - 2026-08-23
 
 ### Added

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.30.0",
+  "version": "1.31.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {

website/docusaurus.config.ts

@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.30.0';
+const latestVersion = 'v1.31.0';
 
 const config: Config = {
   title: 'CVE Lite CLI',