release: v1.10.0 (#256)

Author: sonukapoor

CHANGELOG.md

@@ -2,6 +2,20 @@
 
 All notable changes to CVE Lite CLI will be documented in this file.
 
+## [1.10.0] - 2026-04-28
+
+### Added
+- HTML report now includes breaking change indicators, validation statistics, scan notes, and a search/filter control in the findings table.
+
+### Fixed
+- Transitive vulnerability findings now display tier-aware, actionable guidance instead of the generic "Upgrade the parent dependency chain" message. When a primary parent package is identified, it is named explicitly. When no dependency path data is available, the output honestly says so and directs developers to inspect their lockfile.
+- Fix plan skip reasons now distinguish between findings where a parent is known but no safe upgrade version was identified (Tier 2) and findings with no dependency path data at all (Tier 3).
+- Urgent fix plan table now renders parent-upgrade targets in their own table with a Context column showing which vulnerable package each parent upgrade resolves.
+
+### Changed
+- CI integration docs updated to reference the `OWASP/cve-lite-cli` GitHub Action and include the `--all` flag in example commands.
+- Comparison docs expanded with a dedicated GitHub Dependabot section covering advisory database differences, methodology, and where CVE Lite CLI provides more actionable output.
+
 ## [1.9.0] - 2026-04-25
 
 ### Added

docs/index.html

@@ -51,7 +51,7 @@
       "description": "Free, local-first dependency vulnerability scanner for JavaScript and TypeScript projects. Scans npm, pnpm, Yarn, and Bun lockfiles, provides copy-and-run fix commands, and supports offline advisory DB scanning.",
       "url": "https://owasp.org/cve-lite-cli/",
       "downloadUrl": "https://www.npmjs.com/package/cve-lite-cli",
-      "softwareVersion": "1.9.0",
+      "softwareVersion": "1.10.0",
       "license": "https://github.com/OWASP/cve-lite-cli/blob/main/LICENSE",
       "releaseNotes": "https://github.com/OWASP/cve-lite-cli/releases",
       "codeRepository": "https://github.com/OWASP/cve-lite-cli",
@@ -109,10 +109,10 @@
             </a>
           </div>
         </div>
-        <a class="release-badge" href="https://github.com/OWASP/cve-lite-cli/releases/tag/v1.9.0"
-          aria-label="Latest release v1.9.0">
+        <a class="release-badge" href="https://github.com/OWASP/cve-lite-cli/releases/tag/v1.10.0"
+          aria-label="Latest release v1.10.0">
           <span class="release-badge-label">Latest Release</span>
-          <span class="release-badge-version">v1.9.0</span>
+          <span class="release-badge-version">v1.10.0</span>
         </a>
         <p class="eyebrow">JavaScript/TypeScript Dependency Scanner &mdash; <a href="https://owasp.org/cve-lite-cli" style="color:inherit;text-decoration:underline">An OWASP Foundation Project</a></p>
         <h1>Scan. Understand. Fix.</h1>
@@ -391,7 +391,7 @@ <h3>Trust and support</h3>
   <footer class="container site-footer">
     <p><em>Most tools tell you what's wrong. CVE Lite CLI tells you what to run.</em></p>
     <p>CVE Lite CLI is MIT licensed and built in public. <a href="https://owasp.org/cve-lite-cli">An OWASP Foundation Project</a>.</p>
-    <p>Latest: <a href="https://github.com/OWASP/cve-lite-cli/releases/tag/v1.9.0">v1.9.0</a></p>
+    <p>Latest: <a href="https://github.com/OWASP/cve-lite-cli/releases/tag/v1.10.0">v1.10.0</a></p>
     <p>Developed with love by <a href="https://sonukapoor.com">Sonu Kapoor</a>.</p>
     <p>
       <a href="https://github.com/OWASP/cve-lite-cli/issues">Open an issue</a>

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.9.0",
+  "version": "1.10.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {