All pull requests

Pull requests

• fix(overrides): OA005 --fix removes only the flagged nested pin

  #1636·prx-my opened Nov 13, 2026Contributor·

  ·
  1

  2

• fix: validate the registry for npm alias tarballs

  #1633·shryssssss-maker opened Nov 13, 2026Contributor·

  ·
  1

  13

• release: v1.41.3

  #1632·sonukapoor opened Nov 13, 2026Collaborator·

  ·
  1

• fix: preserve dev flags for validated chain upgrades

  #1631·shryssssss-maker opened Nov 13, 2026Contributor·

  ·
  1

  4

• refactor: share package install command prefixes

  #1630·shryssssss-maker opened Nov 13, 2026Contributor·

  ·
  1

  3

• fix(npm): preserve root workspace with --include-workspace-root (#1619)

  #1625·muntasir-396 opened Nov 11, 2026Contributor·

  ·
  1

  6

• fix(bun): scope workspace parent updates with --filter (#1620)

  #1624·muntasir-396 opened Nov 11, 2026Contributor·

  ·
  1

  7

• fix: preserve every advisory in CycloneDX output

  #1616·vianmangal opened Nov 10, 2026Contributor·

  ·
  1

  10

• fix: scope OSV query and detail caches to the endpoint

  #1615·vianmangal opened Nov 10, 2026Contributor·

  ·
  1

  10

• fix: follow osv querybatch pagination

  #1614·vianmangal opened Nov 10, 2026Contributor·

  ·
  1

  20

• fix: match explicit affected versions in offline scans

  #1613·vianmangal opened Nov 10, 2026Contributor·

  ·
  1

  13

• fix: recognize compact static imports

  #1612·vianmangal opened Nov 10, 2026Contributor·

  ·
  1

  5

• fix: allow combining --sbom and --report output format

  #1604·Nachiket-Roy opened Nov 10, 2026Contributor·

  ·
  1

  15

• fix(cli): distinguish all-dev dependencies filtered by --prod-only from missing lockfiles

  #1603·Nachiket-Roy opened Nov 10, 2026Contributor·

  ·
  1

  9

• fix(usage): scan Svelte, Vue, and Astro components for imported package usage

  #1600·Nachiket-Roy opened Nov 10, 2026Contributor·

  ·
  1

  21

• fix(security): strip credentials from lockfile resolved URLs

  #1596·Medhansh-741 opened Nov 10, 2026·

  ·
  1

  2

• fix: strip credentials and query tokens from resolved URLs

  #1595·coder-Yash886 opened Nov 10, 2026Contributor·

  ·
  1

  32

• fix: retain pnpm root fixes alongside member fixes

  #1594·vianmangal opened Nov 10, 2026Contributor·

  ·
  1

  2

• fix: use refresh commands in within-range advice

  #1593·vianmangal opened Nov 10, 2026Contributor·

  ·
  6

• fix: skip option-shaped workspace names in npm, Yarn and Bun fix commands

  #1588·rqms40 opened Nov 10, 2026Contributor·

  ·
  1

  17

• fix(remediation): add -w to pnpm add for workspace-root dependencies

  #1587·sarankumar1325 opened Nov 9, 2026·

  ·
  1

  6

• fix(output): name the project's package manager in the within-range recommendedAction

  #1586·sarankumar1325 opened Nov 9, 2026·

  ·
  1

  4

• fix(parsers): loadFromPackageLock omits resolvedUrl for v1 lockfile dependencies (#1579)

  #1581·muntasir-396 opened Nov 9, 2026Contributor·

  ·
  1

  18

• fix(cli): create missing parent directories for --audit-log file path (#1578)

  #1580·muntasir-396 opened Nov 9, 2026Contributor·

  ·
  1

  19

• fix: sanitize package names and summaries in stdout against workflow command injection

  #1573·Nachiket-Roy opened Nov 9, 2026Contributor·

  ·
  1

  51