skills.rest
Doezer
DoezerCOMMUNITY
Explore all skills by this author →
GitHub

cve-report

Report CVEs fixed per release by diffing package-lock.json across version tags against OSV.dev.

605|26|Updated Sep 22, 2025
Search Tags:#release notes#Security#NPM#cve#OSV.dev#vulnerability report#package-lock.json
One-click install
npx skills add https://github.com/Doezer/Questarr --skill cve-report
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: cve-report
Source: https://github.com/Doezer/Questarr/tree/main/.claude/skills/cve-report
Command: npx skills add https://github.com/Doezer/Questarr --skill cve-report

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Maintainers need to know which security vulnerabilities were fixed in each release, but manually tracking dependency bumps and matching them to CVE databases across many version tags is tedious and error-prone.

Core Features & Use Cases

  • Automated CVE Attribution: Diffs resolved package-lock.json versions (direct and transitive dependencies) across consecutive version tags and checks OSV.dev for CVEs fixed by each bump.
  • Scoped Reporting: Groups results per version boundary, then by scope (Production/Development dependencies) and severity (CRITICAL to LOW).
  • Use Case: Before publishing release notes, run the report across all tags to document which security fixes shipped in each version, then save the output to docs/CVE-REPORT.md for human review.

Quick Start

Ask the assistant to report which CVEs were fixed in each Questarr release, or specify a version range such as from v1.2.0 to v1.3.0.

Frequently Asked Questions about cve-report

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find which CVEs were fixed in a specific release?▼

Run the cve-report script with two version tags, such as node scripts/cve-report.mjs v1.2.0 v1.3.0. It diffs the resolved package-lock.json dependencies between those tags and checks OSV.dev for vulnerabilities fixed by each version bump.

How to generate a CVE report for an entire release history?▼

Run node scripts/cve-report.mjs with no arguments. It walks every consecutive v* tag boundary plus the unreleased range from the latest tag to HEAD, producing a report grouped by version, dependency scope, and severity.

Does the CVE report cover transitive npm dependencies?▼

Yes, the script diffs both direct and transitive dependencies resolved in package-lock.json. Results are grouped by scope, separating Production and Development dependencies, then ordered by severity from CRITICAL to LOW.

What vulnerability database does the CVE report use?▼

The report uses OSV.dev as the source of truth for CVE data. The skill instructions explicitly prohibit adding or inferring CVE claims beyond what the script prints from OSV.dev results.

Why does the CVE report script fail with a network error?▼

Failures occur when OSV.dev is unreachable or when a git ref lacks a package-lock.json file. The skill directs the assistant to report the specific error to the user rather than retrying blindly or guessing at results.

Related Skills

Explore More Software Engineering Skills→
deinsoftwaredeinsoftware
125

swpm-release

Bump SWPM versions in package.json and update CHANGELOG.md from commits.

Official
Advanced
cobusgreylingcobusgreyling
10.8k

draft-release-notes

Converts changelog-scan output into a categorized release notes draft.

Community
Basic
bordenetbordenet
8

security-upgrade

Scan project dependencies for known vulnerabilities and upgrade affected packages.

Community
Advanced
forcedotcomforcedotcom
1.0k

dependabot-alerts

Triage GitHub Dependabot security alerts into GUS work items for dependency bumps.

Official
Advanced