OWASP/cve-lite-cli

This is a first-timers-only issue - reserved for someone making their first open source contribution. Comment below to claim it. What to do src/output/debug.ts exports createDebugLogger which handles debug output. It has no dedicated unit tests. Your job is to add them. Steps: Star the repo if you haven't already - it helps others discover this project and means a lot to us. Fork the repo and clone it locally. Run npm install then npm test to make sure everything passes. Create a new file tests/output/debug.test.ts. Write tests that verify: When the logger is disabled (no path given), log and logJson are no-ops that do not write to disk When enabled, calling log writes a line to the log file announcePath only writes to stderr the first time it is called (subsequent calls are silent) formatJson handles plain strings, objects, and gracefully handles values that cannot be serialized Run npm test to confirm all tests pass. Open a PR with Closes #ISSUE_NUMBER in the body. Tip: Use jes

This is a first-timers-only issue - reserved for someone making their first open source contribution. Comment below to claim it. What to do src/utils/time.ts exports a function formatAdvisoryDbFreshness that is imported but not yet tested in tests/time.test.ts. Your job is to add those tests. Steps: Star the repo if you haven't already - it helps others discover this project and means a lot to us. Fork the repo and clone it locally. Run npm install then npm test to make sure everything passes. Open tests/time.test.ts and add a new describe block for formatAdvisoryDbFreshness. Write tests that verify: null input returns "unknown" An invalid date string returns "unknown" A valid ISO date string returns a string that contains the date in parentheses Run npm test to confirm all tests pass. Open a PR with Closes #ISSUE_NUMBER in the body. This is an additive change - no new file needed, just new tests in an existing file. Happy to answer any questions along the way. Welcome! If you a

This is a first-timers-only issue - reserved for someone making their first open source contribution. Comment below to claim it. What to do src/utils/advisory.ts exports three small pure functions - isPrivateRegistrySource, isGitSource, and hasCommitShaPinning - that have no dedicated unit tests. Your job is to add them. Steps: Star the repo if you haven't already - it helps others discover this project and means a lot to us. Fork the repo and clone it locally. Run npm install then npm test to make sure everything passes. Create a new file tests/utils/advisory.test.ts. Write tests that verify each function returns true/false for the expected inputs. Each function receives an object with a resolvedUrl string - test a positive case, a negative case, and a null/undefined input. Run npm test to confirm all tests pass. Open a PR with Closes #ISSUE_NUMBER in the body. Reference: Look at tests/utils/array.test.ts for the pattern to follow. Happy to answer any questions along the way. Welco

This is a first-timers-only issue - reserved for someone making their first open source contribution. Comment below to claim it. What to do src/utils/sarif.ts exports a single function sarifFingerprintHash that has no dedicated unit tests. Your job is to add them. Steps: Star the repo if you haven't already - it helps others discover this project and means a lot to us. Fork the repo and clone it locally. Run npm install then npm test to make sure everything passes. Create a new file tests/utils/sarif.test.ts. Write tests that verify: The output is a 16-character hex string The same inputs always produce the same output (deterministic) Different inputs produce different outputs Run npm test to confirm all tests pass. Open a PR with Closes #ISSUE_NUMBER in the body. Reference: Look at tests/utils/array.test.ts for the pattern to follow. Happy to answer any questions along the way. Welcome! If you are not making your first contribution to this repo, your PR will be closed.

We want a verified case study of CVE Lite CLI on Docusaurus (Meta's documentation framework, a large pnpm monorepo with ~2,590 resolved packages). An earlier draft (PR #766, now closed) got the scan and most of the case-study structure in place but stalled before the measured-results step, so this is a good pickup for a first-time contributor. Starting point: the closed PR #766 is a useful reference for the scan output and the overall structure - you can build on it rather than starting from scratch. Use an existing study such as analog.md as the template and follow the standard case-study section order. What's needed to finish Before vs After table with measured rows (the core of the study). It needs the baseline row plus one measured row per fix-command group. Clone Docusaurus at a pinned commit, apply the first fix-command group, rescan with cve-lite . --verbose, record the row (findings / severity / direct / transitive / command groups), then apply the next group and repeat. Run g