release: v1.41.4

CHANGELOG.md

@@ -4,6 +4,14 @@ All notable changes to CVE Lite CLI will be documented in this file.
 
 ## [Unreleased]
 
+## [1.41.4] - 2026-11-13
+
+> **Upgrade note.** This release contains one security fix and nothing else.
+
+### Security
+
+- A package name that looks like a command-line option, such as an npm alias named `--registry=https://...` or `--ignore-scripts=false`, is no longer put into a printed fix command or run by `--fix`. Since 1.41.0 such an alias is scanned under the real package it points at, so it could produce a finding whose fix command the package manager read as a setting, for example pointing `npm install` at another registry. The finding is now listed as skipped with the reason (GHSA-5583-5qpr-q69x). Reported and fixed by @S3DFX-CYBER.
+
 ## [1.41.3] - 2026-11-13
 
 > **Upgrade note.** This release contains one security fix and nothing else.

package.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.41.3",
+  "version": "1.41.4",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {

website/docusaurus.config.ts

@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.41.3';
+const latestVersion = 'v1.41.4';
 
 const config: Config = {
   title: 'CVE Lite CLI',