release: v1.24.0 (#699)

Author: sonukapoor

CHANGELOG.md

@@ -4,6 +4,21 @@ All notable changes to CVE Lite CLI will be documented in this file.
 
 ## [Unreleased]
 
+## [1.24.0] - 2026-06-17
+
+### Added
+- `--sarif` can now be combined with `--report` to write both a SARIF file and an HTML report in one scan; useful for CI pipelines that upload to GitHub Code Scanning and also attach an HTML artifact for human review (#681)
+
+### Fixed
+- Fix commands now include `-D` flag for dev dependencies (`npm install -D`, `pnpm add -D`, `yarn add -D`, `bun add --dev`); mixed dev/prod batches split into separate commands (#689, #690)
+- GitHub Action now installs cve-lite-cli via `npm install --prefix` and appends the bin dir to `$GITHUB_PATH`, fixing `cve-lite: not found` errors on npm 10.x runners where npx cannot resolve a binary name different from the package name (#691, #692)
+
+### Changed
+- Upgrade jest to 30.4.1; add `.cve-lite/baseline.json` to suppress unfixable `js-yaml@3.14.2` transitive dev dep (GHSA-h67p-54hq-rp68) (#693, #694)
+
+### Docs
+- Socket CLI comparison expanded with structured sections and concrete examples (#655)
+
 ## [1.23.1] - 2026-06-15
 
 ### Performance

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.23.1",
+  "version": "1.24.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {

package.json

@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.23.1';
+const latestVersion = 'v1.24.0';
 
 const config: Config = {
   title: 'CVE Lite CLI',