release: v1.23.0 (#647)

Author: sonukapoor

CHANGELOG.md

@@ -4,6 +4,20 @@ All notable changes to CVE Lite CLI will be documented in this file.
 
 ## [Unreleased]
 
+## [1.23.0] - 2026-06-13
+
+### Added
+- Graded output for MAL- advisories from git sources: terminal shows `⚠ Git source (SHA-pinned)` or `⚠ Git source (floating ref)` with resolved URL; HTML report shows orange badge; `isGitSource()` and `hasCommitShaPinning()` detection functions (#618)
+- `multiple-versions-same-pkg` and `git-source-mal` example fixtures
+
+### Fixed
+- Error handling and cleanup for SARIF, CycloneDX, and HTML report file writes; pre-existing directories preserved on write failure (#628)
+- Duplicate `db.close()` call removed from osv-sync catch block that could mask original error (#629)
+
+### Performance
+- CVE detail fetches now run concurrently via `runWithConcurrency` instead of serially — 2.2x faster on cold cache for large lockfiles (#645)
+- Packument cache pre-warmed before transitive remediation loop to eliminate serial npm registry round-trips (#645)
+
 ## [1.22.0] - 2026-06-11
 
 ### Added

package-lock.json

@@ -1,6 +1,6 @@
 {
   "name": "cve-lite-cli",
-  "version": "1.22.0",
+  "version": "1.23.0",
   "description": "Developer-friendly CLI for scanning JS/TS projects for dependency vulnerabilities using local lockfiles and OSV",
   "type": "module",
   "bin": {

package.json

@@ -2,7 +2,7 @@ import {themes as prismThemes} from 'prism-react-renderer';
 import type {Config} from '@docusaurus/types';
 import type * as Preset from '@docusaurus/preset-classic';
 
-const latestVersion = 'v1.22.0';
+const latestVersion = 'v1.23.0';
 
 const config: Config = {
   title: 'CVE Lite CLI',