Dependency security scan results + actionable upgrade path (OWASP project)

I ran a dependency scan on Commitizen while looking at tools that are commonly used in developer and release workflows.

For context, I’m the maintainer of an OWASP-adopted CLI called [CVE Lite CLI](https://github.com/OWASP/cve-lite-cli). It focuses on scanning lockfiles locally and surfacing actionable fixes rather than just listing advisories.

The CLI uses the existing `package-lock.json`, so no setup or API keys are needed.

What stood out:

* 48 findings in total
* includes critical and multiple high severity issues
* some vulnerabilities are in **direct dependencies**, not just transitive ones
* a few issues have clear upgrade paths, others are harder to resolve

The tool was able to suggest a concrete fix plan:

```bash
npm install minimist@1.2.6 lodash@4.18.0 semver@7.5.2 @octokit/request@5.6.3 npm@10.9.6 @babel/traverse@7.23.6
```

A couple of examples:

* `minimist@1.2.5` has a **critical vulnerability**, fix available at `1.2.6`
* `lodash@4.17.21` requires upgrading beyond the advisory hint (validated safe version is `4.18.0`)
* `semver` shows up in multiple vulnerable versions across the tree

One thing I found interesting is that advisory “fixed versions” are not always reliable. In a few cases, versions marked as fixed were still vulnerable, so the safe upgrade required additional validation.

CVE Lite CLI also has a [GitHub Action](https://github.com/marketplace/actions/cve-lite-cli), so this kind of scan can run locally during development or in CI as a lightweight dependency security check.

I’m not raising this as a strict issue to fix everything, more sharing the findings and the approach. Since `Commitizen` is used directly in developer workflows, this felt like a useful data point.

For reference, here’s a snapshot of the report view highlighting the findings and suggested fix paths:

Curious how you currently think about dependency security here, whether this kind of pre-release/local check would be useful alongside existing tooling.

Happy to share more details if helpful.

Bắt đầu bằng việc xem xét package-lock.json và các phát hiện về dependency được liệt kê, bao gồm lệnh upgrade được đề xuất và các phiên bản dễ bị tấn công. Issue không xác định thay đổi mã cụ thể hay tiêu chí chấp nhận; issue chỉ hoàn tất sau khi các maintainer quyết định có thực hiện các upgrade hay áp dụng một lần quét cục bộ hoặc CI hay không.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.