@conterra/vuln-scan 0.0.34 → 0.0.35

package/README.md

@@ -49,6 +49,9 @@ After that you have following commands available:
 - `ct-vuln-remove-project`
   - Removes a project from the configuration file and all vex statements related to the project.
   - Or removes a project from all vex statements matching a given vulnerability id.
+- `ct-vuln-add-project-to-vex`
+  - Update vex files to include a new project version. The project is added to each vex file that references the existing project version given.
+  - This step is already included in the `ct-vuln-add-project` command, but it can be run separately to update the vex files for an already existing project entry in the configuration file.
 
 ### Vulnerability scan
 
@@ -457,6 +460,22 @@ $ ct-vuln-remove-project mapapps 4.18.2-SNAPSHOT CVE-2024-38820
 This will remove the product-id from all vex statements matching the given vulnerability.
 This is useful if a vulnerability is no longer detected for a project and you like to remove an existing statement.
 
+## Usage - Add project to vex
+Adds a new project version to all vex statements matching a reference project version.
+This step is already included in the `ct-vuln-add-project` command, but it can be run separately to update the vex files for an already existing project entry in the configuration file.
+
+To update vex files to include a new project version, run:
+
+```sh
+$ ct-vuln-add-project-to-vex <existingPurl> <newPurl>
+```
+
+for example:
+
+```sh
+$ ct-vuln-add-project-to-vex pkg:maven/de.conterra.mapapps/ct-mapapps@4.19.0 pkg:maven/de.conterra.mapapps/ct-mapapps@4.19.1
+```
+
 ## Usage - Simulate a version release with preparation of the next dev version
 
 By combining the `ct-vuln-add-project` and `ct-vuln-remove-project` commands, you can simulate a version release.