vexa-sca 1.3.5 โ†’ 1.3.6

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +7 -7
  2. package/bin/vexa-sca.js +1 -1
  3. package/package.json +1 -1
package/README.md CHANGED
@@ -1,6 +1,6 @@
1
1
  # Vexa SCA: Enterprise-Grade Software Composition Analysis & Security Engine
2
2
 
3
- [![Release](https://img.shields.io/badge/Release-v1.3.5%20Tier%201%20GA-brightgreen.svg?logo=github)](https://github.com/noviqtechnologies/vexa-sca/releases)
3
+ [![Release](https://img.shields.io/badge/Release-v1.3.6%20Tier%201%20GA-brightgreen.svg?logo=github)](https://github.com/noviqtechnologies/vexa-sca/releases)
4
4
  [![Build Status](https://img.shields.io/badge/Build-Passing-brightgreen.svg?logo=githubactions)](https://github.com/noviqtechnologies/vexa-sca/actions)
5
5
  [![Tests](https://img.shields.io/badge/Tests-211%20Passing-success.svg)](#automated-tests--verification)
6
6
  [![License](https://img.shields.io/badge/License-Apache--2.0-blue.svg)](LICENSE)
@@ -33,8 +33,8 @@
33
33
 
34
34
  | Key Feature | Security & Developer Value | Quick Command |
35
35
  | :--- | :--- | :--- |
36
- | ๐Ÿ” [**Repository Usage Signals**](#1-repository-usage-signal-analysis) | Classifies dependencies as `IMPORTED_SOURCE`, `REFERENCED_CONFIG_OR_SCRIPT`, or `NO_REFERENCE_FOUND_WITHIN_SCOPE` to highlight top-priority findings without suppressing unverified risks. | `vexa-sca scan` |
37
- | โšก [**Pure Rust Core & Cross-Platform**](#cross-platform-installation--setup) | High-throughput multi-threaded analysis with **zero external C / OpenSSL runtime dependencies**. Native single binaries for Linux, macOS & Windows. | `vexa-sca scan` |
36
+ | ๐Ÿ” [**Repository Usage Signals**](#1-repository-usage-signal-analysis) | Classifies dependencies as `IMPORTED_SOURCE`, `REFERENCED_CONFIG_OR_SCRIPT`, or `NO_REFERENCE_FOUND_WITHIN_SCOPE`, extracts vulnerable symbols directly from advisory text (`infer_functions_from_details`), and preserves conservative `NoSymbolData` (`Unknown`) verdicts when symbol mappings are unavailable. | `vexa-sca scan` |
37
+ | โšก [**Pure Rust Core & Cross-Platform**](#cross-platform-installation--setup) | High-throughput multi-threaded analysis with **zero external C / OpenSSL runtime dependencies** and atomic cross-OS cache persistence (`.sca-cache`). Native single binaries for Linux, macOS & Windows. | `vexa-sca scan` |
38
38
  | ๐Ÿ”„ [**PR-Differential Scanning**](#pr-differential-scanning---baseline) | Compares PR findings against a baseline report (`--baseline`). Blocks only on newly introduced vulnerabilities while reporting baseline findings as non-blocking. | `vexa-sca scan --baseline base.json --fail-on high` |
39
39
  | ๐Ÿค– [**GitHub Actions Native CI/CD**](#two-operational-profiles-scan-vs-ci) | Generates rich GitHub Job Summaries (`$GITHUB_STEP_SUMMARY`) and annotations that succeed even under restricted read-only tokens (Dependabot/Fork PRs). | `vexa-sca ci --fail-on high` |
40
40
  | ๐Ÿš€ [**1-Command Workflow Setup**](#github-actions-initialization-vexa-sca-init) | Bootstrap pinned GitHub Actions CI workflow in `.github/workflows/vexa-sca.yml` with immutable commit SHA action references. | `vexa-sca init --enforce` |
@@ -45,7 +45,7 @@
45
45
  | ๐Ÿ“ˆ [**EPSS Exploit Prediction**](#epss-exploit-prediction-likelihood) | Prioritizes CVEs by real-world 30-day exploit likelihood (FIRST.org EPSS) with fail-closed retention during upstream outages. | `vexa-sca scan --epss-threshold 0.50` |
46
46
  | ๐Ÿšจ [**CISA KEV Integration**](#9-supply-chain-behavioral-analysis) | Flags CVEs confirmed exploited in the wild via the CISA Known Exploited Vulnerabilities catalog (cached, 24h TTL, +35 priority score boost). | `vexa-sca scan` |
47
47
  | ๐Ÿ”ฌ [**Supply Chain Behavioral Analysis**](#9-supply-chain-behavioral-analysis) | 15 static-analysis rules (SC-001โ€“SC-015) detecting typosquatting, CI/CD poisoning, secrets, reverse shells, and MCP prompt-injection in manifests and workflows. | `vexa-sca scan` |
48
- | ๐Ÿงช [**Zero-Code-Sync CI SAST & Secret Detection**](#12-zero-code-sync-ci-sast--secret-detection) | Local fast sink analysis (`CWE-78` OS Command Injection, `CWE-89` SQLi, `CWE-94` Eval, `CWE-502` Deserialization, etc.) + redacted Secret Scanning (`AKIA****`) + SARIF v2.1.0 ingestion, working even in lockfile-less repositories. | `npx vexa-sca scan --sast --secrets` |
48
+ | ๐Ÿงช [**Zero-Code-Sync CI SAST & Secret Detection**](#12-zero-code-sync-ci-sast--secret-detection) | Local fast sink & intra-procedural multi-line taint analysis (`CWE-78` OS Command Injection, `CWE-89` multi-line SQLi / Python f-strings, `CWE-22` Path Traversal, `CWE-918` SSRF, `CWE-94` Eval, `CWE-502` Deserialization) + redacted Secret Scanning (`AKIA****`) + SARIF v2.1.0 ingestion, working even in lockfile-less repositories. | `npx vexa-sca scan --sast --secrets` |
49
49
  | ๐Ÿ”ฅ [**Package Manager Firewall (`wrap`)**](#10-package-manager-firewall-wrap) | Pre-installation zero-shell security gate for npm, pnpm, yarn, bun, pip, uv, and cargo. Blocks typosquatted packages, CISA KEV hits, and OSV advisories before install. | `vexa-sca wrap npm install lodash` |
50
50
  | ๐Ÿค– [**MCP Server (`mcp`)**](#11-mcp-server-integration-mcp) | JSON-RPC 2.0 MCP server exposing 4 tools to AI coding assistants (Cursor, Claude Code, Windsurf, GitHub Copilot). | `vexa-sca mcp` |
51
51
  | ๐Ÿ“ค [**Zero-Code-Retention Facts Export (v2.0)**](#1-vexa-sca-scan) | Generates `.vexa.facts.json` (schema `2.0`) with dependency graph, AST reachability, and stripped SAST/Secret metadata (`file_path`, `line`, `cwe`, canonical `matched_sink` โ‰ค64 chars)โ€”**zero raw source code ever leaves your machine**. | `vexa-sca scan --upload-facts` |
@@ -60,7 +60,7 @@
60
60
  > ```bash
61
61
  > git clone https://github.com/noviqtechnologies/vexa-sca.git
62
62
  > cd vexa-sca
63
- > git checkout v1.3.5
63
+ > git checkout v1.3.6
64
64
  > cargo build --locked --release
65
65
  > ```
66
66
  >
@@ -244,8 +244,8 @@ Download prebuilt archives and cosign attestations directly from [GitHub Release
244
244
  ### Building from Source
245
245
 
246
246
  ```bash
247
- # Clone the repository at the v1.3.5 release tag
248
- git clone --branch v1.3.5 --depth 1 https://github.com/noviqtechnologies/vexa-sca.git
247
+ # Clone the repository at the v1.3.6 release tag
248
+ git clone --branch v1.3.6 --depth 1 https://github.com/noviqtechnologies/vexa-sca.git
249
249
  cd vexa-sca
250
250
 
251
251
  # Compile release binaries with locked dependencies
package/bin/vexa-sca.js CHANGED
@@ -91,7 +91,7 @@ if (!cmd) {
91
91
 
92
92
  // 4.5. Auto-download prebuilt GitHub release binary if Cargo.toml is not present (e.g. `npx vexa-sca`)
93
93
  if (!cmd && !fs.existsSync(path.join(rootDir, 'Cargo.toml'))) {
94
- const pkgVersion = require('../package.json').version || '1.3.5';
94
+ const pkgVersion = require('../package.json').version || '1.3.6';
95
95
  const tag = `v${pkgVersion}`;
96
96
  const cacheDir = path.join(os.homedir(), '.vexa', 'bin');
97
97
  const cachedBin = path.join(cacheDir, `vexa-sca${binExt}`);
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "vexa-sca",
3
- "version": "1.3.5",
3
+ "version": "1.3.6",
4
4
  "description": "Vexa SCA - Software Composition Analysis & Security Engine (High-Performance Rust Core)",
5
5
  "homepage": "https://vexasec.io/sca",
6
6
  "repository": {