AI security doesn’t need another checklist. It needs repeatable evidence. When an agent crosses a trust boundary, leaks data, or misuses a tool, that failure should become a security regression test. My latest InfoWorld article: www.infoworld.com/article/4203...

AI agents need security regression testing, not another checklist

In traditional software engineering, serious bugs become regression tests. We should apply the same rigorous approach to agent security.

infoworld.com

Most scanners tell you to "upgrade the parent" to fix a transitive CVE, even when the newer parent still pulls the vulnerable version. CVE Lite CLI v1.28.0 (OWASP) now verifies the fix actually resolves the CVE first. github.com/OWASP/cve-li...

Release v1.28.0 - Honest remediation and maintenance risk detection · OWASP/cve-lite-cli

Added Cooldown-aware fix resolver: warns when a recommended fix version is newer than the project's configured release cooldown (npm min-release-age, pnpm minimumReleaseAge, yarn npmMinimalAgeGate...

github.com

Every install is a trust decision. We catch bad dependencies in CI. By then the package is in and the decision is made. The scanner just confirms what you shipped. Node.js security is won or lost before CI runs. www.infoworld.com/article/4194...

Node.js security starts before CI

Modern JavaScript teams do not just need more vulnerability reports. They need dependency decisions that developers can understand before risky code becomes part of the application.

infoworld.com

A dependency can pass every CVE check and still be one of the riskiest things in your tree. Abandonware pinning a transitive dep below its fix. No advisory, so scanners stay quiet. No newer version, so bots can't help. The gap I'm closing next in CVE Lite CLI (OWASP Lab Project). More soon ...

CVE Lite CLI was accepted into Anthropic's Claude for Open Source Program. OWASP Lab Project. 25k+ npm downloads since March. Adopted by teams across government, enterprise, and open source. One more external validator for the work. github.com/OWASP/cve-lite-cli

The problem with CI-based dependency scanning isn't the scanner - it's the handoff. By the time a CVE shows up in your pipeline, context is gone. You approve the PR and move on. Wrote about shifting this left for InfoWorld: www.infoworld.com/article/4194...

Node.js security starts before CI

Modern JavaScript teams do not just need more vulnerability reports. They need dependency decisions that developers can understand before risky code becomes part of the application.

infoworld.com

CVE Lite CLI is at 630 GitHub stars. Help us reach 700. Free, local, OWASP-recognized dependency scanner for JS/TS projects. Gives you copy-and-run fix commands, not just CVE IDs. If you've found it useful, a star goes a long way. github.com/OWASP/cve-li... #OpenSource #OWASP

Two separate French government ministries independently added CVE Lite CLI to their dev stack - without reaching out first. One blocks every push if a high-severity CVE is found. No outreach. No pitch. Just developers solving a problem. tinyurl.com/3p8rvrfa #opensource #security #owasp

GitHub - OWASP/cve-lite-cli: Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and… | Son...

Two French government ministries independently integrated CVE Lite CLI into their production repos - without any outreach from me. DINUM (Direction Interministérielle du Numérique, France's intermini...

linkedin.com

Hey all - would love a quick API review from Angular eyes. Formisch is a schema-first, headless form library. We just added an Angular adapter, and we want to make sure the API feels genuinely Angular-native before it ships. The full PR is here: github.com/open-circle/...

Add @formisch/angular package with playground by fabian-hiller · Pull Request #124 · open-circle/formisch

Implements the full Angular framework package for Formisch (@formisch/angular): types, injectForm / injectField / injectFieldArray, the FormischForm / FormischField / FormischFieldArray components,...

github.com

For over a decade, Lance has been a staple in the Angular world 🏗️ His favorite evolution? Signals. They’ve fundamentally improved how we write templates, components, and services across the board. See what Lance is building: github.com/lmfinney 💻

CVE Lite CLI is at 447 GitHub stars. Help us reach 500. Free, local, OWASP-recognized dependency scanner for JS/TS projects. Gives you copy-and-run fix commands, not just CVE IDs. If you've found it useful, a star goes a long way. github.com/OWASP/cve-li... #OpenSource #OWASP

GitHub - OWASP/cve-lite-cli: Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practi...

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance. ...

github.com

@securityweek.bsky.social published an article on my CVE Lite CLI www.securityweek.com/owasp-incuba...

OWASP Incubator Project Helps Developers Find and Fix Vulnerable Dependencies in Seconds

CVE Lite CLI helps developers quickly identify and fix vulnerable npm dependencies during development, reducing delays and improving software security.

securityweek.com

CVE Lite CLI is at 322 GitHub stars. Help us reach 500. Free, local, OWASP-recognized dependency scanner for JS/TS projects. Gives you copy-and-run fix commands, not just CVE IDs. If you've found it useful, a star goes a long way. github.com/OWASP/cve-lite-cli #OpenSource #OWASP #DevSecOps

GitHub - OWASP/cve-lite-cli: Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practi...

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance. ...

github.com

ReversingLabs just published a piece on CVE Lite CLI - with perspectives from security leaders at Bugcrowd, Black Duck, Contrast Security, and SOCRadar on why developer-time scanning matters. reversinglabs.com/blog/cve-lit... #DevSecOps #OWASP #OpenSource #SupplyChainSecurity

Dependency remediation bolstered with CVE Lite CLI | RL Blog

OWASP’s dependency scanner gives developers actionable fixes. But today's supply chain attacks aren’t in any advisory database.

reversinglabs.com

Do you really understand how to fix CVEs? npm install is not always the right answer. We just published a visual breakdown with dependency tree diagrams and real examples. owasp.org/cve-lite-cli/docs/how-remediation-works #javascript #security #opensource

Checkout my lastest project: github.com/OWASP/cve-li...

GitHub - OWASP/cve-lite-cli: Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practi...

Fast, developer-friendly JS/TS dependency vulnerability scanner with local lockfile scanning, OSV matching, direct vs transitive visibility, --fix, JSON output, and practical remediation guidance. ...

github.com

With v22 release coming soon, we need the perfect vibe 🌍 If you were in charge of the playlist for an Angular launch event, what’s the one track that must be on it? Perhaps Angular's original music? youtu.be/fpQj0i8Fnxs?... Drop your song suggestions below & let's build the ultimate playlist 🎶

Code and Chill with Angular OST (Original Soundtrack)

YouTube video by Angular

youtu.be

Using CVE Lite CLI in your projects or at work? We just opened a community thread to collect real-world use cases. One sentence about where it fits in your workflow is enough. github.com/OWASP/cve-lite-cli/discussions/481

Who is using CVE Lite CLI? Share your use case · OWASP cve-lite-cli · Discussion #481

If you are using CVE Lite CLI in your projects or at your company, we would love to hear about it. Drop a comment below with: Where you use it — local dev, CI pipeline, pre-commit hook, security re...

github.com

t.co/7TrPRGUB9X

New release of @ngbracket/ngx-layout, this version now supports v20 Angular, library is now standalone, new demo site and updated docs demo: ngx-layout.ngbracket.com dos docs.ngx-layout.ngbracket.com BIG thanks to @sonukapoor.bsky.social and Lars Gyrup Brink Nielsen @angular-community.bsky.social

Let's celebrate an Angular community hero! 🎉 Sonu Kapoor has been a part of the Angular community for over 10 years. His work includes co-authoring Angular's Typed Forms RFC, two books 📚 and many more. Join him and other experts. Learn to contribute: 🔗 developers.google.com/community/ex...

Formisch will soon be available for @angular. Thank you @sonukapoor.bsky.social for leading this effort! Feel free to join the discussion if you are using Angular! github.com/open-circle/...

RFC: Angular package for Formisch - architecture design and open questions · open-circle formisch · Discussion #100

Following our conversation about adding Angular support to Formisch, I have done a deep architectural study of Formisch's internals and Angular Signals to understand how an Angular adapter would wo...

github.com

Formisch is now in the official shadcn/ui forms docs ⚡️ Schema-first, fully type-safe, headless. Works with Valibot out of the box — no resolver, the schema is the source of truth. If you're building forms in @react.dev with @shadcn.com, give it a try: ui.shadcn.com/docs/forms/f...

Formisch

Build forms in React using Formisch and Valibot.

ui.shadcn.com

OWASP spotlights CVE Lite CLI — a lightweight tool for JS/TS dependency scanning.  Runs locally, highlights real risks, and shows what to fix.   Designed to make security part of the dev workflow, not just CI. owasp.org/cve-lite-cli/

I worked with Mike before and he would be a great addition to any team doing Angular! 👇

Mike Brocchi@mikebrocchi.bsky.social · 2y ago

My time at HeroDevs has come to and end and I am in search of a new role! Looking to join a team doing Angular, if you're looking or know someone who is, please get in touch, thanks!

A new starter pack created by @michael-hladky.bsky.social for the Web Performance community! bsky.app/starter-pack...