Quickstart: find what affects your release

In about five minutes you find out which vulnerabilities affect a shipped release and which dependency updates the next release must carry.

Prerequisites

  • The Vulnlog CLI is installed (see Install Vulnlog).

  • A Vulnlog file. To follow along without one, save the example file below as acme-web-app.vl.yaml. It tracks the Acme Web App with two published releases (1.0.0, 1.1.0) and one unpublished release (1.2.0).

acme-web-app.vl.yaml 
# $schema: https://vulnlog.dev/schema/vulnlog-v1.json
---
schemaVersion: "1"

project:
  organization: Acme Corp
  name: Acme Web App
  author: Acme Corp Security Team

releases:
  - id: 1.0.0
    published_at: 2026-01-15
  - id: 1.1.0
    published_at: 2026-03-20
  - id: 1.2.0

vulnerabilities:

  - id: CVE-2026-8802
    releases: [1.1.0]
    packages: ["pkg:npm/session-store@1.4.0"]
    reports:
      - reporter: trivy
        at: 2026-07-01

  - id: CVE-2026-7791
    description: SQL injection in query-parser
    releases: [1.1.0]
    packages: ["pkg:npm/query-parser@5.2.1"]
    reports:
      - reporter: trivy
        at: 2026-05-15
    analysis: >-
      Confirmed exploitable through the search endpoint. Crafted filter expressions reach the vulnerable parser.
    analyzed_at: 2026-05-16
    verdict: affected
    severity: high
    resolution:
      in: 1.2.0
      at: 2026-06-20
      ref: "https://jira.example.com/browse/SEC-201"
      note: Updated query-parser from 5.2.1 to 5.3.0

  - id: CVE-2026-6685
    description: Denial of service in thumbnail-gen
    aliases: [SNYK-JS-THUMBNAILGEN-2984765]
    releases: [1.0.0]
    packages: ["pkg:npm/thumbnail-gen@2.0.0"]
    reports:
      - reporter: trivy
        at: 2026-04-02
        suppress: {}
    analysis: >-
      Confirmed but only exploitable with specially crafted image dimensions that the upload validation layer rejects.
    analyzed_at: 2026-04-03
    verdict: risk acceptable
    severity: low
    comment: Risk accepted by project lead. Revisit when thumbnail-gen 3.0 is released.

  - id: CVE-2026-1234
    description: Remote code execution in example-lib
    releases: [1.0.0]
    packages: ["pkg:npm/example-lib@2.3.0"]
    reports:
      - reporter: trivy
        at: 2026-02-01
    analysis: >-
      The vulnerable code path is not reachable in our application because we only use the safe subset of the API.
    analyzed_at: 2026-02-02
    verdict: not affected
    justification: vulnerable code not in execute path

  - id: CVE-2025-9876
    description: Authentication bypass in auth-middleware
    releases: [1.0.0]
    packages: ["pkg:npm/auth-middleware@3.0.2"]
    reports:
      - reporter: trivy
        at: 2026-01-20
    analysis: Confirmed. The bypass affects every session-authenticated route.
    analyzed_at: 2026-01-21
    verdict: affected
    severity: critical
    resolution:
      in: 1.1.0
      at: 2026-03-18
      ref: "https://jira.example.com/browse/SEC-158"
      note: Updated auth-middleware from 3.0.2 to 3.1.0

Step 1: Generate the release-scoped report

You maintain release 1.1.0 and plan the next release. Scope the report to what actually ships in 1.1.0:

vulnlog report acme-web-app.vl.yaml --release 1.1.0 -o release-1.1.0.html
Wrote: release-1.1.0.html

With --release, a recorded fix only counts when its target release shipped at or before 1.1.0. A fix that is merged but not yet released does not protect anyone running 1.1.0, and the report reflects that.

Step 2: Read the open entries

Open release-1.1.0.html. The entry table is sorted by state, open entries first:

  • CVE-2026-7791 is open with severity high. Its fix is already recorded for release 1.2.0, but 1.2.0 has not shipped, so every 1.1.0 installation still runs the vulnerable query-parser 5.2.1. Shipping 1.2.0 with query-parser 5.3.0 is the update your next release must carry.

  • CVE-2026-8802 is under investigation. Triage has not concluded, so its impact on the release is unknown; it needs a verdict before the release decision.

The dismissed entries need no action: their verdicts (not affected, risk acceptable) closed them without remediation.

Step 3: Compare with the maintainer view

Generate the same report without the release filter:

vulnlog report acme-web-app.vl.yaml
Wrote: vulnlog-report.html

Here CVE-2026-7791 shows as resolved with 1.2.0 in the Fixed In column: from the maintainer’s perspective the triage work is done. The release-scoped view and the maintainer view answer different questions; use --release whenever the question is "what does a user of this release face?".

What you did

You used the release filter of vulnlog report to separate fixes that shipped from fixes that are only recorded, and read the update list for the next release straight from the open entries. How states derive from verdict and resolution is defined in Vulnerability states.

Next steps