Dependency security scan results + actionable upgrade path (OWASP project)

I ran a dependency scan on lint-staged while looking at tools used in pre-commit workflows.

For context, I’m the maintainer of an OWASP-adopted CLI called [CVE Lite CLI](https://github.com/OWASP/cve-lite-cli). It scans lockfiles locally and focuses on surfacing actionable fixes rather than just listing advisories.

The CLI uses the existing `package-lock.json`, so no setup or API keys are needed.

What stood out:

* 3 findings in total
* includes a **high-severity issue in a direct dependency**
* a clear and simple fix is available

The tool was able to derive a concrete fix:

```bash
npm install picomatch@2.3.2
```

Details:

* `picomatch@2.3.1` has a high-severity ReDoS-related vulnerability
* upgrading to `2.3.2` resolves the issue
* the rest of the findings are transitive and lower priority

I also noticed that Dependabot and other security workflows are already in place, which is great. This isn’t meant as a replacement, more a complementary observation that a local scan still surfaces a small, actionable fix at commit time.

Since lint-staged already runs checks before commits, this felt like a natural place where a lightweight dependency check could fit into the same workflow.

CVE Lite CLI also has a [GitHub Action](https://github.com/marketplace/actions/cve-lite-cli), so this kind of scan can run locally during development or in CI as a lightweight dependency security check.

For reference, here’s a snapshot of the report view highlighting the findings and suggested fix paths:

<img width="1728" height="693" alt="Image" src="https://github.com/user-attachments/assets/e42ac09c-18b9-4926-8337-454b9e7a7fa3" />

Not raising this as a strict issue - more sharing the result and approach.

Happy to share more details if useful.

[]