feat: show fix version publish date in output to support minimum release age policies

[sonukapoor]

When CVE Lite CLI recommends a fix version, it currently shows the version number but not when that version was published. This makes it impossible to evaluate whether the fix version is "fresh" (potentially risky from a supply chain perspective) or well-established.

Proposed change

Show the npm publish date of the recommended fix version alongside the version number in terminal output and HTML report. For example:

fix: npm install lodash@4.17.21   (published 2021-02-20, 4 years ago)

Motivation

Teams using minimum release age policies (e.g. rejecting packages published less than N days ago to mitigate supply chain attacks) currently have no way to act on CVE Lite CLI's fix suggestions without manually checking npm. Surfacing the publish date lets them make a severity-based decision inline:

• CRITICAL/HIGH CVE + young fix version: weigh exploit risk vs supply chain risk
• LOW/MEDIUM CVE + young fix version: bypass the pre-commit hook and wait for the fix to age

This was surfaced by a DINUM (French government) user running CVE Lite CLI with a pre-commit hook and a minimum release age policy.

[coder-Yash886]

@sonukapoor i am looking to work on this issue

[sonukapoor]

Hi @coder-Yash886 - happy to have you work on this! Here's the implementation path:

Data source

The npm registry exposes per-version publish dates via:

GET https://registry.npmjs.org/<package-name>

The response has a time field which is a map of version strings to ISO timestamps:

{
  "time": {
    "1.0.0": "2021-01-15T10:30:00.000Z",
    "4.17.21": "2021-02-20T19:00:00.000Z"
  }
}

Where to add the fetch

Fix version data flows through src/osv/validate.ts. The cleanest place to attach the publish date is alongside the existing validation - once a firstFixedVersion is confirmed, fetch time[version] from the registry for that package.

Add an optional fixVersionPublishedAt?: string | null field to the Finding type in src/types.ts.

Where to display it

Store the raw ISO string and format it as YYYY-MM-DD at display time. For the stated use case (minimum release age policies), the absolute date is what matters - a developer checking whether a fix is at least 30 days old needs the actual date, not a fuzzy relative string.

fix: npm install lodash@4.17.21   (published 2021-02-20)

Touch two files:

• src/output/printers.ts - append the date to the fix command lines
• src/output/html-reporter.ts - same in the HTML report's fix command section

Caching

Reuse the existing cache infrastructure in src/osv/cache.ts rather than making a fresh registry call every scan. Key off package@version.

Edge cases to handle

• Package not on npm (private registry, workspace package) - skip silently, don't show the date
• Network error or offline mode - skip silently
• Version not in the time map - skip silently