iiinova — where your digital self keeps evolving

Sonu Kapoor @sonukapoor.bsky.social · 04/09/2026

CVE Lite CLI opened a security fix PR on its own repo while I was sleeping. Found CVE-2026-45820 in fflate 0.8.2, validated that 0.8.3 was clean, and opened the PR automatically. Findings before: 2. After: 0 No alert fatigue. No manual triage. The tool just handled it. github.com/OWASP/cve-li...

github.com

[CVE-Lite-CLI] fix: upgrade fflate (1 vulnerability resolved) by github-actions[bot] · Pull Request #1073 · OWASP/cve-lite-cli

Automated security fixes applied by CVE Lite CLI, an OWASP Lab Project for JS/TS dependency vulnerability scanning. Fixed packages fflate: 0.8.2 -> 0.8.3 (CVE-2026-45820, GHSA-px8p-9vwx-vf98) ...

020

Sonu Kapoor @sonukapoor.bsky.social · 11/08/2026

v1.29.0 of CVE Lite CLI fixes a real correctness bug: transitive dependencies reached only through a workspace's own deps or a peer dep were wrongly showing "No parent identified" - even when a real parent chain existed. Now attributed correctly everywhere. github.com/OWASP/cve-li...

github.com

Release v1.29.0 - Parent-dependency attribution fixes and multi-folder scan improvements · OWASP/cve-lite-cli

Added Honor --usage/--only-used in multi-folder scans - previously accepted (and exposed in the GitHub Action) but silently ignored outside single-folder mode; each subfolder now gets its own sour...

010

Sonu Kapoor @sonukapoor.bsky.social · 30/07/2026

AI security doesn’t need another checklist. It needs repeatable evidence. When an agent crosses a trust boundary, leaks data, or misuses a tool, that failure should become a security regression test. My latest InfoWorld article: www.infoworld.com/article/4203...

infoworld.com

AI agents need security regression testing, not another checklist

In traditional software engineering, serious bugs become regression tests. We should apply the same rigorous approach to agent security.

030

Sonu Kapoor @sonukapoor.bsky.social · 26/07/2026

Most scanners tell you to "upgrade the parent" to fix a transitive CVE, even when the newer parent still pulls the vulnerable version. CVE Lite CLI v1.28.0 (OWASP) now verifies the fix actually resolves the CVE first. github.com/OWASP/cve-li...

github.com

Release v1.28.0 - Honest remediation and maintenance risk detection · OWASP/cve-lite-cli

Added Cooldown-aware fix resolver: warns when a recommended fix version is newer than the project's configured release cooldown (npm min-release-age, pnpm minimumReleaseAge, yarn npmMinimalAgeGate...

010

Sonu Kapoor @sonukapoor.bsky.social · 20/07/2026

Every install is a trust decision. We catch bad dependencies in CI. By then the package is in and the decision is made. The scanner just confirms what you shipped. Node.js security is won or lost before CI runs. www.infoworld.com/article/4194...

infoworld.com

Node.js security starts before CI

Modern JavaScript teams do not just need more vulnerability reports. They need dependency decisions that developers can understand before risky code becomes part of the application.

111

Sonu Kapoor @sonukapoor.bsky.social · 20/07/2026

A dependency can pass every CVE check and still be one of the riskiest things in your tree. Abandonware pinning a transitive dep below its fix. No advisory, so scanners stay quiet. No newer version, so bots can't help. The gap I'm closing next in CVE Lite CLI (OWASP Lab Project). More soon ...

010

Sonu Kapoor @sonukapoor.bsky.social · 17/07/2026

CVE Lite CLI was accepted into Anthropic's Claude for Open Source Program. OWASP Lab Project. 25k+ npm downloads since March. Adopted by teams across government, enterprise, and open source. One more external validator for the work. github.com/OWASP/cve-lite-cli

000

Sonu Kapoor @sonukapoor.bsky.social · 16/07/2026

The problem with CI-based dependency scanning isn't the scanner - it's the handoff. By the time a CVE shows up in your pipeline, context is gone. You approve the PR and move on. Wrote about shifting this left for InfoWorld: www.infoworld.com/article/4194...

infoworld.com

Node.js security starts before CI

Modern JavaScript teams do not just need more vulnerability reports. They need dependency decisions that developers can understand before risky code becomes part of the application.

000

Sonu Kapoor @sonukapoor.bsky.social · 09/06/2026

Hey all - would love a quick API review from Angular eyes. Formisch is a schema-first, headless form library. We just added an Angular adapter, and we want to make sure the API feels genuinely Angular-native before it ships. The full PR is here: github.com/open-circle/...

github.com

Add @formisch/angular package with playground by fabian-hiller · Pull Request #124 · open-circle/formisch

Implements the full Angular framework package for Formisch (@formisch/angular): types, injectForm / injectField / injectFieldArray, the FormischForm / FormischField / FormischFieldArray components,...

033

Reposted by Sonu Kapoor

Angular @angular.dev · 08/06/2026

For over a decade, Lance has been a staple in the Angular world 🏗️ His favorite evolution? Signals. They’ve fundamentally improved how we write templates, components, and services across the board. See what Lance is building: github.com/lmfinney 💻

163

Sonu Kapoor @sonukapoor.bsky.social · 04/06/2026

ReversingLabs just published a piece on CVE Lite CLI - with perspectives from security leaders at Bugcrowd, Black Duck, Contrast Security, and SOCRadar on why developer-time scanning matters. reversinglabs.com/blog/cve-lit... #DevSecOps #OWASP #OpenSource #SupplyChainSecurity

reversinglabs.com

Dependency remediation bolstered with CVE Lite CLI | RL Blog

OWASP’s dependency scanner gives developers actionable fixes. But today's supply chain attacks aren’t in any advisory database.

120

Sonu Kapoor @sonukapoor.bsky.social · 04/06/2026

Do you really understand how to fix CVEs? npm install is not always the right answer. We just published a visual breakdown with dependency tree diagrams and real examples. owasp.org/cve-lite-cli/docs/how-remediation-works #javascript #security #opensource

owasp.org

020

Reposted by Sonu Kapoor

Angular @angular.dev · 01/06/2026

With v22 release coming soon, we need the perfect vibe 🌍 If you were in charge of the playlist for an Angular launch event, what’s the one track that must be on it? Perhaps Angular's original music? youtu.be/fpQj0i8Fnxs?... Drop your song suggestions below & let's build the ultimate playlist 🎶

youtu.be

Code and Chill with Angular OST (Original Soundtrack)

YouTube video by Angular

031

Reposted by Sonu Kapoor

Duncan Faulkner @duncanfaulkner.bsky.social · 23/07/2025

New release of @ngbracket/ngx-layout, this version now supports v20 Angular, library is now standalone, new demo site and updated docs demo: ngx-layout.ngbracket.com dos docs.ngx-layout.ngbracket.com BIG thanks to @sonukapoor.bsky.social and Lars Gyrup Brink Nielsen @angular-community.bsky.social

ngx-layout.ngbracket.com

@ngbracket/ngx-layout

022

Reposted by Sonu Kapoor

Angular @angular.dev · 10/09/2025

Let's celebrate an Angular community hero! 🎉 Sonu Kapoor has been a part of the Angular community for over 10 years. His work includes co-authoring Angular's Typed Forms RFC, two books 📚 and many more. Join him and other experts. Learn to contribute: 🔗 developers.google.com/community/ex...

Years active in the community - +10 years
Favourite Angular Feature - My favorite Angular feature is Signals. They fundamentally change the way we think about reactivity by making state updates predictable, debuggable, and intuitive. With Signals, Angular now provides a simpler mental model for state management, reducing boilerplate and eliminating common RxJS pitfalls. This unlocks new possibilities for building scalable applications with cleaner, more maintainable code.
Website - https://github.com/sonukapoor
Fun fact - I once built a personal tech blog that unexpectedly grew into a global developer hub, serving over 33 million views. That experience taught me the power of sharing knowledge openly; it can impact more people than you ever imagine.

181

Reposted by Sonu Kapoor

Fabian Hiller @fabianhiller.com · 20/05/2026

Formisch is now in the official shadcn/ui forms docs ⚡️ Schema-first, fully type-safe, headless. Works with Valibot out of the box — no resolver, the schema is the source of truth. If you're building forms in @react.dev with @shadcn.com, give it a try: ui.shadcn.com/docs/forms/f...

ui.shadcn.com

Formisch

Build forms in React using Formisch and Valibot.

2161

Reposted by Sonu Kapoor

OWASP® Foundation @owasp.org · 29/04/2026

OWASP spotlights CVE Lite CLI — a lightweight tool for JS/TS dependency scanning. Runs locally, highlights real risks, and shows what to fix. Designed to make security part of the dev workflow, not just CI. owasp.org/cve-lite-cli/

081

Reposted by Sonu Kapoor

Brandon Roberts @brandonroberts.dev · 18/11/2024

I worked with Mike before and he would be a great addition to any team doing Angular! 👇

0124

Reposted by Sonu Kapoor

Brandon Roberts @brandonroberts.dev · 19/11/2024

A new starter pack created by @michael-hladky.bsky.social for the Web Performance community! bsky.app/starter-pack...

1145