Public roadmap: make vibgrate/cli easy to discover, try, and contribute to

[vibgrate-team]

Why this exists

vibgrate/cli ships frequently (see Releases and the site changelog), but an empty Issues tab reads as “inactive” on places like AlternativeTo — even when the product is moving.

This issue is the public roadmap tracker. Comment to upvote or propose; we’ll open focused issues for work that is ready for contribution.

Near term (next ~30 days)

• Keep README / install path obvious for AlternativeTo and first-time visitors
• Document and demo the new --iac scanning path (Terraform, Kubernetes, Helm, Dockerfile)
• Seed a small set of good first issue / help wanted tickets (linked below as we open them)
• Improve contributor onboarding against CONTRIBUTING.md (fixtures, docs PRs, grammar work)

Mid term (~90 days)

• Deeper language / resolution coverage where fixtures are thin
• Stronger “blast radius / architecture” demos newcomers can run in minutes
• Clearer path from CLI → VS Code / MCP (vg serve) for AI coding agents
• Community-facing example repos beyond examples/github-actions

How we use this issue

• Maintainers update checkboxes and link child issues as work starts
• External ideas: open a Feature request (or comment here if you’re unsure)
• Stars help people track releases; issues and PRs are how the project actually grows

Links

• Product: https://vibgrate.com/cli
• Latest changelog: https://vibgrate.com/changelog/cli/2026.914.1
• Benchmarks: https://vibgrate.com/cli/benchmarks

[vibgrate-team]

Daily seeding batch (2026-09-17)

Announcement

• Release notes: Vibgrate CLI 2026.916.3 — maintenance cut, corpus steady #207 (Release notes: Vibgrate CLI 2026.916.3)

Issues

• Docs: document how vg scan SARIF groups advisory aliases (avoid duplicate alerts) #208
• Enhancement: surface “fix available” hints in vg scan / report human output #209
• Docs: document prod vs dev/optional dependency scope in vg sbom exports #210
• Test: add pnpm lockfile edge-case fixture (catalog / engines) for vg build #211
• Docs: clarify registry/auth failure wording for remote lookup paths (no secrets) #212
• Enhancement: include source path for license findings in machine-readable scan output #213
• Docs: document how vg sbom treats multiple versions of the same component #214
• Enhancement: keep direct dependencies without explicit version pins visible in vg scan graphs #215

[vibgrate-team]

Daily seeding batch (2026-09-18)

Announcement

• Release notes: Vibgrate CLI 2026.917.1 — architecture canvas meets findings #229 (Release notes: Vibgrate CLI 2026.917.1 — architecture canvas meets findings)

Issues (all vibgrate-team)

• Docs: document vg show arch Overview/Architecture canvas toggles (vulns, drift, ownership, churn) #230 — Docs: vg show arch canvas toggles (documentation, good first issue)
• Docs: document vg review findings-from-diff JSON contract (kind: correctness) #231 — Docs: findings-from-diff JSON / kind: correctness (documentation)
• Test: add Cargo workspace / path-dependency fixture for vg build #232 — Test: Cargo workspace / path-dep fixture (enhancement, good first issue)
• Bug: surface actionable errors when license IDs fail SPDX-style parse (no silent drop) #233 — Bug: actionable license SPDX parse errors (bug)
• Docs: document vg scan / vg build exit codes for CI gating #234 — Docs: vg scan / vg build exit codes (documentation, good first issue)
• Enhancement: lead vg report HTML with a compact summary before long finding tables #235 — Enhancement: HTML report summary-first (enhancement)
• Docs: document how Maven/Gradle profile or configuration scopes appear in vg scan graphs #236 — Docs: Maven/Gradle profile & config scopes in graphs (documentation)
• Test: add Yarn Berry (yarn.lock v2+) edge-case fixture for vg build #237 — Test: Yarn Berry fixture (enhancement, good first issue)

No help wanted on this batch. No external contributor replies needed today.

[vibgrate-team]

Daily seeding 2026-09-21 — new public issues:

• Docs: document vg why / vg bisect for vulnerability attribution #238 Docs: vg why / vg bisect vulnerability attribution (documentation, good first issue)
• Docs: document offline vg scan --vulns with --package-manifest #239 Docs: offline vg scan --vulns --package-manifest (documentation)
• Bug: surface actionable errors when CVSS/severity vectors fail to parse #240 Bug: actionable errors on CVSS/severity vector parse failures (bug)
• Enhancement: optional JUnit XML report from vg scan for CI test reporters #241 Enhancement: optional JUnit XML from vg scan for CI reporters (enhancement)
• Docs: clarify how vg scan --iac treats same-stem .tf and .tofu files #242 Docs: same-stem .tf / .tofu under vg scan --iac (documentation)
• Test: add Go module workspace (go.work) fixture for vg build #243 Test: Go go.work workspace fixture for vg build (enhancement, good first issue)
• Docs: document vg evidence exposure CI exit semantics #244 Docs: vg evidence exposure CI exit semantics (documentation, good first issue)
• Enhancement: keep advisory-corpus metadata compact in vg report HTML footer #245 Enhancement: compact advisory-corpus metadata in vg report HTML footer (enhancement)

Themes rewritten from adjacent SCA/SBOM CLI issue spaces (syft/trivy/grype/osv-scanner/dependency-check) into Vibgrate-specific docs/tests/bugs — no copy-paste titles. Mix stays documentation / enhancement / bug; good first only where newcomer-scoped; no new help wanted.

Toward the ~200 public-issue discovery goal on the roadmap.