Fix the CLI's hardcoded version string — it doesn't match package.json

[grantfox-oss]

cli/open-audit-cli.ts hardcodes .version("1.0.0"). package.json's actual version field is "0.1.0". These are already out of sync today — running open-audit-cli --version reports a release that doesn't exist.

Scope: Read the version from package.json at build/run time instead of hardcoding it (e.g. importing the package.json version field, or injecting it at build time — whichever fits this project's existing build setup for the CLI).

Acceptance criteria:

open-audit-cli --version reports the same version as package.json
Bumping package.json's version updates the CLI's reported version with no other code change

[anisayakmitra-in]

I’ll take this. The CLI build already enables JSON module resolution, so I’ll source the Commander version from package.json and verify the compiled CLI reports it.

[angelraph]

I’d like to take on #426.

I’ve looked through the issue and the fix is straightforward. The CLI currently has its version hardcoded to 1.0.0 while package.json is at 0.1.0, which can easily cause the CLI and package metadata to drift apart.

My plan is to remove the hardcoded version and source it directly from the package metadata using the project’s existing TypeScript/build setup. I’ll keep the change limited to the CLI version handling, then verify the compiled CLI reports the same version as package.json and that changing the package version automatically updates open-audit-cli --version.

I’ll also run the existing checks and make sure there’s no unnecessary change to the CLI behavior or build configuration.

I’m happy to keep the PR small, focused, and easy to review.

[grantfox-oss]

🦊 GrantFox — @angelraph has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #426)
2. Your PR will be reviewed by the Open-audit-foundation maintainers

Good luck! Track your progress on GrantFox.

[angelraph]

Heads up for maintainers: there are now two independent, working fixes open for this issue — #430 and #437. Both take the same approach (import the version from package.json instead of hardcoding it) and both verify against the acceptance criteria. Flagging so you can pick one to merge and close the other, rather than duplicating review effort. Happy to close #437 in favor of #430 (or vice versa) — whichever you prefer.

[angelraph]

@Osuochasam could you take a look when you get a chance? There are two open PRs for this issue — #430 and #437 — both correctly fixing the hardcoded CLI version. Would appreciate a decision on which to merge so we can close out the duplicate.

[angelraph]

@Osuochasam following up — this has been open almost a day with no maintainer response. Two working, mergeable PRs (#430, #437) are both blocked on a decision. Can you pick one to merge today? Happy to close mine (#437) immediately if you go with #430 — just need a call so this stops sitting idle.

[angelraph]

@Osuochasam kindly check case #437 from issue #426 its long overdue