Vulnerability watch

A published vulnerability in a package you depend on is the security problem you do not need a model to find. Somebody already found it, wrote it up and, often, fixed it. What is missing is the person who reads the feed every morning, knows which of your repositories it touches, and opens the pull request. Vulnerability watch is that person.

• Once a day, the manifests. Switch it on in a repository's settings under Connections, GitHub. ZeusQA reads package.json with package-lock.json, pnpm-lock.yaml or yarn.lock, requirements.txt, go.mod, Cargo.lock, composer.lock and Gemfile.lock from the root of the default branch, and sends every package version to OSV.dev, which carries GitHub's advisory database and the PyPI, Go, Rust and other ecosystem databases. Each advisory that applies is checked against CISA's catalog of vulnerabilities attackers are known to use. Nothing in the repository runs.
• A briefing, not a scanner row. The new Advisories page puts each advisory on a card: what happened, who should look, what to do now, the evidence (the advisory, the CVE record, the fix commit) and a chronology. Needs attention holds the open ones and the ones with a pull request waiting; Reference keeps what a later check found gone and what a member dismissed. A known exploited vulnerability is marked and sorted first.
• The fix as a pull request. A direct dependency with a fixed version gets a pull request on a zeusqa/advisory/ branch that bumps it to the lowest fixed version, keeping its caret or tilde, with the same briefing in the description. Up to 3 a day per repository and 10 open at once. A package that arrives through another dependency gets the instruction instead: an override, or the install command to run. The lockfile is yours to refresh, and the pull request says how. Pull requests need the GitHub App's Contents permission at Read and write.
• Slack and Discord. Settings, Notifications has a new section for incoming webhooks, each with the lowest severity to post. New advisories for every watched repository, and the pull requests opened for them, arrive as one message per check with a link to the briefings. Only Slack and Discord webhook URLs are accepted, the URL is stored on the server and shown only in part, and a test message is one click.

Pro watches 10 repositories, Team 50, each checked every 24 hours with Check now once an hour. Only the root manifests are read, so a monorepo's nested packages are not covered yet, and a vulnerability with no public advisory is not found. Vulnerability watch has its own page.