Changelog
A free lockfile vulnerability checker
- New
- Security
Drop a lockfile or manifest from npm, PyPI, Go, Cargo, Composer or RubyGems at /tools/vulnerability-check. Every package version is checked against OSV.dev and CISA's KEV catalog in your browser, with the version that fixes each advisory. The file is never uploaded.
Vulnerability check is the one-off version of vulnerability watch, free and without an account.
- Nine files, six ecosystems. package-lock.json, pnpm-lock.yaml, yarn.lock, package.json, requirements.txt, go.mod, Cargo.lock, composer.lock and Gemfile.lock, read by the same parsers vulnerability watch uses. Drop several at once, or paste one.
- Your file stays in your browser. It is parsed there, and only package names and versions go from your browser to OSV.dev's public API.
- What matters first. Each advisory is marked exploited when its CVE is in CISA's Known Exploited Vulnerabilities catalog, rated by severity, marked direct or transitive, and given the version that fixes it.
New advisories land every day. To have this check run on a repository daily, with the upgrade opened as a pull request, turn on vulnerability watch.
Part of the ZeusQA changelog. Follow new releases with the RSS feed.
Try it on your own site
Paste a URL, describe the flow in plain English, and watch a real browser do it. Three runs free, no card.