Tools / Dependency vulnerability checker
Dependency vulnerability checker
Paste or upload your dependency file and see which packages have known vulnerabilities — with the CVE / advisory IDs, severity, and the version that fixes each one.
Supported files
- JavaScript (npm):
package-lock.json(exact versions),package.json(ranges). - PHP (Composer):
composer.lock,composer.json. - Python (PyPI):
requirements.txt,Pipfile.lock. - Ruby (RubyGems):
Gemfile.lock.
Sub-dependencies
Packages pull in other packages, which pull in more. A lock file lists that whole installed tree, so every
level is checked — and each finding says whether it is a direct dependency or which chain brings it in,
e.g. qs via express › body-parser: upgrade express (or add an override) to fix it.
A manifest (package.json, composer.json) lists only your direct dependencies, as ranges
(^1.2), so it is checked at the lowest version in each range and sub-dependencies are not included
— upload the lock file for the full picture. Up to 5,000 packages per check.
Why it matters
Most of the code in a modern application is open-source dependencies, and attackers target known vulnerabilities in them. The EU Cyber Resilience Act and US federal rules now expect a software bill of materials (SBOM) and timely patching.
Privacy
Your file is read in memory and immediately discarded — never stored. Only package names and versions are sent to OSV.dev, Google’s open vulnerability database (GitHub advisories, PyPI, RubyGems, Packagist and more). Remove anything private (internal registry URLs, tokens) before pasting.
Want this on every build? We set up dependency scanning in CI/CD.