Product · Dependencies

Exact versions, matched against advisories.

A lockfile says what actually ships. Every pinned version in it is resolved, matched against the public advisory database, and matched again the next day, and the day after, without touching GitHub.

Connect a lockfile Every dependency rule

01Ecosystems

7 ecosystems, one rule: pinned or nothing.

A range is not a version. Only an exact, pinned version is ever queried, so a match is a match and never a guess about what the resolver might have chosen.

npm

package-lock.json, pnpm-lock.yaml, yarn.lock

PyPI

requirements.txt (pinned), Pipfile.lock, poetry.lock

go.sum

RubyGems

Gemfile.lock

Packagist

composer.lock

crates.io

Cargo.lock

Maven

gradle.lockfile

Direct and transitive

Both are read; the report says which is which, because the fix is different.

02Re-evaluated daily

The advisory that lands tomorrow.

The inventory is stored, so a new advisory is checked against every connected repository the same day it is published - from what is already known, with no call to GitHub and no re-scan of your code.

Batched queries
Versions are looked up in batches and cached, so a large monorepo does not become a large bill.
Targeted refresh
Only the repositories that hold an affected package are re-evaluated, and only for the packages that changed.
Resolves itself
The finding resolves when the installed version leaves the affected range, on the next push that changes the lockfile.
Severity from the advisory
The advisory sets the severity; the report adds whether the package is direct or transitive and where it is declared.

pnpm-lock.yaml · advisoriesre-evaluated daily

/next@15.1.0:

resolution: {integrity: sha512-…}

Criticalsource.framework.conditioned-advisory

Next.js middleware can be skipped with one request header (CVE-2025-29927)

next 15.1.0 is in the affected range and the application has a middleware file.

not raised CVE-2024-47831 (image optimizer): the app does not use next/image.

03Conditioned on the feature

Raised only when you use the thing.

A framework advisory about middleware is noise for an app with no middleware. These three fire only when the lockfile version is affected and the repository shows the feature in use, and they resolve when either stops being true.

CVE-2025-29927
Next.js middleware can be skipped with one request header
Only when the application has a middleware file.
CVE-2024-34351
Next.js Server Actions follow a crafted Host header
Only when the application uses Server Actions ("use server").
CVE-2024-47831
Next.js image optimizer can be driven into denial of service
Only when the application renders images through next/image.

source.framework.conditioned-advisory

04On the live site too

What the page admits to running.

Without a repository, the free scan still reads what the site says about itself: 94 technologies recognised from headers, markup and script URLs, the versions that leak with them, and whether any of those is past its end of life or in an affected range.

Software in use no longer receives security updates
runtime.technology.end-of-life
A library the page loads has a published vulnerability
runtime.technology.known-vulnerable-version

05The source rules

7 rules for what you depend on.

Dependency with a known vulnerability
source.dependencies.known-vulnerability
Dependency installed from git or a URL
source.dependencies.git-or-url-dependency
Dependency version left floating
source.dependencies.floating-range
Install script downloads or executes
source.dependencies.lifecycle-install-script
No lockfile committed
source.dependencies.lockfile-missing
Lockfile out of date with the manifest
source.dependencies.lockfile-out-of-date
Internal package scope without a registry mapping
source.dependencies.internal-scope-without-registry

Connect a lockfile.

One repository per site, on every plan. The inventory is built once, and every advisory after that is checked against it.

Create a free account Read every rule