Awesome Reviewers

Verification · Supply chain · Dependency audit

Advisory matching

Compare resolved versions with OSV, GitHub and ecosystem advisories.

How to build it

  1. Run an audit tool against the lockfile or manifest on every dependency change.
  2. Compare resolved versions with advisory databases such as OSV or the GitHub advisory database.
  3. Fail the build on advisories that have a fix available and report the rest.

Signals in a repository

  • A dependency-review workflow or audit step in CI for lockfile changes.
  • An osv-scanner, deny.toml or pip-audit step in the pipeline.

In practice

42 repositories run a tool for this check in the scanned set.

  • npm-audit · 9 repos
  • pip-audit · 2 repos
  • cargo-audit · 2 repos
  • govulncheck · 4 repos
  • cargo-deny · 19 repos
  • dependency-review · 12 repos

Examples