Dependency Vulnerability & SBOM Scanner

Parse JavaScript, Python, Rust and Go lockfiles locally, query exact versions against OSV, inspect affected ranges and export a CycloneDX 1.7 software bill of materials.

Local lockfile, minimal OSV query

No dependency is installed or executed. Unpinned, Git, workspace and local-path dependencies are retained as unresolved and are not queried.

package-lock, pnpm-lock, yarn.lock, requirements, Poetry, Pipfile, Cargo, go.sum or CycloneDX JSON

One text lockfile up to 25 MB and 20,000 normalized components. At most 1,000 exact versions are queried per run.

About Dependency Vulnerability & SBOM Scanner

Keep lockfiles local while querying exact package coordinates. Parse JavaScript, Python, Rust and Go lockfiles locally, query exact versions against OSV, inspect affected ranges and export a CycloneDX 1.7 software bill of materials.

Key capabilities

Parse common npm, pnpm, Yarn, Python, Cargo, Go and CycloneDX inputs
Keep the full file local and send only ecosystem, package name and exact version
Show OSV aliases, affected records, withdrawal state and known fixed versions
Generate CycloneDX 1.7 components and dependency references without inventing metadata

Useful for

Check known package vulnerabilities before a release
Create a portable component inventory for review
Inspect a supplied lockfile without installing or executing dependencies

Frequently asked questions

Is Dependency Vulnerability & SBOM Scanner free to use online?

Yes. Dependency Vulnerability & SBOM Scanner opens in a modern browser and does not require desktop software installation.

What is Dependency Vulnerability & SBOM Scanner useful for?

Common use cases include Check known package vulnerabilities before a release; Create a portable component inventory for review.

Does this tool make network connections?

Some Dependency Vulnerability & SBOM Scanner features need to connect to a target service or load online data. Follow the page guidance and access only resources you are authorized to use.

Comments

0 comments

AAccount

No comments yet. Be the first to leave feedback.