VulnerabilityEnhanced with input7 checks
Transitive Dependency Vulnerability Scanner
Resolve every dependency your lockfiles actually install — transitive ones included, across npm, PyPI, Go, Cargo, RubyGems, Composer and Maven — and report the known CVEs against them.
How this scan works
- Needs a connected GitHub repository — no manifest to paste
- Reads your committed lockfile rather than your manifest, so it sees the fully-resolved tree: every transitive dependency at the exact version that actually gets installed, not the version range a package.json declares
- Covers package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, bun.lock, poetry.lock, Pipfile.lock, uv.lock, go.sum, Cargo.lock, Gemfile.lock, composer.lock, pom.xml and gradle.lockfile
- Matches every resolved package against Trivy’s vulnerability database and groups findings by severity
- Separates the vulnerabilities that already have a released fix from the ones still unpatched upstream — the first group is what you can close today
- Runs alongside the OSV.dev-backed Dependency Vulnerability Scanner rather than replacing it: the two databases don’t fully overlap, so a finding in one and not the other is expected
- Reports the vulnerability database’s build date in its coverage line, so an ageing database is visible rather than assumed current