GitHub Dependency Risk Triage with OSV

Thirdwatch portfolio: 5K+ users across 140+ public Actors, 2M+ records delivered, and >99% run success. Explore all Thirdwatch Actors.

Triage dependency risk in a GitHub repo — read manifests, check packages against OSV vulnerabilities, and open a triage issue.

What you get

Triage dependency risk in a GitHub repo — read manifests, check packages against OSV vulnerabilities, and open a triage issue.

Why use GitHub Dependency Risk Triage with OSV

• Manifest scanning — reads package.json and pinned requirements.txt directly from your repo.
• OSV vulnerability data — matches exact package versions against the open OSV database.
• Issue output — writes (or updates) a single triage issue in the repo, with a dry-run mode for safe testing.

Quick start

{
  "manifestPaths": [
    "package.json",
    "requirements.txt"
  ]
}

Input parameters

Parameter	Required	Description
githubConnector	No	Authorized GitHub connector limited to reading files, searching issues, and creating or updating an issue.
owner	No	GitHub user or organization that owns the repository.
repo	No	Repository name without the owner or URL.
ref	No	Optional branch, tag, or full ref. Leave empty for the default branch. Default: ``.
manifestPaths	Yes	Supports package.json and pinned requirements.txt entries. Missing paths are reported and skipped. Default: ['package.json', 'requirements.txt'].
maxPackages	No	Stop after this many distinct pinned versions across the selected manifests. Default: 100.
updateExistingIssue	No	Search for the stable issue title and update it instead of opening duplicates. Default: True.
issueLabels	No	Labels must already exist in the repository. Leave empty when unsure. Default: [].
dryRun	No	Read manifests and run OSV without writing a GitHub issue. Default: True.
confirmWriteTarget	No	Required when Dry run is off. Enter the exact owner/repo and write only to a repository you own or are explicitly authorized to modify. Default: ``.

Output fields

• repository
• ref
• manifests_read
• manifest_errors
• packages_checked
• advisories_found
• decision
• setup_required
• message
• github_issue_url
• issue_action
• osv_run_id
• scanned_at

Example result

{
  "repository": "not configured",
  "ref": "default",
  "manifests_read": [],
  "manifest_errors": {},
  "packages_checked": 0,
  "advisories_found": 0,
  "decision": "SETUP_REQUIRED",
  "setup_required": [
    "githubConnector",
    "owner",
    "repo"
  ],
  "message": "Select a GitHub MCP connector and enter a repository owner and name, then run again.",
  "github_issue_url": null,
  "issue_action": "not_written",
  "osv_run_id": null,
  "scanned_at": "2026-08-30T20:28:59.719399+00:00"
}

Common use cases

• Audit repo dependencies for known CVEs
• Automate security review in CI-adjacent workflows
• Get a human-readable risk issue without a full SCA tool

Compared to alternatives

• vs other GitHub Dependency Risk Triage with OSV scrapers on the Store — pay-per-result billing means empty or failed searches cost nothing; you are not charged for a run that returns zero rows.
• vs building your own — no proxy management, markup-change maintenance, or infrastructure to run; paste inputs and consume the dataset.

Limitations

• Requires an authorized GitHub connector for repo access.

• Covers package.json and pinned requirements.txt manifests.

• Set dryRun: true to inspect results without writing issues.

• Use public data lawfully and respect applicable privacy and platform rules.

FAQ

Do I need an account or cookies?

No — the Actor reads public data only. There is no login to configure and no account to risk.

What happens when a search returns nothing?

The run completes with zero (or an explicit error) rows. Per-result billing means you are not charged for empty output.

Can I run it on a schedule?

Yes — attach an Apify schedule or use the saved tasks to re-run the same inputs daily or weekly.

Related guides and Actors

• Compare Github Dependency Risk Technical Side By Side
• Export Github Dependency Risk Technical To Csv
• Extract Github Dependency Risk Technical At Scale
• GitHub Doc Link Auditor
• NVD CVE Scraper

Last verified: 2026-09

More scrapers at thirdwatch.dev.