Manifest to OSV Vulnerability Triage

Turn a bounded list of package versions or dependency manifests into structured vulnerability findings from the Open Source Vulnerabilities (OSV) database.

What it does

• Queries only the public OSV batch API; it does not clone repositories or inspect source code.
• Accepts explicit packages, npm package-lock.json v1+, exact Python requirements.txt pins, and explicit Maven pom.xml dependency versions.
• Emits one dataset item per OSV finding plus one final summary item.
• Deduplicates package/version/ecosystem combinations before querying OSV.

Input

Use one or more input methods. The combined normalized dependency limit is 500, and total text across manifest fields is 2 MiB.

Explicit package records

{
  "packages": [
    { "name": "lodash", "version": "4.17.20", "ecosystem": "npm" },
    { "name": "requests", "version": "2.31.0", "ecosystem": "PyPI" }
  ]
}

npm lockfile

{
  "npmPackageLock": "{\n  \"lockfileVersion\": 3,\n  \"packages\": { ... }\n}"
}

Python requirements

{ "requirementsTxt": "requests==2.31.0\nurllib3==1.26.5\n" }

Only exact package==version pins are queried. Ranges, editable installs, URLs and unpinned requirements are returned as parse warnings and are never sent to OSV.

Maven POM

{
  "pomXml": "<project><dependencies><dependency><groupId>org.apache.logging.log4j</groupId><artifactId>log4j-core</artifactId><version>2.14.1</version></dependency></dependencies></project>"
}

Maven dependencies need explicit groupId, artifactId, and version. Property substitution such as ${version}, inherited versions, and dependencyManagement resolution are not performed; property-based versions are reported as parse warnings and are never queried.

Output

Finding records contain the package coordinate, OSV ID, aliases, summary, references, and affected ranges. Example finding:

{
  "package": "lodash",
  "version": "4.17.20",
  "ecosystem": "npm",
  "osvId": "GHSA-example",
  "aliases": ["CVE-2026-0001"],
  "summary": "Example OSV finding",
  "references": [{ "type": "WEB", "url": "https://osv.dev/" }],
  "affected": []
}

The final dataset record is a summary:

{
  "type": "summary",
  "recordCount": 5,
  "unresolvedPackageCount": 0,
  "parseWarningCount": 0
}

recordCount is the number of finding records emitted. unresolvedPackageCount is the number of OSV-query warnings, and parseWarningCount is the number of skipped or unsupported input entries. No findings means OSV returned no known matching vulnerabilities for the submitted versions at the time of the query; it does not mean the software is secure.

Limits, privacy, and responsible use

• Maximum 500 normalized dependencies per run; total manifest text is capped at 2 MiB.
• Do not submit credentials, tokens, source code, private archives, personal data, or private repository details.
• The Actor sends only package name, version, and ecosystem to the public OSV API.
• Results are triage data, not a security certification, remediation plan, or legal advice. Verify findings and affected ranges before acting.

Pricing and support

The Actor is currently free to run. It has no Pay-per-Event billing configured.

For reproducible bug reports, include a minimal non-sensitive input and the run ID. Do not include secrets in reports.

Local development

npm ci
CRAWLEE_STORAGE_DIR=storage npm start

Place input at storage/key_value_stores/default/INPUT.json.