Enter the site URL
Scan a URL or dependency manifest. Even without a lockfile, known package advisories can be checked.
The file itself is never sent or saved. Your browser reads it locally and sends only package names and versions to OSV.
対応ファイルを見る
bun.lock / package-lock.json / npm-shrinkwrap.json / yarn.lock / pnpm-lock.yaml / package.json / composer.lock / composer.json / Gemfile.lock / requirements.txt / constraints.txt / pip-freeze.txt / Pipfile.lock / poetry.lock / uv.lock / pdm.lock / go.mod / go-list.txt / Cargo.lock
Scan complete ♡
Drop a lockfile to check its recorded versions.
Versions hidden from public view cannot be assessed. No finding is not proof of safety.
Libraries needing
security updates
We refresh security advisories for selected npm and Composer packages from OSV every 15 minutes. This list does not mean these packages were detected on the scanned site.
Loading updates…
Important runtime updates
Runtime information is current as of October 23, 2026; its update schedule differs from the advisory feed.