Deplyra
Does that advisory affect the version you actually run?
Upload a lockfile. dependencywatch compares the versions in it against published security advisories and answers affected, not affected, or unknown — and why. Once a week, for exactly the libraries in your manifests.
Start watching a project How it works
Free. No card, and no card form — billing is switched off in this build.
The third answer is the point
Every dependency scanner shows you a red badge or a green one. The trouble is that half the time neither is knowable. An advisory says >=4.0.0, <4.17.21; your package.json says ^4.17.0. Which version is installed depends on what the registry held the day your CI last ran, and the file cannot tell you.
A tool that prints a badge anyway has guessed. We say unknown, and we say which of four reasons it is — then we tell you the one thing that would turn it into a real answer, which is usually "upload the lockfile".
What a finding looks like
lodash 4.17.20 affected
You run 4.17.20. The advisory covers 4.0.0 up to but not including 4.17.21, and 4.17.20 is inside that range.
express ^4.18.1 unknown
We cannot tell. The manifest gives a version range, not the version you installed — upload the lockfile and this becomes a yes or a no.
What it will not do
- It will not guess a version it was not given. No resolving your ranges against today's registry to produce a badge that is true until your next install.
- It will not tell you an upgrade is safe. It can tell you the maintainer published a new major version, which under semver means they intend a breaking change. Nobody here has read the changelog.
- It will not let a language model decide anything. Every verdict is version arithmetic against a published range, shown on the page. A model optionally rewrites an advisory into plainer English, and that text is checked and thrown away if it names a version the advisory does not.
- It will not call an unchecked package clean. When the advisory database cannot be reached for some of your packages, they are listed as unchecked — on the dashboard and in the digest.
The full list of what we cannot tell you →
Join the waitlist
The product works and is free to use now. The list is for when there is news worth an email — a new ecosystem comparator, or the day billing exists. Nothing is charged and no card is taken.