Questions
Does dependencywatch tell me if I am actually affected by a CVE?
It tells you one of three things, and the third is the important one. If your manifest pins an exact version — a lockfile — it compares that version against the advisory's published affected range and answers yes or no, showing the arithmetic: '4.17.20 is at or above 4.0.0 and below 4.17.21'. If your manifest gives a range like ^4.17.0, it answers UNKNOWN, because the version you installed depends on what the registry held when your CI last ran and nobody can tell from the file alone.
Why does it say unknown instead of just working it out?
Because working it out would mean guessing. We could ask npm what ^4.17.0 resolves to today and print a confident badge; it would be right until your next install and we would have no way to know when it stopped being right. Upload the lockfile and every unknown becomes a yes or a no.
Where does the advisory data come from?
OSV.dev, which aggregates GitHub Security Advisories, PyPA, RustSec and others, and publishes machine-readable affected version ranges. We do the version comparison ourselves rather than asking OSV to match, so the page can show you the comparison it made.
Which manifest formats can it read?
package-lock.json, npm-shrinkwrap.json, yarn.lock, pnpm-lock.yaml, package.json, poetry.lock, Pipfile.lock, requirements.txt, go.mod, Cargo.lock, Gemfile.lock and composer.lock.
Does it tell me whether an upgrade will break my build?
No, and it says so on the screen. It can tell you the maintainer published a new major version, which under semver means they intend a breaking change. Whether that break touches anything you call is not something we can know, and we do not pretend to. We have not read the changelog for you.
Is there an ecosystem where the answers are weaker?
Yes. We order versions for npm, PyPI, Go and crates.io. For RubyGems, Packagist, Maven and NuGet we list your dependencies and show the advisories that name them, but range-based findings come back as unknown rather than as a verdict, because we have not written and tested a version comparator for those ecosystems. A wrong ordering would produce a confident wrong answer, which is worse than an admitted gap.
Does a language model decide any of this?
No. Every verdict is version arithmetic against a published range. A model is used for one optional thing — rewriting an advisory's own description into plainer English, on request — and that text is checked before you see it: if it names a version the advisory does not contain, makes any claim about whether you are affected, or recommends an upgrade target, it is discarded and you get the advisory's own words.
What does the weekly digest contain?
What changed for you in the week that ended: newly affected packages with the cited range, new unknowns and why they are unknown, new major versions, and any packages we could not get an answer about. An empty week still sends a digest saying nothing changed — silence is indistinguishable from a broken scanner.
What does it cost?
Nothing, and there is no card form. Billing is switched off in this build. When there is something to charge for, it will be on the pricing page before it is on your statement.