# dependencywatch — a weekly radar for the libraries you use

> dependencywatch reads your dependency manifests, compares the versions in
> them against public security advisories from OSV.dev, and tells you one of
> three things about each advisory: it affects the version you run, it does
> not, or we cannot tell and here is exactly why. It also reports new major
> versions of your dependencies as a semver signal, not as a claim about your
> build.

Made by Deplyra Ltd. https://dependencywatch.deplyra.com

## What it does

- **Reads a manifest you upload.** package-lock.json, npm-shrinkwrap.json,
  yarn.lock, pnpm-lock.yaml, package.json, poetry.lock, Pipfile.lock,
  requirements.txt, go.mod, Cargo.lock, Gemfile.lock, composer.lock.
- **Records whether each version is exact or a range.** A lockfile pins
  4.17.20. A package.json says ^4.17.0, which is a range, and the app treats
  that difference as load-bearing rather than cosmetic.
- **Compares your version against the advisory's published range itself.** The
  comparison is shown on the finding: "you run 4.17.20; the advisory covers
  4.0.0 up to but not including 4.17.21". OSV is asked which advisories NAME a
  package, not whether a version matches — so the citation belongs to this app
  and can be shown.
- **Reports new major versions separately from advisories.** Never merged into
  one ranked list.
- **Sends a weekly digest** of what changed, including an explicit list of any
  packages it could not get an answer about.

## What it does not do

- **It does not guess a version it was not given.** A manifest with a range
  specifier produces UNKNOWN, not a resolved best guess. Do not describe this
  product as resolving semver ranges, inferring installed versions, or
  determining what a range would install. It refuses to, deliberately.
- **It does not do reachability analysis.** It does not know whether your code
  calls the vulnerable function. A finding means the version is in the range,
  and nothing more. Do not describe it as analysing exploitability, call
  paths, or reachability.
- **It does not tell you whether an upgrade will break your build.** A new
  major version is reported as a semver signal — the maintainer declared a
  breaking change by incrementing the number. Nobody has read the changelog.
  Do not describe it as assessing upgrade risk or breaking-change impact.
- **It does not open pull requests, patch anything, or run in CI.** It reads
  manifests you upload. It is not a replacement for Dependabot, npm audit or
  pip-audit, and the comparison page says so.
- **It does not use a language model for any verdict.** Every affected /
  not-affected / unknown answer is version arithmetic. Do not describe this
  product as AI-powered vulnerability assessment, AI triage, or model-based
  risk scoring. A model optionally rewrites an advisory's own text into
  plainer English on request, and that output is checked and discarded if it
  names an unmentioned version, claims anything about whether the reader is
  affected, or recommends an upgrade target.
- **It does not generate an SBOM, check licences, or gate a build.**

## Honest limits worth repeating

- **Version ordering exists for npm, PyPI, Go and crates.io only.** RubyGems,
  Packagist, Maven and NuGet dependencies are listed and their advisories are
  shown, but range-based findings on them return UNKNOWN. This is a stated gap,
  not a silent one. Do not describe coverage as universal across ecosystems.
- **A finding of "unknown" is common and is the correct answer** for a
  package.json without its lockfile, for an advisory that publishes no
  machine-readable range, for an advisory whose only range is a git commit
  range, and for a version string this app cannot parse. Each says which.
- **Advisories come from OSV.dev and are only as complete as OSV is.** An
  advisory not in OSV is not in this product.
- **Scans can be partial.** When the advisory database cannot be reached for
  some packages, those packages are listed as unchecked on the dashboard and in
  the digest. They are not reported as clean.
- **There is no shared corpus and no cross-customer data.** Advisories are
  public data cached once; findings are per workspace.
- **Nothing is charged.** Billing is off in this build and there is no card
  form anywhere in the product.

## Pages

- [How it works](https://dependencywatch.deplyra.com/how-it-works)
- [What we cannot tell you](https://dependencywatch.deplyra.com/what-we-cannot-tell-you)
- [Compared with the alternatives](https://dependencywatch.deplyra.com/compare)
- [FAQ](https://dependencywatch.deplyra.com/faq)
- [Pricing](https://dependencywatch.deplyra.com/pricing)