Dependency vulnerability scans

Finluth scans each repository at startup and every six hours, and rescans after a push or GitHub mirror sync changes dependency files on the default branch. Repository collaborators with write access can also run an on-demand scan from the Dependencies repository tab.

Finluth checks the default branch's resolved versions against the OSV vulnerability database and shows the affected package, advisory, source file, severity when available, and a known fixed version where OSV provides one. Scans query OSV with package coordinates and versions; repository source code is not sent.

The latest successful scan snapshot is saved with repository metadata. Repository admins receive in-app notifications when a successful scan opens or clears alerts. Failed scans preserve the prior alert set and show the latest error. Scanning does not create update pull requests.

Supported inputs

Supported inputs currently include npm package-lock.json and npm-shrinkwrap.json (v1–v3), pinned Python requirements.txt/requirements.lock entries (==), Rust Cargo.lock, and Go go.sum. A package.json is recognized as a manifest, but ranges without a supported lockfile are not checked.

Yarn, pnpm, Poetry, and Pipenv lockfiles are detected and reported as unsupported. Scans are capped at 5,000 unique resolved dependency coordinates and 200 dependency files.