All 98 Dependencies
Every package OSV.dev depends on, ranked by repo health score.
OSV.dev is an open-source vulnerability database and triage platform built by Google that provides precise, version-aware vulnerability data for open source packages. Unlike generic CVE databases that describe vulnerabilities in prose, OSV maps each advisory directly to the affected package versions or commit hashes using a standardized machine-readable schema — enabling automated tools to determine exactly whether a specific installed version is vulnerable.
The platform aggregates advisories from GitHub Security Advisories, the Python Packaging Authority, RustSec, NVD, Alpine, Debian, Ubuntu, and more than 50 other ecosystems. All data is published under the open OSV schema adopted by OpenSSF and is freely accessible via a REST/gRPC API, bulk GCS data dumps at gs://osv-vulnerabilities, and a web UI at osv.dev.
Behind the scenes, OSV runs on Google Cloud Platform using a polyglot architecture: Python services handle the API layer, import pipeline, and core vulnerability processing, while Go powers the binary analysis indexer, NVD CVE converters, and API bindings. Workers deployed on GKE perform bisection analysis on git repositories to pinpoint when a vulnerability was introduced and fixed — producing version ranges that are more accurate than what upstream advisories report.
OSV.dev is also the data backbone for first-party tools like osv-scanner and is consumed by Trivy, Dependency-Track, pip-audit, Renovate, and the OSS Review Toolkit, making it a foundational piece of the open source supply chain security ecosystem.
