triage_dependencies

app.openkrill/cve · Verify this server

Use this when the user wants to know which vulnerable dependencies to fix first, such as "which dependencies in this package-lock.json should I upgrade first?" or "triage my requirements.txt". Pass the text of a package-lock.json, package.json or requirements.txt as manifest, or a packages list of ecosystem, name and exact version (npm, pypi, go, crates.io, maven, rubygems, nuget, packagist); only names and versions are read. Returns fix_first: by default the 3 packages to upgrade first, each with a priority (malicious, exploited, likely, routine or unknown), one line on why, the CVE ids and the version that fixes it, then a short list of the other vulnerable packages and a count per priority. It matches exact package versions to known advisories; it does not scan code or show that the vulnerable code is reached.