Explain any lockfile change: what bumped, what's breaking, what's newly
vulnerable, how old every incoming version is — before you merge. Runs entirely in your
browser (WebAssembly); nothing you paste or drop leaves it, except queries to the public
forge / OSV.dev / deps.dev / package-registry APIs.
GitHub repo ·
install the CLI ·
61 formats incl. GitHub Actions, GitLab CI & CircleCI, Dockerfiles & Kubernetes manifests · GitHub / GitLab / Bitbucket / Gitea / Azure DevOps URLs
(Codeberg blocks cross-origin browser requests — use the CLI for those)
Try:
·
·
old lockfile drop it here, or click to pick
new lockfile drop it here, or click to pick
package-lock.json, Cargo.lock, uv.lock, go.mod, pnpm-lock.yaml, Gemfile.lock,
.terraform.lock.hcl, renv.lock … or two CycloneDX/SPDX JSON SBOMs. One side may carry a
suffix (Cargo.lock.orig).
audit what your lockfiles pin right now — no diff needed drop one or more lockfiles / SBOMs here, or click to pick
Reports known advisories (OSV.dev), versions missing from their registry's
index, deprecated / retracted / yanked packages, license oddities, and days-old releases —
for every pinned package. Like lockvet audit in the CLI.
Try:
·
·
Vets a package before it's in any lockfile —
the moment you're deciding whether to install it. Advisories (incl. malware records), release age,
deprecation / yank, versions missing from the registry index, typosquat suspects. No version =
the registry's latest. Like lockvet pkg in the CLI.
Options & API token
The token is sent only to the forge the URL points at, never anywhere else.