WHAT: Check exact package versions, or a pasted manifest (package.json, package-lock.json v1-v3, requirements.txt with == pins, go.mod), against the OSV.dev vulnerability database (GHSA, PYSEC, GO, RUSTSEC, CVE aliases). WHEN TO USE: auditing a project or a list of dependencies before upgrading or shipping, or answering "is lodash 4.17.20 vulnerable and what should I upgrade to?". WHEN NOT TO USE: for the full record of an advisory ID you already have use get_vulnerability_details (free); to browse all advisories of a package without a version use list_package_vulnerabilities (free). Does not scan source code, containers or unpinned ranges (ranges produce VERSION_NOT_PINNED warnings). BEHAVIOR: runs the Fairquery Apify Actor fairquery/osv-dependency-vulnerability-check through the Apify API, which queries api.osv.dev. Requires APIFY_TOKEN. Typical run 5-60 s depending on package count. COST: paid (billed to your Apify account, pay-per-event): $0.00005 per run + $0.0005 per package row + $0.0015 per emitted vulnerability row; error/warning rows are free. Example: lodash + django (2 packages, 41 vulns) ~ $0.06. RETURNS: one type="package" row per unique package (recommended_version = smallest version fixing every emitted vuln, or null) plus one type="vulnerability" row per advisory; type="error" rows carry code (INPUT_EMPTY, INVALID_PACKAGE, MANIFEST_UNDETECTED, MANIFEST_PARSE_FAILED, MAX_PACKAGES_EXCEEDED, OSV_QUERYBATCH_FAILED, OSV_VULN_FETCH_FAILED, or the warnings VERSION_NOT_PINNED / VERSION_NOT_PINNABLE / RANGE_APPROXIMATED) and retryable. EXAMPLE: {"packages":[{"ecosystem":"npm","name":"lodash","version":"4.17.20"}],"minSeverity":"HIGH"} -> 1 package row (vulnerable, recommended_version) + HIGH/CRITICAL vulnerability rows. PARAMETERS: packages and/or manifestText: at least one is required although the schema marks both optional (neither -> INPUT_EMPTY, not billed); both may be combined and packages parsed from the manifest are merged with packages, deduped by ecosystem+name+version. Every unique package is one billed row, so maxPackages (default 1000) is also your spend cap; extras produce a free MAX_PACKAGES_EXCEEDED row. Versions must be pinned: requirements.txt needs "==" pins, package.json ranges such as "^4.17.0" are approximated (RANGE_APPROXIMATED warning) - paste package-lock.json for exact results. manifestType: leave "auto" unless detection fails (MANIFEST_UNDETECTED). minSeverity uses the CVSS v3 base score, else the advisory label; package rows are always emitted, but their vulnerable, vuln_count, max_severity and recommended_version then cover only the vulns that passed the filter (vuln_count_total keeps the unfiltered count); includeUnknownSeverity decides whether vulns without any severity pass that filter, and has no effect when minSeverity is "ALL". dedupeAliases=false emits one row per OSV ID (GHSA and PYSEC copies of the same issue), which raises cost. includeDevDependencies only affects package.json / package-lock.json.

WHAT: Fetch the full OSV record for one or more known vulnerability IDs (e.g. GHSA-35jh-r3h4-6jhm, PYSEC-2021-9, GO-2022-0969, RUSTSEC-2021-0078, CVE-2021-44228) directly from the public OSV.dev API. WHEN TO USE: you already have an advisory/CVE ID (e.g. from check_dependency_vulnerabilities or a security report) and need its summary, details, affected ranges, fixed versions, severity vectors or references. WHEN NOT TO USE: to find which vulnerabilities affect given package versions or a manifest use check_dependency_vulnerabilities (paid); to list every advisory of a package without IDs use list_package_vulnerabilities (free). COST/BEHAVIOR: free; one HTTP GET per ID to api.osv.dev, no token; OSV documents no rate limit. RETURNS: one row per ID: type="vulnerability" with the raw OSV record fields plus osv_url, or type="error" (VULN_NOT_FOUND or OSV_FETCH_FAILED, see PARAMETERS). PARAMETERS: ids: each ID is trimmed and fetched separately (in parallel) and yields exactly one row in input order, so one bad ID never fails the call: unknown IDs return VULN_NOT_FOUND rows (not retryable), network/5xx problems OSV_FETCH_FAILED rows (retryable - resend just those IDs). Use the exact IDs from check_dependency_vulnerabilities (id / vuln_ids / aliases); a CVE-... ID resolves only when OSV holds it as its own record, otherwise query its GHSA alias. Duplicate IDs are fetched twice. For more than 25 IDs, split into several calls. EXAMPLE: {"ids":["GHSA-35jh-r3h4-6jhm"]} -> 1 vulnerability row (lodash command injection, fixed in 4.17.21).

WHAT: List every OSV.dev advisory recorded for one package across all of its versions (no version needed), with the affected version ranges and fixed versions for that package. WHEN TO USE: "what security issues has lodash had?", choosing a safe version before adding a dependency, or browsing advisories for a package when you have no exact version or advisory ID. WHEN NOT TO USE: to check exact pinned versions or a manifest and get upgrade recommendations use check_dependency_vulnerabilities (paid); for the full record of one advisory use get_vulnerability_details (free). BEHAVIOR: POST /v1/query to api.osv.dev without a version; follows OSV pagination up to 10 pages; typically 1-3 s. An unknown package name returns 0 rows, not an error (OSV does not distinguish). COST: free; no APIFY_TOKEN, nothing sent to Fairquery or Apify; OSV documents no rate limit. RETURNS: one type="vulnerability" summary row per advisory, newest published first; Errors: INVALID_ECOSYSTEM, OSV_FETCH_FAILED (retryable). PARAMETERS: ecosystem accepts aliases (pip -> PyPI, cargo -> crates.io, gem -> RubyGems, composer -> Packagist, golang -> Go, java -> Maven) and other OSV ecosystem names verbatim (e.g. "Debian:12"). name must match the published package exactly; affected_ranges and fixed_versions only cover entries for this exact package, not sibling packages the same advisory also lists. limit/offset page the sorted rows; every call re-queries OSV, which is free. withdrawn advisories are kept and carry a withdrawn timestamp. EXAMPLE: {"ecosystem":"npm","name":"lodash","limit":2} -> total 10, newest first: {"id":"GHSA-r5fr-rjxr-66jc","severity":"HIGH","affected_ranges":[{"introduced":"4.0.0","fixed":"4.18.0"}],"fixed_versions":["4.18.0"],...}, then GHSA-f23m-r3pf-42rh.