cve-audit

Dependency audit

Check the dependencies a project actually declares against OSV. Start with a local package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml or Cargo.lock. The default reads that file through native admission, reuses sbom-generate for inventory interpretation, and looks up exact registry package versions. It returns advisory summaries, affected coordinates, source identity and coverage. It never installs dependencies or executes the project's code.

Use this before release review or vuln-triage. Use sbom-generate when the job is an inventory or CycloneDX document; use vuln-triage to decide exposure, priority and remediation from findings already available. A database match is evidence about a package version, not proof that an application is exploitable.

Composes

• sbom-generate#inventory-file
• sbom-generate#inventory-source
• sbom-generate#make
• web-fetch#web-fetch

Choose the evidence you already have

For an ordinary local audit, supply path relative to the authorized workspace. repo_root selects that workspace root; lockfile_type is inferred from a conventional filename unless explicitly selected. scope defaults to all-locked. direct-production is available where the lockfile can establish it; npm lockfile version 1 and Cargo do not record it, so that selection is refused rather than guessed. These are locked declarations, not an inventory of what is currently installed.

from-inventory accepts the completed runx/sbom-generate.inventory.v1 packet. It keeps source identity, locations and coverage without reading or parsing the lockfile again. from-source accepts complete acquired text and uses the same inventory owner. from-url fetches a public npm JSON lockfile through web-fetch; its parsed inventory has canonical JSON identity, while the separate acquisition record retains the actual response-body digest and final URL. A mutable URL is an observation of those bytes, not an immutable repository revision.