Turn dependency advisories into upgrade decisions.
Winfunc inventories direct and transitive dependencies, matches them against OSV, GitHub, and NVD advisories, and checks whether your code reaches the vulnerable function. Each reachable advisory comes with the fixed version and the upgrade command for your package manager, alongside SBOM export and license checks.
- acme
- /billing-api
- /Dependencies
- express4.19.2
- body-parser1.20.2
- axios1.6.0Reachable
- follow-redirects1.15.4
- pdfkit0.13.0
- fontkit2.0.2
- jsonwebtoken9.0.0
SSRF through a path-relative URL
CVE-2024-39338 · axios
- Version
- 1.6.0 → 1.7.4
- Called from
- webhooks/preview.ts:61
- Upgrade
bun add axios@1.7.4
Security work should end in a decision, not another queue.
A package identifier and severity score are not enough to plan remediation. Teams need to know which repository contains the dependency, what OSV reports, whether a fixed version exists, and how to make and verify the upgrade in the package ecosystem they use.
- Repository dependencies
- OSV enrichment
- upgrade and rescan
From scope to an engineering decision.
Connect an authorized repository with supported dependency files and identify the engineering owners who will assess and apply package upgrades.
- Scope01
Scan supported repository dependency files with osv-scanner
- Investigate02
Enrich detected vulnerabilities with current OSV advisory details
- Investigate03
Review affected versions, severity, references, and available fixes
- Review04
Apply the ecosystem-specific upgrade path and rescan the repository
What your team gets.
- 01Repository-scoped OSV findings
- 02Affected and fixed-version context
- 03Upgrade guidance with a rescan step
- Repository-scoped dependency findings with OSV identifiers and source links
- Affected package, installed version, severity, and advisory metadata
- Fixed-version guidance when OSV provides it
- Package-manager-specific upgrade commands where supported
- A clear rescan step to verify the dependency state after remediation
Reduce time spent translating advisory records into concrete, verifiable dependency upgrades.
Measure it
Track open dependency findings, findings with a named fixed version, upgrade lead time, and the share closed by a clean follow-up scan.
Scope and limits
Coverage depends on the dependency files and ecosystems supported by osv-scanner and on the data available from OSV. A clean dependency scan does not review application logic, build-pipeline integrity, provenance, or runtime exposure.
Explore connected capabilities
Bring us your hardest codebase.
We'll bring the proof.
Scope a first audit with our security engineers. You get findings with traces, reproduction evidence, and patches ready for review.