Skip to content

Vulnerability Sources

Fast and deep mode both query these four sources concurrently:

  • OSV
  • GitHub Advisories
  • CISA KEV
  • deps.dev

deps.dev output is shown as:

deps-dev: 0 advisories, 43 package record(s) checked

That means:

  • how many advisory references deps.dev reported
  • how many resolved package-version records were successfully checked

deps.dev coverage gaps

deps.dev does not support Pub or Composer/PHP as ecosystems at all. depshieldx skips it explicitly for those scans rather than silently querying the wrong system, so deps-dev: no vulnerabilities for a Pub or Composer scan means "not checked", not "checked and clean". deps.dev does support RubyGems.