Security · runs in your browser

Are your dependencies affected?

Paste your package.json, composer.json or a lockfile, or just type the versions you run. It checks them against a snapshot of known advisories and tells you which are affected and what to upgrade to. It reads only the versions you give it; it never contacts your site or anyone else's.

Paste package.json, composer.json, a lockfile, or type versions

Runs in your browser; nothing is uploaded. It reads only the versions you paste and never contacts any website.

Paste your dependencies to check them against known advisories.

For exact results, paste a lockfile (package-lock.json or composer.lock). A plain package.json only gives the minimum version each range allows.

How to read this

Advisories come from a snapshot of OSV.dev taken on 2026-10-23, covering 71 popular npm and Composer packages. Runtime support dates come from endoflife.date.
“None in snapshot” does not mean safe. It means we have no matching advisory for that version in this snapshot. For authoritative, complete results run npm audit or composer audit in your project.
Some advisories list a fix version that isn't released yet, or a CVE that's still disputed. Always open the advisory link before acting.
Not covered here: Python, Ruby, Go, Rust, OS packages, and anything outside the 71 bundled packages.

Snapshot date 2026-10-23. Covers 71 popular npm and Composer packages plus Node.js and PHP support dates. This is a quick heads-up, not a substitute for npm audit, composer audit or a full security review.