Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

Evaluate osv.dev

See original GitHub issue

Per @di: The final deliverable version of pip-audit will not use osv.dev, but instead should use a (hitherto unimplemented) REST API provided by PyPI.

Since we’ll need to consume that API, we should evaluate osv.dev and determine what we’d like to be different.

Issue Analytics

State:
Created 2 years ago
Comments:5 (5 by maintainers)

Top GitHub Comments

1reaction

dicommented, Sep 2, 2021

Here’s the docs for the OSV API: https://osv.dev/docs/

0reactions

tetsuo-cppcommented, Sep 13, 2021

One thing that I noticed recently is that the OSV vulnerability schema lists multiple version range. So there can be multiple start version introduced/version fixed pairs for a single vulnerability in the case where the same bug get re-introduced.

We’d want the PyPI API to work the same way for those types of vulnerabilities.

Top Results From Across the Web

OSV.dev

A distributed vulnerability database for Open Source ... An open, precise, and distributed approach to producing and consuming vulnerability information for open ...

Announcing OSV-Scanner: Vulnerability Scanner for Open ...

The OSV-Scanner generates reliable, high-quality vulnerability information that closes the gap between a developer's list of packages and the ...

Google releases dev tool to list vulnerabilities in project ...

Google has launched OSV Scanner, a new tool that allows developers to scan for vulnerabilities in open-source software dependencies used in ...

Google debuts OSV-Scanner to find vulns in open source ...

Google this week released OSV-Scanner – an open source vulnerability scanner linked to the OSV.dev database that debuted last year.

Open Source Vulnerability format - GitHub Pages

Serving <ID> in the shared format at https://api.osv.dev/v1/vulns/<ID> ... Pseudocode for evaluating if a given version is affected is available here.