Command

`okulo vuln`

Scan dependency lockfiles for known vulnerabilities (CVE/GHSA) via the public OSV.dev API.

securityosvci

When to use it

You want a CI gate or local report of known CVEs in npm, Maven, or Pub dependencies — without installing a separate scanner.

Usage

okulo vuln scan [repo] [options]

Options

Option	Default	Description
`-f, --format`	table	`table`, `json`, or `markdown` (PR comments)
`--fail-on`	none	`critical`, `high`, `medium`, `low`, `any`, or `none` — exit 1 when a finding meets the threshold
`--ecosystems`	all	Limit to `npm`, `Maven`, and/or `Pub` (comma-separated or repeated)
`--min-severity`	all	Only show findings at least this severe
`--no-dev`	off	Skip development/test-only dependencies
`--offline`	off	Answer from the local OSV cache only (no network)
`--no-cache`	off	Do not read/write `.git/okulo/osv-cache.json`
`--rev`	working tree	Scan lockfiles at this Git revision instead
`--components A,B`	all	Only scan files in these components

Examples

Scan the current repo

okulo vuln scan
okulo vuln scan . -f json

CI gate on HIGH or worse

okulo vuln scan --fail-on high -f markdown -o vuln-pr.md

npm production deps only

okulo vuln scan --ecosystems npm --no-dev

Reuse the local cache (offline)

okulo vuln scan --offline

Sample output

Illustrative terminal output (column layout matches the real CLI):

okulo vuln scan  packages 128 · lockfiles 3 · complete
severity  package                         version   id                   fixed_in   source
────────  ──────────────────────────────  ────────  ───────────────────  ─────────  ─────────────────────
CRITICAL  lodash                          4.17.20   GHSA-xxxx…           4.17.21    web/package-lock.json
HIGH      org.springframework:…web        5.3.9     GHSA-yyyy…           5.3.14     service/pom.xml
MEDIUM    http                            0.13.3    GHSA-zzzz…           0.13.5     mobile/pubspec.lock

3 vulnerable package(s) · critical 1 · high 1 · medium 1 · low 0

How to read it

severity comes from the advisory (GHSA label or CVSS). Use --fail-on high so CI fails on CRITICAL/HIGH.
fixed_in is the lowest version OSV knows that clears the finding — your upgrade target.
source is the lockfile that pinned the version (npm, Maven, or Pub).
Exit 1 = gate failed; 0 = clean for the chosen --fail-on; 2 = incomplete (network) — do not treat as pass.

Tips

Only package coordinates (ecosystem, name, version) are sent to api.osv.dev — never source code.
Prefer lockfiles with pinned versions. Bare package.json / pubspec.yaml ranges without a lockfile are skipped.
Exit 2 means an incomplete scan (network/cache). Do not treat that as clean in CI.
okulo check stays offline and unchanged; use okulo vuln scan for vulnerability gating.

okulo vuln