Skip to main content

See the vulnerabilities of a component

Each night, Astrolabe checks the dependencies of every component against OSV, the public database of known vulnerabilities. The Tech stack tab then tells you which library is touched, by which vulnerability, and which version fixes it. You have nothing to set up.

Before you start​

  • The Tech stack plugin is on. An administrator turns it on in Administration › Plugins: see Turn on a plugin.
  • The component is in the catalog and its Tech stack tab shows its dependencies: see See a component's tech stack.

🔎 Read the vulnerabilities​

  1. In the sidebar, click Catalog.

  2. In the list, click the name of your component, for example web-shop.

  3. Click the Tech stack tab, then the Dependencies sub-tab.

  4. Leave Branch on the default branch, for example main: the check runs on the default branch only.

  5. Above the files, a line sums up the last check, for example 1 known vulnerability in the direct dependencies, checked on 10/31/2026.

  6. On the row of the library, for example lodash 4.17.20, read:

    • touched by CVE-2021-23337: click it to read the advisory on OSV;
    • the severity, for example high;
    • installed 4.17.20, fixed in 4.17.21: the version your component installs, and the first version without the vulnerability.

  7. Update the library to the fixed version, here 4.17.21. The next night, the row is clean.

🌙 Before the first night​

Until the first check has run, the Dependencies sub-tab says Vulnerabilities not checked yet: the check runs each night on the default branch. Come back the next day.

⚠️ What could not be checked​

Astrolabe never says a dependency is safe when it could not check it.

  • A dependency written as a range, for example left-pad ^1.3.0, with no lockfile next to it: its row says not checked, and the line above the files says 1 dependency not checked: with 1 with no lockfile to give the version installed. Commit the lockfile of the project (for example package-lock.json or yarn.lock) to the repository.

🛡️ All the vulnerabilities of the company​

An administrator sees every vulnerability found, with the components it touches, in Administration › Problems: see Find and fix a problem.

❓ Questions​

Is every dependency checked? No: the direct dependencies, the ones the files of the repository declare. The dependencies of your dependencies are not read.

Is another branch checked? No, only the default branch. On another branch, the Dependencies sub-tab says Vulnerabilities are checked each night on the default branch (main) only.

Our servers cannot reach the Internet. Add the OSV connection to read a copy of OSV inside your network: see Read vulnerabilities from your own OSV.

Something does not look right? See Common problems with the Tech stack.