NAME

check-third-party - survey vendored third-party libraries for outdated versions and known CVEs

SYNOPSIS

    devel/tools/check-third-party
    devel/tools/check-third-party --output report.md

DESCRIPTION

For each library described under devel/third-party/, queries OSV.dev for known vulnerabilities against the declared purl, and the appropriate upstream registry (npm registry or GitHub Releases) for the latest release. Emits a Markdown report suitable for paste into a release-prep ticket.

Intended to be run by hand before each RT release. Not part of the standard test suite because it makes network requests against external services and the underlying advisory database changes daily.

OPTIONS

--output FILE

Write the report to FILE instead of stdout.

--help

Print this help.

ENVIRONMENT

GITHUB_TOKEN

If set, used as a bearer token against the GitHub API. Lifts the unauthenticated 60-requests/hour rate limit, which matters when the tool is run repeatedly during release prep.

← Back to index