vulns

vulns queries OSV.dev and lists each affected package with its OSV / GHSA / CVE identifiers, a severity bucket, and a one-line summary. It does not evaluate licence policy.

licence_audit vulns

Report contents

For each affected package, vulns shows its identifiers, severity, and a short summary. Severity is critical, high, medium, low, none, or unknown. The command first reads database_specific.severity from OSV. If this value is not available, it uses the CVSS vector. The report ends with the numbers of checked, affected, and clean packages.

A valid CVSS score of 0.0 has severity none, not low or unknown. It remains in the report but never blocks check --vulns, even with --vuln-block-unknown. When OSV supplies multiple vectors, the highest known severity applies. A recognised database_specific.severity remains authoritative.

A vulnerability does not make vulns fail. Exit codes:

• 0: the scan completes, with or without findings.
• 2: an input, configuration, manifest, or OSV batch network or decode error.

If the request for one advisory fails, the report keeps the advisory ID with unknown severity and a warning. The command still exits 0. The severity is then incomplete.

The command queries Hex and GitHub dependencies. It skips other sources and lists them at the end. It gets advisories through HTTPS and does not cache them.

Hex queries identify the package and locked version. GitHub queries send the locked commit through OSV’s commit field. Reports, scoped exceptions, and SBOM component references keep the GitHub purl. These query rules also apply to check --vulns and sbom --vulns.

Reviewed advisory exceptions

vulns uses configuration discovery to read [tools.licence_audit]. It shows matching advisory exceptions with their reasons and expiry dates, but keeps the advisories in the affected-package counts. An exception does not mean that a vulnerability has been fixed.

Use --config=other.toml to select another configuration file, or --ignore-config to ignore configuration. The command does not require a licence policy. It reports licence exceptions as not evaluated.

The exception summary lists expired and unused entries. Expiry does not make vulns enforce a gate. Malformed or overlapping exception configuration returns exit code 2. A failed advisory detail lookup still appears as unavailable evidence with a warning; an exception cannot accept that placeholder.

See scoped policy exceptions for the TOML schema, exact version/commit matching, advisory aliases, and UTC expiry.

Failing a build on vulnerabilities

vulns reports results and does not enforce a threshold. To return a failure when advisories meet a severity threshold, add --vulns to check:

licence_audit check --vulns
licence_audit check --vulns --vuln-severity=medium
licence_audit check --vulns --vuln-block-unknown

The command runs the licence audit and then queries OSV.dev. It fails when an advisory meets or exceeds the threshold. An advisory with unknown severity does not cause a failure by default. Use --vuln-block-unknown to make unknown severity cause a failure. See check for configuration and override rules.

Flags

vulns includes development dependencies by default. Use --prod-only to exclude them. OSV advisories are not cached; this command does not accept --no-cache or --cache-path.

Scope follows the production dependency graph in the gleam.toml beside the selected manifest. A valid file without [dependencies], or with an empty table, has no production dependencies, so --prod-only makes no OSV requests. A missing file uses all lockfile direct dependencies as production roots. An unreadable file, invalid TOML, or a dependencies value that is not a table causes exit code 2, including with --ignore-config.

Report known vulnerabilities for locked dependencies using the OSV.dev database. Does not evaluate licence policy. Includes dev dependencies unless –prod-only is set. Queries OSV directly and uses no on-disk cache.

Usage:

licence_audit vulns [--flags]

Flags: