osv-scanner

Scan lockfiles or the resolved source tree, preserve structured output, and evaluate vulnerable-feature use and runtime reachability. Pass every material advisory candidate to /verify-security-finding.

Complete when every material advisory names the resolved version, affected feature, and reachability disposition.