Public Dependency Rot Scanner

Run a rot scan on any public GitHub repo.

Pull a manifest from GitHub, cross-reference OSV.dev and the package registries, score age behind latest and severity-weighted CVEs. The same code runs from this page and the homepage.

Live demo

Scan a public GitHub repo for dependency rot

Paste a github.com/<owner>/<repo>URL. We'll fetch the manifest, cross-reference OSV and the package registries, and score rot in seconds. Anonymous · no signup.

We probe package.json, requirements.txt, go.mod, and Gemfile. Override with a custom branch or path below.

Cross-ecosystem

npm, Python (pip-style requirements.txt), Go modules, and Ruby (Gemfile) — picked automatically from the repo.

CVE-aware

OSV.dev batch queries surface published advisories with the fixed version range when one exists.

Upgrade PRs (coming)

When the GitHub App launches, weekly scans turn into one-click tested pull requests — same diff-and-test discipline as the demo above.