Open source. GitLab, GitHub, Gitea and Forgejo. Release 0.1.0a13, an alpha.
Find what your scanner can’t see yet.
limbowatch scan checks your lockfiles against all 10,059 advisories in limbo, the ones Dependabot, npm audit and OSV-Scanner don’t report yet. It shows what it finds where your team already looks, and tells you which upgrade clears it.
In your terminal
One table per lockfile, the upgrade that clears each package, and a verdict. This is the demo pull request that adds scapy==2.7.0.
In your pull request
The GitHub action writes SARIF for code scanning, annotates each affected package without it, and adds a summary to the run.
In your merge request
The GitLab CI/CD component works on every tier, Free included.
Every report from one scan
Write as many as you need: -o table -o sarif=x.sarif -o junit=junit.xml -o html=report.html. Exit codes: 0 passed, 1 a finding meets --fail-on, 2 the scan couldn’t run.
| table | The terminal and CI logs, coloured; one verdict line at the end |
|---|---|
| json | Automation: findings, upgrades, summary and gate result (schema_version 1) |
| markdown | Pull request comments and job summaries |
| html | A standalone report to keep as a CI artifact |
| sarif | GitHub code scanning and other SARIF 2.1.0 tools |
| codequality | GitLab Code Quality in merge requests, every tier |
| junit | Test summaries in GitLab, Jenkins, Azure DevOps, CircleCI |
| csv | Spreadsheets |
| cyclonedx | CycloneDX 1.6 with vulnerabilities, for SBOM tools |
| github | Annotations on the pull request, one per package, no code scanning needed |
What it finds
confirmed findings in 13 popular open-source projects that GitHub’s Dependabot didn’t alert on, though every affected package was in its dependency graph. It raised 2,020 alerts on the same files, none of them for these.
on a demo app with real npm, Go, pip and Bundler lockfiles: Limbowatch found 16 advisories in limbo in six packages. OSV-Scanner and GitHub’s Dependabot alerts reported none of them.
new findings when a change adds one affected package, in GitLab’s merge request and inline on GitHub.
Use it
- 1
GitLab CI · in the CI/CD Catalog
include: - component: $CI_SERVER_FQDN/limbowatch/limbowatch-component/limbowatch@0.1.0-alpha.13 inputs: fail_on: high - 2
GitHub, Gitea or Forgejo Actions · in GitHub Marketplace
permissions: contents: read security-events: write # for the SARIF upload steps: - uses: actions/checkout@v4 - uses: limbowatch/limbowatch-action@v0.1.0a13 with: fail-on: high sarif: limbowatch.sarif - if: always() uses: github/codeql-action/upload-sarif@v4 with: { sarif_file: limbowatch.sarif, category: limbowatch } - 3
On your machine
pipx install limbowatch-cli==0.1.0a13 # needs OSV-Scanner 2.7.1 limbowatch scan .
This is an alpha: options and formats may change before 0.1.0. Full guide · Changelog
What it does, and what it doesn’t
- Reads lockfiles with OSV-Scanner, offline. The feed is downloaded whole, so limbo.watch learns nothing about your project.
- Never drops a dependency. A range-only requirement, a git install or an unreadable lockfile is listed with the reason.
- It’s a head start. Most of these advisories are reviewed eventually, after weeks; then your usual scanner reports them and Limbowatch notes that they’re visible. In ecosystems GitHub doesn’t review, the wait may never end.
- Ranges are as entered by maintainers and haven’t been reviewed. A range that contradicts its own fix is reported as possible, never silently passed.
- Large projects need a read-only GitHub token, to check the upstream repos the tracker doesn’t watch.