---
name: dependency-checker
description: "Dependency Vulnerability & EOL Checker via devops.majbase.com's free public API, no key required. Keywords: check requirements.txt for vulnerabilities, scan package.json / package-lock.json / go.mod for CVEs, OSV.dev lookup, is python 3.9 end of life, node 16 EOL, endoflife.date."
---

# Dependency Vulnerability & EOL Checker

Looks every pinned version in a dependency manifest up in OSV.dev (known
vulnerabilities, with severity and fixed version) and checks a runtime's
end-of-life status on endoflife.date. Calls devops.majbase.com's free public
API — no API key or authentication required. The manifest is processed in
memory only and never stored.

## Endpoints

```
POST     https://devops.majbase.com/dependency-checker/api
GET/POST https://devops.majbase.com/dependency-checker/api/runtime
```

## Request / Response

```
API: POST /dependency-checker/api
  manifest=<string>  (required — raw requirements.txt / package.json /
                      package-lock.json / go.mod / Pipfile.lock /
                      composer.lock / Gemfile.lock content)
  format=<string>    (optional, default 'auto'; one of the names above)
Returns {"format", "summary": {"checked", "vulnerable", "clean", "unchecked",
"vulnerabilities", ...}, "packages": [{"name", "version", "ecosystem",
"approximate", "status", "vulns": [{"id", "url", "severity", "fixed_in",
"summary", "aliases", ...}]}], "unchecked": [{"name", "reason"}],
"runtime": {...endoflife.date verdict...} | null}, or {"error": "..."}.
Rate limited per source IP (30/hour); input up to 512 KB / 2000 packages.

API: GET or POST /dependency-checker/api/runtime
  product=<string>  (required — endoflife.date product, e.g. python, nodejs,
                     ubuntu, postgresql; aliases like 'node'/'postgres' accepted)
  version=<string>  (required — e.g. 3.9, 3.9.7, 20.04, 16)
Returns {"product", "product_url", "version", "status": "supported" |
"ending-soon" | "security-only" | "eol" | "unknown", "eol_date",
"days_to_eol", "support_date", "latest", "lts", "message", "cycle",
"available_cycles"}, or {"error": "..."}.
```

## Examples

```bash
curl -sS -X POST https://devops.majbase.com/dependency-checker/api -H "Content-Type: application/json" \
  -d '{"manifest":"requests==2.25.0\nflask==2.0.0","format":"auto"}'

# straight from a lockfile:
curl -sS -X POST https://devops.majbase.com/dependency-checker/api --data-urlencode "manifest@package-lock.json"

curl -sS "https://devops.majbase.com/dependency-checker/api/runtime?product=python&version=3.9"
```

## Notes

- No API key or authentication required.
- Only pinned versions are checked. A `package.json` range like `^1.2.3` is
  checked at its minimum version and flagged `"approximate": true`; unpinned
  `requirements.txt` lines are listed under `unchecked`. Prefer lockfiles.
- No transitive resolution unless a lockfile is provided. OSV coverage varies
  by ecosystem — `"status": "clean"` means no advisory is recorded, not proof
  of safety.
- Full interactive tool: https://devops.majbase.com/dependency-checker/