Supply chainIn testing
Every new dependency, checked before it merges.
Forseti diffs your lockfiles and manifests and checks what changed: known advisories, licences, look-alike package names and install scripts. Deterministic, almost free, and it never blocks on a network failure.
| Package | Change | Checks |
|---|---|---|
| date-fns | 3.6.0 → 4.1.0 | MIT |
| expresss | added 1.0.2 | looks like expressinstall script |
| pdf-render-kit | added 0.9.1 | AGPL-3.0 |
| xml-parse-lite | 2.1.0 → 2.1.3 | OSV advisory |
| left-pad | removed | removed |
OSV and registry lookups are cached with a 5 s timeout; on a network failure the review continues and says what it could not check.
How it works
Step by step.
New dependencies, advisories, licences and typosquats.
- 01DiffLockfile and manifest changes for npm, pnpm, yarn, pip, poetry, go.mod and Cargo.
- 02AdvisoriesOSV.dev for added or changed versions, cached, with a 5-second timeout.
- 03LicencesFrom the registry; GPL, AGPL and unknown licences are flagged.
- 04Look-alikesEdit distance against popular packages, plus npm install scripts.
In detail
What it does, exactly.
- Runs on every PR that touches a lockfile, at no meaningful cost.
- On GitHub
- Supply-chain findings in the review
- In the dashboard
- Findings by category
Added and removed
A clear list of what entered and left the dependency tree.
Never a network hostage
If a registry or OSV is slow, the review carries on and says what it couldn't check.
Its own category
Findings use the supply_chain category, so you can measure and filter them.
Almost free
No model calls: these checks are deterministic.
Put Forseti on your next pull request.
Connect GitHub in four clicks. Your first review starts by itself on your latest small open PR, priced before it runs.