Go modules and npm lockfiles
Would this build pass?
Choose a project folder. depscan reads its lockfiles, checks every package against , looks up each , applies your policy, and tells you the exact upgrade for every problem.
or drop one anywhere on this page. Only go.mod and package-lock.json are read, and they go to this server on your computer, nowhere else.
Walkthrough
How a scan works
Follow one sample project from a folder on your computer to a checked pull request. Each step shows what depscan does, why, and the exact request or code behind it.
End of the walkthrough
That is a whole scan.
Folder, lockfiles, licenses, advisories, policy, report, review and history. Now try it on your own project.
0:00 / 0:00
The sample project is made up, but every advisory in it is a real OSV.dev record (checked October 2026), trimmed to keep the walkthrough short.