Alerts

What changed between nightly refreshes: advisories newly listed in OSV.dev for a tracked package, advisories that now affect the current version, risky metadata changes (remote host change, package identifier / registry type / Docker image repository change, runtime command or code-executing argument changes, new or removed required secret env vars, tool list changes), archived repositories and score drops of 10+ points. Version bumps, image tags that follow the version, tracking-parameter URL edits and description text edits are not alerts — they stay in each server's change history. Newly tracked servers don't generate "new advisory" alerts, and failed lookups never do. RSS feed

Log updated Oct 20, 2026.