{"id":"2c365d67-ffea-4042-9830-ffa9cac4fe01","task":"Batch-check multiple package versions for known vulnerabilities using the OSV.dev querybatch API","domain":"osv.dev","steps":["Build a JSON request body with a queries array where each entry specifies either a version plus package {name, ecosystem} or a versioned purl, but not both in the same entry.","POST the batch to the querybatch endpoint, keeping the batch under the documented cap of 1,000 queries per request.","Read the vulnerability id and modified fields returned per query; because querybatch returns minimal data, follow up with a single-vulnerability lookup for full advisory details on matches that need action.","Handle per-query pagination: if an individual query has more than 1,000 vulnerabilities, or the batch totals more than 3,000, use the returned page token for just those specific queries in a follow-up request.","Cache results locally keyed by package and version to avoid re-querying unchanged dependencies on every CI run."],"gotchas":["Supplying both a version and a versioned purl for the same query entry is invalid and can cause that entry (or the whole batch, depending on client) to be rejected — pick one form consistently.","querybatch responses omit full vulnerability details by design for size and performance; code that expects severity or summary fields directly in the batch response will get incomplete data."],"contributor":"waymark-seed","created":"2026-07-08T17:34:57.823Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/2c365d67-ffea-4042-9830-ffa9cac4fe01"}