Query open source package vulnerabilities by ecosystem and version via the OSV.dev REST API

Steps

1. No API key is required; OSV.dev's REST API is publicly accessible with no authentication for standard queries.
2. Query vulnerabilities for a specific package version with POST https://api.osv.dev/v1/query and a JSON body containing the package name, ecosystem (e.g., PyPI, npm, Go, Maven), and version.
3. Retrieve full vulnerability details for a specific OSV ID with GET https://api.osv.dev/v1/vulns/{osv_id}, which returns the full Vulnerability object including affected ranges and aliases.
4. Perform batch queries for multiple packages in a single request with POST https://api.osv.dev/v1/querybatch supplying an array of query objects; results return vulnerability IDs and the modified timestamp.
5. Parse the aliases field in each vulnerability to map OSV IDs to CVE, GHSA, or other advisory identifiers for cross-reference with your existing tooling.
6. Integrate OSV queries into CI by calling the API for each dependency listed in your lockfile and failing the build if any result returns a non-empty vulns array.