Check a lockfile

Paste or upload

Paste a lockfile or choose one: package-lock.json, yarn.lock, pnpm-lock.yaml, requirements.txt, poetry.lock, Pipfile.lock, go.sum, Cargo.lock, Gemfile.lock or composer.lock. Up to 3,000 packages.

Your file is read in your browser; only package names and versions are sent, and nothing about you is saved. A shareable report keeps just the vulnerable packages for 30 days.