Checks · DEP-002

DEP-002 · Dependency with high CVE

Why it matters

High-severity dependency bugs are worth upgrading even when they are less urgent than a critical one.

How we detect it

OSV reports a high severity advisory on a locked package.

How we fix it

Bump the package to a version that fixes the advisory.

Can it be fixed automatically? Yes, with a template change

Related checks

• DB-006 · No backups or point-in-time recovery
• DB-007 · Backups never restore-tested
• TLS-001 · Certificate expires in under 14 days
• TLS-002 · TLS below 1.2 accepted