{"id":43736150,"url":"https://github.com/homebrew/homebrew-brew-vulns","last_synced_at":"2026-02-05T11:01:13.900Z","repository":{"id":334542669,"uuid":"1130281340","full_name":"Homebrew/homebrew-brew-vulns","owner":"Homebrew","description":"🔓 A Homebrew subcommand that checks installed packages for vulnerabilities","archived":false,"fork":false,"pushed_at":"2026-02-03T15:42:19.000Z","size":76,"stargazers_count":5,"open_issues_count":1,"forks_count":3,"subscribers_count":3,"default_branch":"main","last_synced_at":"2026-02-03T23:35:30.325Z","etag":null,"topics":["brew","homebrew","security","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"https://rubygems.org/gems/brew-vulns","language":"Ruby","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/Homebrew.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":"CODE_OF_CONDUCT.md","threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null},"funding":{"github":"Homebrew","open_collective":"homebrew","patreon":"homebrew"}},"created_at":"2026-01-08T09:32:32.000Z","updated_at":"2026-02-03T15:43:21.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/Homebrew/homebrew-brew-vulns","commit_stats":null,"previous_names":["andrew/brew-vulns","homebrew/homebrew-brew-vulns"],"tags_count":4,"template":false,"template_full_name":null,"purl":"pkg:github/Homebrew/homebrew-brew-vulns","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Homebrew%2Fhomebrew-brew-vulns","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Homebrew%2Fhomebrew-brew-vulns/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Homebrew%2Fhomebrew-brew-vulns/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Homebrew%2Fhomebrew-brew-vulns/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/Homebrew","download_url":"https://codeload.github.com/Homebrew/homebrew-brew-vulns/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/Homebrew%2Fhomebrew-brew-vulns/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":29120481,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-02-05T10:47:47.471Z","status":"ssl_error","status_checked_at":"2026-02-05T10:45:08.119Z","response_time":65,"last_error":"SSL_connect returned=1 errno=0 peeraddr=140.82.121.5:443 state=error: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["brew","homebrew","security","vulnerability-scanners"],"created_at":"2026-02-05T11:00:38.173Z","updated_at":"2026-02-05T11:01:13.894Z","avatar_url":"https://github.com/Homebrew.png","language":"Ruby","funding_links":["https://github.com/sponsors/Homebrew","https://opencollective.com/homebrew","https://patreon.com/homebrew"],"categories":[],"sub_categories":[],"readme":"# brew-vulns\n\nA Homebrew subcommand that checks installed packages for known vulnerabilities using the [OSV.dev](https://osv.dev) database.\n\n## Installation\n\nVia Homebrew:\n\n```bash\nbrew install homebrew/vulns/brew-vulns\n```\n\nOr via RubyGems:\n\n```bash\ngem install brew-vulns\n```\n\nOnce installed, the command is available as `brew vulns`.\n\n## Usage\n\n```bash\nbrew vulns [formula] [options]\n```\n\n### Options\n\n| Flag | Long form | Description |\n|------|-----------|-------------|\n| `-b PATH` | `--brewfile PATH` | Scan packages from a Brewfile (default: ./Brewfile) |\n| `-d` | `--deps` | Include dependencies when checking a specific formula or Brewfile |\n| `-j` | `--json` | Output results as JSON |\n| | `--cyclonedx` | Output results as CycloneDX SBOM with vulnerabilities |\n| | `--sarif` | Output results as SARIF for GitHub code scanning |\n| `-m N` | `--max-summary N` | Truncate summaries to N characters (default: 60, 0 for no limit) |\n| `-s LEVEL` | `--severity LEVEL` | Only show vulnerabilities at or above LEVEL (low, medium, high, critical) |\n| `-h` | `--help` | Show help message |\n\n### Examples\n\n```bash\n# Check all installed packages\nbrew vulns\n\n# Check a specific formula\nbrew vulns openssl\n\n# Check a formula and its dependencies\nbrew vulns python --deps\n\n# Scan packages from a Brewfile\nbrew vulns --brewfile\n\n# Scan a specific Brewfile\nbrew vulns -b ~/project/Brewfile\n\n# Scan Brewfile packages and their dependencies\nbrew vulns --brewfile --deps\n\n# Output as JSON (useful for CI/CD)\nbrew vulns --json\n\n# Show longer summaries\nbrew vulns --max-summary 100\n\n# Show full summaries (no truncation)\nbrew vulns -m 0\n\n# Only show HIGH and CRITICAL vulnerabilities\nbrew vulns --severity high\n\n# Output as CycloneDX SBOM with vulnerabilities\nbrew vulns --cyclonedx \u003e sbom.cdx.json\n\n# Output as SARIF for GitHub code scanning\nbrew vulns --sarif \u003e results.sarif\n\n# Show help\nbrew vulns --help\n```\n\n## How it works\n\n1. Reads installed Homebrew formulae via `brew info --json=v2 --installed`\n2. Extracts the repository URL and version tag from each formula's source URL\n3. Queries the OSV API using the GIT ecosystem to find known vulnerabilities\n4. Reports any vulnerabilities found with their severity and CVE identifiers\n\nPackages with GitHub, GitLab, or Codeberg source URLs are checked. Packages from other sources are skipped.\n\n## Example output\n\n```\nChecking 104 packages for vulnerabilities...\n(119 packages skipped - no supported source URL)\n\nexpat (2.7.3)\n  CVE-2025-66382 (HIGH) - XML parsing vulnerability...\n\nhdf5 (1.14.6)\n  OSV-2023-1091 (MEDIUM) - Buffer overflow in...\n  OSV-2023-1223 (MEDIUM) - ...\n\nFound 15 vulnerabilities in 3 packages\n```\n\n## Exit codes\n\n- `0` - No vulnerabilities found\n- `1` - Vulnerabilities found (or error occurred)\n\nThis makes it suitable for use in CI/CD pipelines.\n\n## GitHub Actions\n\nUse the `--sarif` flag to integrate with GitHub code scanning:\n\n```yaml\nname: Vulnerability Scan\n\non:\n  schedule:\n    - cron: '0 0 * * *'\n  workflow_dispatch:\n\njobs:\n  scan:\n    runs-on: macos-latest\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Install brew-vulns\n        run: gem install brew-vulns\n\n      - name: Run vulnerability scan\n        run: brew vulns --sarif \u003e results.sarif\n        continue-on-error: true\n\n      - name: Upload SARIF results\n        uses: github/codeql-action/upload-sarif@v3\n        with:\n          sarif_file: results.sarif\n```\n\n### Dependency graph integration\n\nUse the `--cyclonedx` flag to submit an SBOM to GitHub's dependency graph:\n\n```yaml\nname: SBOM Submission\n\non:\n  schedule:\n    - cron: '0 0 * * *'\n  workflow_dispatch:\n\njobs:\n  sbom:\n    runs-on: macos-latest\n    permissions:\n      contents: write\n    steps:\n      - uses: actions/checkout@v4\n\n      - name: Install brew-vulns\n        run: gem install brew-vulns\n\n      - name: Generate SBOM\n        run: brew vulns --cyclonedx \u003e sbom.cdx.json\n        continue-on-error: true\n\n      - name: Submit to dependency graph\n        uses: evryfs/sbom-dependency-submission-action@v0\n        with:\n          sbom-files: sbom.cdx.json\n```\n\nThis adds your Homebrew packages to the repository's dependency graph, enabling Dependabot alerts.\n\n## Development\n\n```bash\ngit clone https://github.com/Homebrew/homebrew-brew-vulns\ncd brew-vulns\nbin/setup\nrake test\n```\n\n## License\n\nMIT License. See [LICENSE](LICENSE) for details.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhomebrew%2Fhomebrew-brew-vulns","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fhomebrew%2Fhomebrew-brew-vulns","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fhomebrew%2Fhomebrew-brew-vulns/lists"}