osv-dedupe

Given a security finding for a PyPI package, decide whether it's already a published vulnerability before you spend time (or LLM tokens) triaging it. osv-dedupe queries OSV (and optionally NVD), then scores each candidate advisory against your finding using source reliability, package-name presence, CWE overlap, and file/function hints.

Install

pip install osv-dedupe

Library usage

from osv_dedupe import find_known_advisory_matches

finding = {"cwe": "CWE-22", "path": "demo/tarfile_utils.py"}
matches = find_known_advisory_matches("demo", "1.0.0", finding)

for m in matches:
    print(m["confidence"], m["source"], m["id"], m["url"])
    print(m["reason"])

Each match is a dict with source, id, url, confidence (0.0–1.0), reason, aliases, cwes, and summary. A confidence >= 0.70 is generally strong enough to treat the finding as already reported.

Options:

• min_confidence (default 0.70) — threshold for returned matches.
• include_nvd (default False) — also keyword-search NVD (slower, noisier).
• limit (default 3) — max matches returned.

CLI

osv-dedupe requests 2.0.0 --cwe CWE-22
osv-dedupe django 3.2 --include-nvd --json

Scoring

Confidence is clamped to [0.0, 1.0]. All network calls are best-effort: if OSV or NVD are unreachable, you get an empty list, never an exception. Results are cached in-process; call clear_cache() to reset.

License

MIT