Free n8n templates for OSV dependency vulnerability checks

Fairquery · October 20, 2026

Two free n8n workflows that check your dependencies against OSV.dev, the open vulnerability database. Download the JSON, import it into n8n, add your own credentials, and run it. MIT licensed.

These are community templates published by Fairquery. They are not in the n8n template library and have not been reviewed or approved by n8n.

• Weekly GitHub to OSV.dev to Slack digest: free, needs no Apify account.
• CI webhook gate: runs the Fairquery OSV Actor on Apify with your own Apify token.

1. Weekly GitHub dependency scan with Slack alerts (free)

What it does: every Monday at 08:00 (n8n instance timezone), or when you click Run now, it reads one manifest from a GitHub repository (package-lock.json, package.json or requirements.txt), collects up to maxPackages dependency versions, asks the OSV.dev querybatch API which ones have advisories, fetches each advisory (at most 40 per run) for severity and fixed versions, and posts the findings at or above minSeverity (default HIGH) to Slack. Clean runs stay silent. A missing manifest or an OSV.dev error stops the run with an error instead of reporting a pass.

What it calls: the GitHub API (your GitHub credential), api.osv.dev (free, no key) and Slack (your Slack credential). No Apify Actor and no Fairquery service.

Setup:

1. In n8n, choose Import from File and pick the downloaded JSON.
2. Create a GitHub credential (a personal access token with read access to the repository contents) and select it on Read manifest from GitHub.
3. Create a Slack credential, select it on Post alert to Slack, and pick a channel.
4. Open Settings and set githubOwner, githubRepo, gitRef, manifestPath, minSeverity and maxPackages.
5. Click Run now once, check the Slack message, then activate the workflow.

Limits: version ranges in package.json are reduced to the bare version (^4.17.20 becomes 4.17.20), so point manifestPath at package-lock.json for the versions you actually install. Advisories with no severity score count as UNKNOWN and do not meet a HIGH threshold. One repository and one manifest per workflow.

How we tested it: n8n 2.43.7 with live OSV.dev calls: a vulnerable fixture (lodash 4.17.20, minimist 1.2.5) produced an alert; a clean one (left-pad 1.3.0) ended at All clear; an empty manifest, a missing file and an OSV.dev error each stopped the run. There were no GitHub or Slack accounts on the test machine, so those two nodes were replaced with stand-ins that return the same data shape.

Download the weekly GitHub to Slack workflow (JSON) n8n-osv-github-slack-weekly.json · 25 KB · SHA-256 525efe6ebfe496b4…

2. CI gate: fail the build on HIGH or CRITICAL vulnerabilities (uses Apify)

What it does: your CI job POSTs a package-lock.json, a pinned requirements.txt, a go.mod or a list of packages to an n8n webhook. The workflow runs the Fairquery OSV Dependency Vulnerability Check Actor on Apify, which checks every exact version against OSV.dev, and answers with fail true or false, counts per severity and the top 15 findings with their fixed versions. Missing input returns HTTP 400 and a failed check returns 502. A check that covered no packages, or hit lookup errors, returns fail: true, so the gate never passes by accident.

What it calls: the Apify API (run-sync-get-dataset-items for Actor fairquery/osv-dependency-vulnerability-check) with your own Apify API token, stored as an n8n Bearer Auth credential. The run happens in your Apify account and is billed there: $0.50 per 1,000 packages checked plus $1.50 per 1,000 vulnerability rows reported, plus a $0.00005 start fee per run; error rows are never charged. Each run is capped at $2 with Apify's maxTotalChargeUsd.

Setup:

1. Import the JSON into n8n.
2. Create a Header Auth credential (for example header X-Api-Key with a long random value) and select it on CI webhook.
3. Create a Bearer Auth credential with your Apify API token (Apify Console › Settings › API & Integrations; a scoped token limited to running this Actor is enough) and select it on Run OSV check on Apify. Never paste the token into the node itself.
4. Activate the workflow and call the production webhook URL from CI, failing the job when the response has "fail": true.

jq -n --rawfile m package-lock.json '{manifestText: $m, minSeverity: "HIGH"}' \
  | curl -sf -X POST "$N8N_WEBHOOK_URL" -H "X-Api-Key: $N8N_GATE_KEY" \
      -H "Content-Type: application/json" -d @- > gate.json
jq -e '.fail == false' gate.json

Send "minSeverity": "MEDIUM" for a stricter gate or "CRITICAL" for a looser one. For a pip project, run pip freeze > requirements.txt first so every version is exact.

How we tested it: n8n 2.43.7, live webhook, real Apify runs on tiny inputs: no or wrong header key gave 403, an empty body gave 400, lodash 4.17.20 gave fail: true with 2 HIGH findings, the same with minSeverity CRITICAL gave fail: false, and an unparseable manifest gave 502.

Download the CI gate workflow (JSON) n8n-osv-ci-gate-apify.json · 11 KB · SHA-256 f519b4ff18400db3…

What is in the files

Plain n8n workflow JSON with sticky notes that repeat the setup steps. There are no credentials, credential IDs, node IDs, webhook IDs, account names or pinned test data in them; n8n assigns new IDs on import, and you select your own credentials. The GitHub owner and repository are placeholders (YOUR_GITHUB_OWNER, YOUR_REPO). Check the full SHA-256 after download with sha256sum:

525efe6ebfe496b4c3dc55c18187cb03f0578de48faca74e6f043c26a7d46922  n8n-osv-github-slack-weekly.json
f519b4ff18400db3bf563a97ca6d5d38745c657e72301d867861234b6d654798  n8n-osv-ci-gate-apify.json

Related

• npm and PyPI vulnerability check in CI with OSV: the same check with a free Python script and a GitHub Actions example.
• OSV API in Python: query and querybatch, pagination and severity traps.
• Agent Trust MCP server: free osv_query_packages and osv_get_vulnerability tools for AI agents.
• All Fairquery tools

FAQ

Are these official n8n templates?

No. They are community workflows published by Fairquery. They are not listed in the n8n template library and are not reviewed, approved or endorsed by n8n. n8n is a trademark of its owner.

Do I need an Apify account?

Only for the CI gate. The weekly GitHub to Slack workflow calls the free OSV.dev API directly and uses no Apify or other paid service. The CI gate runs the Fairquery OSV Dependency Vulnerability Check Actor on Apify with your own Apify API token, billed to your Apify account.

What does the CI gate cost?

$0.50 per 1,000 packages checked plus $1.50 per 1,000 vulnerability rows reported, plus a $0.00005 Actor-start fee per run (Apify pay per event, Free-plan price). Error rows are never charged. The workflow caps each run at $2 with Apify's maxTotalChargeUsd parameter.

Which n8n version do they need?

They were built and tested on self-hosted n8n 2.43.7 and use that version's default node versions. Older n8n releases may not have every node version.

What data leaves my n8n instance?

The weekly workflow sends package names and versions to api.osv.dev and posts findings to your Slack channel; it reads the manifest with your GitHub credential. The CI gate sends the manifest or package list your CI job posts to the Apify API, which runs the OSV Actor in your Apify account; the Actor queries OSV.dev. Nothing is sent to Fairquery.

OSV.dev data is provided by the OSV project; advisories can be incomplete or change. A clean result means no known advisory matched the exact versions checked, not that the code is safe.