OSV-Scanner Offers Deeper Vulnerability Detection for Open-Source Dependencies

·1 views

OSV-Scanner is a software composition analysis (SCA) tool designed to identify vulnerabilities in open-source dependencies that standard scanners may miss. The tool provides visibility into supply chain risks by scanning project dependencies against the Open Source Vulnerabilities (OSV) database. Users can view results either through a local web interface served on port 8000 or via standard terminal output, making it flexible for different workflows. The terminal output can be piped into other tools or reports, while the web UI offers a cleaner visual overview. Security engineers focused on supply chain risk are seen as the primary audience for the tool.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Better Auth joins Vercel in latest developer tools acquisition

Better Auth, an authentication library, has announced it is joining Vercel, the web development and deployment platform. The announcement was made via a post on the Better Auth official blog. Vercel is known for its hosting infrastructure and developer tooling ecosystem. No further details about the terms or timeline of the arrangement were available from the provided source.

0 comments Read more at Hacker News

ProgrammingDEV Community ·

How Chinese CS Students Can Rewrite University Projects for US Tech Resumes

A guide published on DEV Community advises Chinese university graduates to reframe academic project descriptions when applying for data engineering roles at US companies. US recruiters typically spend only 6–10 seconds scanning a resume and look for concrete evidence of technical skills rather than vague course participation. The recommended formula structures each bullet as: action verb + tool or platform + task description + measurable result, replacing passive descriptions with specific technical achievements. The article also warns against using tables or columns in resumes, as applicant tracking systems like Workday and Greenhouse can misparse such formatting, and recommends submitting files in .docx format for better ATS compatibility. Additional tips include quantifying outputs with real or estimated metrics, writing descriptive English project titles instead of literal course-name translations, and combining related lab exercises into a single concise bullet.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How AI Tools Help Engineers Write and Debug LogQL Queries Faster

Developers using Grafana's Loki log aggregation platform often struggle to recall the exact syntax of LogQL, the query language used to search logs. AI assistants like Claude can rapidly generate working LogQL queries for common tasks such as label filtering, JSON field extraction, and log rate counting. However, AI models occasionally produce syntactically valid but semantically incorrect queries, such as applying PromQL-style syntax or placing high-cardinality fields in stream selectors where they do not belong. Other known failure modes include invented filter operators and incorrect use of the unwrap function, which can silently return zero or null results. The article recommends always specifying which fields are indexed stream labels versus extracted JSON fields when prompting AI, and validating outputs in Grafana's editor to catch structural errors early.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Codename One Adds Apple TV and Android TV Support via Single Codebase and CSS Media Queries

Open-source framework Codename One has extended its single-codebase approach to support Apple TV and Android TV, allowing developers to target both platforms from one Java or Kotlin project. The update introduces CN.isTV() detection APIs backed by native OS checks on both iOS and Android, enabling runtime identification of TV environments. A new CSS @media device-tv query lets developers apply ten-foot UI adjustments — such as larger fonts and prominent focus rings — directly in stylesheets without forking Java code. The same mechanism also completes previously incomplete @media support for the Apple Watch port, unifying form-factor adaptation across TV and wearable targets. Developers can set build flags to generate separate Apple TV or Android TV targets, with the feature covered by a dedicated CSS test suite and updated documentation.

0 comments Read more at DEV Community