ossf/osv-schema

View on GitHub

Open Source Vulnerability schema.

Stars: 271
Forks: 129
Open beginner issues: 0
Indexed issues: 52
Avg merge: 3h 46m
Merged PRs (30d): 4

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 15, 2026
Latest indexed: Sep 19, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Beginner friendly Everything

Open All

52 open issues indexed

mkashif02 Open

Difficulty 5/5 Over a week Newbie friendliness 1/100

ossf/osv-schema#604 · Opened Sep 7, 2026
Can the new severity source enum support databases other than NVD & SELF? Open

Difficulty 4/5 3-5 days Newbie friendliness 48/100

ossf/osv-schema#581 · 2 comments · Opened Jul 15, 2026
Proposal: ecosystem for AI agent "skills" (MCP / agent skill registries) Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/osv-schema#568 · 7 comments · 1 reaction · Opened Jun 21, 2026
Add machine-readable "unmaintained" status to schema Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/osv-schema#562 · 1 comment · Opened Jun 15, 2026
Tighten guidelines on acceptable IDs Open

Difficulty 3/5 1-2 days Newbie friendliness 58/100

ossf/osv-schema#547 · 1 reaction · Opened May 7, 2026
Suggestion: addition of a `metadata` field for normative, linter-validated subfields Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#518 · 1 reaction · Opened Feb 23, 2026
Suggestion: addition of a `symbols` field Open

discussion enhancement

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#501 · 1 comment · 7 reactions · Opened Jan 23, 2026
Optionally have overall CVSS score in severity Open

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/osv-schema#495 · 1 comment · Opened Jan 19, 2026
Create SAST check and require status check pass before changes can be merged Open

security baseline

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#492 · Opened Jan 14, 2026
Document threshold for remediation of SAST finding Open

security baseline

Difficulty 2/5 Half a day Newbie friendliness 35/100

ossf/osv-schema#491 · Opened Jan 14, 2026
Enable SCA and require status check pass before changes can be merged Open

security baseline

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/osv-schema#490 · 1 comment · Opened Jan 14, 2026
Document policy to address SCA violations prior to release Open

security baseline

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/osv-schema#489 · Opened Jan 14, 2026
Define SCA finding threshold for remediation Open

security baseline

Difficulty 4/5 3-5 days Newbie friendliness 35/100

ossf/osv-schema#488 · Opened Jan 14, 2026
Create policy for publishing VEX documents Open

security baseline

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#487 · Opened Jan 14, 2026
Perform threat modeling Open

security baseline

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#486 · Opened Jan 14, 2026
Create policy for adding or updating tests Open

security baseline

Difficulty 2/5 1-3 hours Newbie friendliness 45/100

ossf/osv-schema#485 · Opened Jan 14, 2026
Document when and how tests are run Open

security baseline

Difficulty 2/5 1-3 hours Newbie friendliness 55/100

ossf/osv-schema#484 · Opened Jan 14, 2026
Document when releases or versions will no longer receive security updates Open

security baseline

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/osv-schema#483 · Opened Jan 14, 2026
Document scope and duration of support for each release Open

security baseline

Difficulty 3/5 1-2 days Newbie friendliness 35/100

ossf/osv-schema#482 · Opened Jan 14, 2026
Release must include instructions for release author identity verification Open

security baseline

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/osv-schema#481 · 1 comment · Opened Jan 14, 2026
Define a policy for managing secrets and credentials used by the project Open

security baseline

Difficulty 5/5 Over a week Newbie friendliness 30/100

ossf/osv-schema#480 · Opened Jan 14, 2026
Clarify the usage of "limit" and "fixed" in GIT ranges. Open

Difficulty 3/5 1-2 days Newbie friendliness 45/100

ossf/osv-schema#468 · Opened Dec 5, 2025
Incorrect 'fixed' version for some Red Hat packages Open

ossf/osv-schema#422 · 2 comments · 1 assignee · Opened Sep 18, 2025
Create a dependencies policy Open

security baseline

ossf/osv-schema#369 · 2 comments · 2 assignees · Opened Jul 24, 2025
Review users with admin role to osv-schema project Open

security baseline

Difficulty 4/5 3-5 days Newbie friendliness 25/100

ossf/osv-schema#368 · Opened Jul 24, 2025
Support CMSS as a severity type Open

Difficulty 4/5 3-5 days Newbie friendliness 45/100

ossf/osv-schema#359 · 2 comments · Opened Jun 17, 2025
Entries about malicious packages not in "MAL-" namespace Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#348 · 1 comment · Opened Apr 15, 2025
Add 'known_affected' OSV Red Hat data Open

Difficulty 4/5 3-5 days Newbie friendliness 38/100

ossf/osv-schema#338 · 2 comments · Opened Feb 25, 2025
Support ecosystem severity under severity[] Open

discussion proposal

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#323 · 30 comments · Opened Dec 18, 2024
Deprecate `SEMVER` range type. Open

Difficulty 2/5 1-3 hours Newbie friendliness 35/100

ossf/osv-schema#314 · 5 comments · 1 reaction · Opened Nov 26, 2024
osv-linter additional checks Open

ossf/osv-schema#311 · 6 comments · 1 assignee · Opened Nov 11, 2024
Machine readable encoding for configurations Open

discussion

Difficulty 5/5 Over a week Newbie friendliness 20/100

ossf/osv-schema#281 · Opened Sep 13, 2024
Formally include Common Weakness Enumeration (CWE) in the schema Open

discussion enhancement

ossf/osv-schema#254 · 7 comments · 2 reactions · 1 assignee · Opened Jul 26, 2024
Additional range types for versions conforming to the RPM and Debian versioning standards Open

discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#252 · 2 comments · Opened Jul 16, 2024
Encoding binary packages for linux distros Open

discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#202 · 9 comments · 1 reaction · Opened Sep 15, 2023
Provide official language bindings for the OSV schema Open

Difficulty 5/5 Over a week Newbie friendliness 20/100

ossf/osv-schema#187 · Opened Jul 27, 2023
Difference between "fixed" and "limit" is confusing Open

Difficulty 3/5 1-2 days Newbie friendliness 25/100

ossf/osv-schema#169 · Opened Jun 27, 2023
Add separate field for withdrawn reason & add guidelines for withdrawing Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/osv-schema#160 · 2 comments · Opened Jun 18, 2023
Consider supporting embedded CPEs in package URLs Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#155 · Opened May 16, 2023
Add EPSS as type to severity Open

Difficulty 2/5 1-3 hours Newbie friendliness 30/100

ossf/osv-schema#144 · 14 comments · 4 reactions · Opened Apr 4, 2023
Unified field for describing affected functions Open

discussion

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#127 · 9 comments · Opened Mar 28, 2023
Ecosystem support for tooling that is outside of the language or os specific package management system Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#94 · 22 comments · 1 reaction · Opened Nov 1, 2022
Moving #545 in osv.dev over to this repository Open

Difficulty 5/5 Over a week Newbie friendliness 15/100

ossf/osv-schema#92 · Opened Oct 18, 2022
additional affected:ranges entry suggestion Open

Difficulty 5/5 Over a week Newbie friendliness 30/100

ossf/osv-schema#91 · Opened Oct 12, 2022
Tooling for schema validation Open

ossf/osv-schema#90 · 6 comments · 3 reactions · 1 assignee · Opened Oct 11, 2022
Add a "first_not_affected" field or similar to properly describe all possible ranges for affected packages Open

Difficulty 5/5 Over a week Newbie friendliness 35/100

ossf/osv-schema#75 · 4 comments · Opened Jul 29, 2022
Define a protocol / conventions for discovery Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#64 · 3 comments · Opened Jul 11, 2022
Expand vuln id relationships Open

Difficulty 5/5 Over a week Newbie friendliness 25/100

ossf/osv-schema#53 · 9 comments · Opened Jun 28, 2022
Enable GHSA to consolidate `affected` entries Open

Difficulty 5/5 Over a week Newbie friendliness 24/100

ossf/osv-schema#35 · 15 comments · 1 reaction · Opened Mar 3, 2022
Severity schema should it be a map rather than an array? Open

ossf/osv-schema#34 · 3 comments · 1 assignee · Opened Mar 2, 2022

ossf/osv-schema

Get new issues in your inbox