To know whether you run a component named in the news, search four places: your dependency manifests and lockfiles, your built images and artifacts, your vendors' software, and your running hosts. A current software inventory turns this from a day of searching into a few minutes. Direct dependencies are easy. The nested ones are where surprises hide.
Place 1: manifests and lockfiles
Search every repository for the package name in manifests and lockfiles. A lockfile shows the resolved version, which is the one that matters. Check the transitive entries too: you may never have chosen the affected library, but something you did choose may pull it in.
Place 2: built artifacts and images
What you build is not always what the source says. A container image may include an operating system package or a vendored copy of a library that no manifest lists. Look at what the image really contains, not only what the repository declares.
Place 3: vendor and third party software
Some of the exposure sits in products you buy or install. The vendor's advisory should say whether their product is affected and which fixed version to use. If it does not, ask them and note the date. Hosted services are usually fixed by the provider, which the advisory normally says.
Place 4: running systems
Check what is actually deployed. Old services, forgotten test hosts and one off tools often run versions nobody tracks. A list of running software and versions per host, even a rough one, answers "where" quickly.
Click through it at your own pace, or open it full screen.
Name mismatches
The headline uses a product name. Your files use package names, and different ecosystems use different identifiers for the same project. Search for several spellings, and read the advisory's list of affected package names. A vendor may also rename a component between releases.
Record the result
For each match write the repository or host, the version, whether it is in the affected range, and the owner. For a no match, write what you searched and when. "Searched all 40 repositories and the production image list on 19 October, no match" is a useful sentence.
Make the next one faster
Keep an inventory that is generated, not typed by hand: a software bill of materials per build, refreshed on every release. Safeguard can generate SBOMs and scan dependencies, and its free scan at https://gold.safeguard.sh/scan lets you check a project without setting anything up. Whatever tool you use, the goal is that the answer to "do we run this?" is a lookup.
Quick check
What if I cannot find the component but the advisory says it is bundled?
Look inside vendor products and images, and ask the vendor which versions of their product include it.
How far back should I check?
Check what is deployed now, then any older versions still in use or kept for rollback.
Last reviewed: 19 October 2026.
