How do you poll OSV for new advisories without a full download?

Use the modified_id.csv files in the OSV data bucket. Each line holds a timestamp and a record ID, newest first, so you can read the top of the file, stop at the last time you checked and fetch only those records. That is far cheaper than downloading the full database each time.

What OSV provides

The OSV project documents several ways to get data. It aggregates records from sources such as the GitHub Advisory Database, the Go and Rust advisory databases and others, and converts more, including Debian Security Advisories and NVD CVEs for open source software. The data is exported to a public bucket:

• A zip of every record across all ecosystems, including withdrawn ones.
• A zip per ecosystem.
• One JSON file per record, at a path made of the ecosystem and the ID.
• modified_id.csv files, at the top level and for each ecosystem, listing vulnerabilities by last modified time.

The documentation recommends the CSV files for downloading only new or updated records. These files are also available over HTTP via storage.googleapis.com.

Check the format yourself

At the time of writing, the first lines of the PyPI file look like this, with a UTC timestamp, a comma and a record ID, newest first:

2026-10-18T16:45:03.540654566Z,MAL-2026-17921
2026-10-18T13:45:02.439769873Z,PYSEC-2026-4319

Note the IDs. They are not all CVE IDs, and other prefixes appear too. Read the aliases field in each record to link them to CVEs.

A polling script

This shell sketch reads one ecosystem and prints IDs modified since a saved timestamp. Adapt it to your language of choice.

ECO=PyPI
STATE=.osv-last-$ECO
LAST=$(cat "$STATE" 2>/dev/null || echo "1970-01-01T00:00:00Z")
curl -s "https://storage.googleapis.com/osv-vulnerabilities/$ECO/modified_id.csv" \
  | awk -F, -v last="$LAST" '$1 > last {print}' > new.csv
head -1 new.csv | cut -d, -f1 > "$STATE.next"
cut -d, -f2 new.csv | while read id; do
  curl -s "https://storage.googleapis.com/osv-vulnerabilities/$ECO/$id.json" > "records/$id.json"
done
[ -s "$STATE.next" ] && mv "$STATE.next" "$STATE"

The string comparison works because the timestamps are in a fixed ISO format. Create the records directory first, and treat this as a starting point rather than production code.

What to do with new records

1. Match each record's package and version ranges against your dependency inventory.
2. Create a ticket only for matches, with the record ID and the fixed version if present.
3. Keep unmatched records out of the queue. They are not your problem today.
4. Re-run the match when your inventory changes, not only when OSV changes.

Limits to keep in mind

Records are revised after publication, which is why the file is sorted by modified time and not publication time. Withdrawn records exist too, so a record you ticketed can later be withdrawn. Check ecosystem naming rules in the OSV documentation before you match on names. Our guide on advisory ecosystem names helps with that.

Try it yourself

Click through it at your own pace, or open it full screen.

See how continuous monitoring surfaces a change without a manual pull, which is what the script above approximates.

Safeguard does this matching for you as part of dependency scanning, and a free scan shows results for a project.

Quick check

Sources

• OSV, Data sources and data dumps

Last reviewed: 19 October 2026.