---
title: "Your app's dependency vulnerabilities: the while.sh docs"
url: https://while.sh/en/docs/building-blocks/vulnerabilities/
updated: 2026-11-09
---

# Dependency vulnerabilities

Each version of your app is checked against known vulnerabilities, at build time and then every day. A serious vulnerability to fix wakes your agent.

> You, to your agent: Are there vulnerabilities to fix before the production deployment?

## When to use it

The inventory is always there: each version is checked against the known vulnerabilities, and your agent reads them before production, with `get_app_status` { include: `["vulnerabilities"]` }.

## How it works

Each version has the list of components of its whole image, system packages included, checked against the known vulnerabilities at its build and then every day. A serious vulnerability to fix opens the "Serious vulnerabilities" incident, which wakes the agent.

## What to know

`get_app_status` { include: `["vulnerabilities"]` } lists them, checked by UpdateFOMO. A provided image (image:) is only inventoried if it carries its list of components (docker buildx build --sbom=true). The vulnerabilities of an embedded tool (esbuild…) or without a published fix are shown without opening an incident.

For the app's runtime (Python, Node.js, Ruby, PHP, Go), a vulnerability fixed only in a more recent branch stays to be watched, even high: the advice is to migrate (change branch, then test), not to update. Actively exploited (KEV list), it opens the incident anyway.

## Your agent's MCP tools

Your agent handles it with the `get_app_status` tool.