October 15, 2025
Major Robots Updates & OSV Database Upgrade
Released October 15, 2025
This release delivers the largest data-quality and freshness upgrade in Vulners history: completely rebuilt collection robots for the most active sources and a full re-ingestion + deep integration of the Google OSV database. The result is dramatically faster detection of new disclosures, +28 % more open-source vulnerabilities covered, and significantly cleaner data.
1. Rebuilt & Accelerated Collection Robots
We rewrote the most critical parsers from scratch using parallel processing, incremental feeds, and direct vendor subscriptions.
| Source | Old average lag | New average lag | Speed improvement |
|---|---|---|---|
| Rapid7 Blog | 4–6 hours | < 25 minutes | ~12× |
| OpenSUSE | 2–3 hours | < 12 minutes | ~15× |
| Fedora | 3–5 hours | < 18 minutes | ~14× |
| HackerOne | 1–2 hours | < 8 minutes | ~10× |
| Microsoft KB | 6–24 hours | < 45 minutes | ~20× |
All other 200+ robots received performance and reliability fixes as well.
2. Complete Google OSV Database Refresh (v1.2+)
- Full re-ingestion of every OSV ecosystem (PyPI, npm, Maven, Go, Rust, crates.io, NuGet, etc.)
- Migration to the latest OSV schema with full support for GitHub Security Advisories
- Added previously missing fields: affected commits, ecosystem-specific metadata, enriched references
- Result: +187 000 new unique vulnerability records → +28 % overall open-source coverage
3. Data Quality & Deduplication Improvements
- New cross-source deduplication engine (NVD ↔ OSV ↔ vendor advisories ↔ GitHub)
- Removed > 42 000 historical duplicate objects
- Introduced
isObsoleteandwithdrawnflags for superseded entries
Benefits at a Glance
| Metric | Before | After | Improvement |
|---|---|---|---|
| Average robot lag | ~5.2 hours | ~22 minutes | 93 % faster |
| Open-source vuln records | 682 k | 869 k | +28 % |
| Duplicate objects in DB | ~68 k | ~26 k | –62 % |
| False-positive package matches | 11.4 % | 4.3 % | –61 % |
Immediate Impact for Users
- SBOM and dependency scanners now find far more real vulnerabilities
- Threat intel feeds surface 0-days and vendor patches almost instantly
- Patch Tuesday, Fedora/OpenSUSE updates appear within minutes instead of hours
- Cleaner bulk exports and data warehouse loads
All changes are live - no action required from API or UI users. You’re already getting the improved data.