OSV-Scanner
github.com/google/osv-scanner- Category
- Cybersecurity
- Rank
- No. 346Tools index
- Pricing
- Open Source
- Type
- TOOL
- Builder
- GitHub
- 11.0k stars
- Latest release
- v2.6.0
- Date
About
OSV-Scanner is a Go command-line tool that inspects a project's dependencies, lockfiles, container images, and vendored C/C++ code and reports known vulnerabilities from the open OSV.dev database. It covers 11+ language ecosystems and 19+ lockfile formats, works offline, and can check licenses. Call analysis narrows results to vulnerabilities the code actually reaches, and guided remediation suggests specific version upgrades.
What it does
OSV-Scanner inventories dependencies from project files, containers, operating system packages, and vendored code, then matches them with affected-version records. It can refine results through call analysis, produce HTML reports, check licenses, and suggest selected dependency upgrades.
Why it's ranked here
Its breadth makes it a strong practical choice for mixed repositories and container workflows. Source scanning, layer-aware image inspection, offline operation, license checks, and configurable exceptions fit real engineering work. The verdict stays qualified because the documented second-generation release is beta, while guided remediation remains experimental and narrowly supported.
What's good
Coverage spans many common language ecosystems and package managers, plus Linux operating system packages and container layers. Call analysis can identify whether vulnerable functions are actually used, reducing irrelevant alerts. Offline scanning keeps later checks local. Configuration supports expiring vulnerability ignores, package filters, and license overrides, while reporting includes embedded HTML templates.
Tradeoffs
Normal operation sends package names, versions, ecosystems, and sometimes file hashes to external services. License checks and dependency resolution also depend on supplementary package data. Guided remediation supports only npm lockfiles, npm manifests, and Maven manifests, and may execute package-manager scripts or consult registries. Container artifact coverage is limited to documented distributions and language types.
How to use it well
Use it in local development and CI for recurring dependency, container, and license checks across mixed-language repositories. Prefer offline mode where network disclosure matters, and use dated ignores with reasons. Treat remediation suggestions as reviewed changes on trusted projects. It does not replace broader source-code security analysis.
Technical notes+
The module in go.mod is github.com/google/osv-scanner/v2 and depends directly on OSV-Scalibr, OSV schema bindings, SARIF support, CycloneDX, deps.dev clients, and the Model Context Protocol Go SDK. Makefile exposes build, scanner, lint, format, documentation, short-test, acceptance-test, cassette, and snapshot workflows. internal/config/config.go implements TOML-backed vulnerability ignores, package overrides, license overrides, expiration handling, and unused-ignore tracking; internal/config/manager.go rejects unknown keys and invalid regular expressions. internal/output/html.go embeds HTML templates into the binary. internal/ci/utility.go loads serialized vulnerability results, with coverage in internal/ci/utility_test.go. internal/grouper/grouper.go merges advisories through intersecting aliases using pairwise comparison.
Observed
- Primary language
- Go
- Packaging
- Prebuilt binaries are recommended; source installation is available through the Go toolchain.
- Interface
- Command-line application with source, container-image, license, offline, and remediation workflows.
- Project coverage
- Supports C/C++, Dart, Elixir, Go, Java, JavaScript, PHP, Python, R, Ruby, and Rust projects.
- Container support
- Layer-aware scanning covers Alpine, Debian, and Ubuntu packages, plus selected Go, Java, Node, and Python artifacts.
- Test structure
- The repository includes Go tests and build controls for short, acceptance, snapshot, and recorded-network test modes.
Read from README.md, go.mod, Makefile, internal/ci/utility.go, internal/output/form.go, internal/output/html.go, internal/cmdlogger/fmt.go, internal/config/config.go, internal/config/manager.go, internal/ci/utility_test.go, internal/cmdlogger/level.go, internal/depsdev/depsdev.go, internal/grouper/grouper.go, internal/imodels/imodels.go, internal/ci/testmain_test.go.
Tags
Tech Stack
Comments (0)
No comments yet
Editorially curated, with community endorsements as a secondary signal. Corrections welcome.