Nancy
github.com
Spec sheet
- Purpose
- Nancy checks Go dependencies for vulnerabilities using Sonatype Guide and can also scan with Sonatype Lifecycle.Read 11 Oct 2026 · github.com
- Integrations
- The project documents GitHub Actions, CircleCI, Docker, and Sonatype Lifecycle integrations.Read 11 Oct 2026 · github.com
- Support
- The maintainers say Nancy is a community project not officially supported by Sonatype, and direct users to GitHub Issues rather than Sonatype support tickets.Read 11 Oct 2026 · github.com
- License
- The Nancy repository lists the Apache-2.0 license.Read 11 Oct 2026 · github.com
- Authentication
- Nancy recommends a free Sonatype Guide bearer token; OSS Index username and token credentials remain supported but are deprecated for removal in v3.x.y.Read 11 Oct 2026 · github.com
- CI integrations
- The README links a Nancy GitHub Action and CircleCI Orb and includes a GitHub Actions scanning example.Read 11 Oct 2026 · github.com
- Compatibility limit
- Dependencies resolved by commit hash instead of proper versions are not supported by Nancy's vulnerability lookup.Read 11 Oct 2026 · github.com
- Container use
- Nancy can run as a Docker image, and the README describes latest, full-version, major-version, and major/minor tags.Read 11 Oct 2026 · github.com
- Dependency input
- Nancy works with projects using Go modules and can run `go list -json -deps ./...` itself or accept that output through a pipe.Read 11 Oct 2026 · github.com
- Dependency limitation
- The README says dependencies resolved by commit hash rather than proper versions are not supported by Nancy.Read 11 Oct 2026 · github.com
- Ignore rules
- Users can exclude vulnerabilities by CVE or Sonatype vulnerability ID using flags or files, including ignores with expiration dates.Read 11 Oct 2026 · github.com
- Input
- Nancy works with projects using Go modules and can run `go list -json -deps ./...` itself or read piped `go list` output.Read 11 Oct 2026 · github.com
- Input limit
- Nancy accepts up to 100 MB of `go list` output from stdin by default, and the limit can be adjusted.Read 11 Oct 2026 · github.com
- Installation
- The project offers source builds, downloadable GitHub release binaries, and Homebrew installation on macOS.Read 11 Oct 2026 · github.com
- Output formats
- Nancy supports text, JSON, pretty JSON, and CSV output.Read 11 Oct 2026 · github.com
- Scan scope
- The README says `go list -json -m all` can be used to scan all dependencies, including dependencies that do not end up in the final binary.Read 11 Oct 2026 · github.com
- Security and license
- The GitHub repository identifies the project as Apache-2.0 licensed and links a security policy.Read 11 Oct 2026 · github.com
- Vulnerability database
- Nancy uses Sonatype's vulnerability database to inspect dependency files for potentially vulnerable library usage.Read 11 Oct 2026 · github.com
- Vulnerability exclusions
- Users can exclude vulnerabilities by CVE or Sonatype vulnerability ID, including with dated expiring ignores.Read 11 Oct 2026 · github.com
Plans and prices
Nancy Free Open-source command-line tool; no Nancy price stated Read 11 Oct 2026 · github.com
Where Specifiction places it
- Software Composition Analysis Software#13 of 658.2
Alternatives to NancyAll alternatives →
Endor Labs Free plan 8.9 Visit 
DepWarden From $19/mo · Free plan 8.7 Visit 
Eclipse Steady Free plan 8.6 Visit 
Mend SCA From $20.83/mo 8.6 Visit 
Scantist Free plan 8.6 Visit