OSV-Scanner

Spec sheet

Purpose

OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database.Read 4 Oct 2026 · google.github.io

Support

The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.Read 4 Oct 2026 · github.com

Build provenance

The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification.Read 4 Oct 2026 · google.github.io

Container scanning

It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python.Read 4 Oct 2026 · github.com

Data sent

The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev.Read 4 Oct 2026 · github.com

Dependency coverage

It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation.Read 4 Oct 2026 · google.github.io

Experimental remediation

Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects.Read 4 Oct 2026 · github.com

GitHub integration

Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered.Read 4 Oct 2026 · google.github.io

Known limitations

Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph.Read 4 Oct 2026 · google.github.io

License scanning

It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list.Read 4 Oct 2026 · github.com

Offline mode

It can scan against a local OSV database without a network connection after the initial database download.Read 4 Oct 2026 · google.github.io

Remediation coverage

The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml.Read 4 Oct 2026 · github.com

Ways to use

It can be run as a command-line tool or imported as a Go library.Read 4 Oct 2026 · google.github.io

Plans and prices

Every OSV-Scanner plan and price →

Where Specifiction places it

• Software Composition Analysis Software#40 of 657.7