CheckOps home

Tools directory

O

CheckOps

OSV-Scanner

OSV-Scanner is Google's Apache-2.0 dependency vulnerability scanner and official frontend to the OSV database, covering many languages, package managers, OS packages and containers, with guided remediation and licence checks.

Visit website

Latest public signals

Not refreshed yet. Refresh reads the public site and, when the entry has a GitHub repository, the latest release.

Visit Website

Introduction

OSV-Scanner finds existing vulnerabilities affecting your project’s dependencies. It is Google’s officially supported frontend to the OSV database (osv.dev) and a CLI to OSV-Scalibr, licensed Apache-2.0 with about 11,500 GitHub stars.

OSV is an open, distributed vulnerability database that aggregates advisories from ecosystems such as GitHub Security Advisories, PyPI, Go, Rust and many Linux distributions, using a precise, machine-readable format. That precision means OSV-Scanner can match affected versions accurately.

The README lists support for C/C++, Dart, Elixir, Go, Java, JavaScript, PHP, Python, R, Ruby and Rust; package managers including npm, pip, yarn, Maven, Go modules, Cargo, gem, Composer and NuGet; OS packages on Linux; and container images.

In the quality loop, OSV-Scanner is an SCA gate for pull requests and a scheduled scan for newly disclosed vulnerabilities in code that has not changed.

Features

  1. Lockfile and manifest scanning: Reads lockfiles and manifests across ecosystems.
  2. Container scanning: Checks base images and included packages.
  3. OS packages: Detects vulnerabilities in Linux packages.
  4. Guided remediation: Recommends upgrades based on dependency depth, severity, fix strategy and return on investment.
  5. Licence scanning: Checks dependency licences using deps.dev data.
  6. Offline mode: Download databases for air-gapped scanning.
  7. Ignore files: Configure accepted vulnerabilities with reasons.
  8. Output formats: Table, JSON, SARIF and more.

Pros

  1. Accurate data: Built on the precise OSV schema.
  2. Free: Apache-2.0, from Google.
  3. Broad ecosystems: Many languages and package managers.
  4. Remediation advice: Helps prioritise upgrades.
  5. Active: Commits on the day of review.

Cons

  1. Known vulnerabilities only: Does not find flaws in your own code.
  2. Reachability is limited: Findings may not be exploitable in your usage.
  3. Fix work remains: Upgrades can break things and need tests.
  4. CLI-centric: No built-in dashboard; use Dependency-Track or similar for portfolio views.
  5. Coverage varies: Some ecosystems have richer advisory data than others.

Scan a project recursively:

osv-scanner scan source -r ./

Scan a container image:

osv-scanner scan image my-image:latest

Tips: run on pull requests and also nightly on the default branch, because new advisories appear even when your code does not change. Record accepted risks in the config file with a reason and review date.

Resources:

Pricing

OSV-Scanner is free and open source under Apache-2.0.

  1. Development teams wanting free SCA in CI.
  2. Polyglot organisations with many package managers.
  3. Security teams standardising on OSV data.
  4. Not a fit for SAST or secrets; pair with CodeQL and Gitleaks.

Conclusion

OSV-Scanner is a free, accurate dependency scanner backed by the open OSV database, with useful remediation guidance.

Run it continuously and pair it with SAST and secret scanning for full coverage.

Alternatives

Other tools on CheckOps that cover similar ground. Open a page, or compare one with OSV-Scanner side by side.