On the recordRead 11 Oct 202619 facts
Nancy
Plans and prices
Nancy
Free
Open-source command-line tool; no Nancy price stated
Read 11 Oct 2026 · github.com
On the record
- Authentication
- Nancy recommends a free Sonatype Guide bearer token; OSS Index username and token credentials remain supported but are deprecated for removal in v3.x.y.github.com · read 11 Oct 2026
- CI integrations
- The README links a Nancy GitHub Action and CircleCI Orb and includes a GitHub Actions scanning example.github.com · read 11 Oct 2026
- Compatibility limit
- Dependencies resolved by commit hash instead of proper versions are not supported by Nancy's vulnerability lookup.github.com · read 11 Oct 2026
- Container use
- Nancy can run as a Docker image, and the README describes latest, full-version, major-version, and major/minor tags.github.com · read 11 Oct 2026
- Dependency input
- Nancy works with projects using Go modules and can run `go list -json -deps ./...` itself or accept that output through a pipe.github.com · read 11 Oct 2026
- Dependency limitation
- The README says dependencies resolved by commit hash rather than proper versions are not supported by Nancy.github.com · read 11 Oct 2026
- Ignore rules
- Users can exclude vulnerabilities by CVE or Sonatype vulnerability ID using flags or files, including ignores with expiration dates.github.com · read 11 Oct 2026
- Input
- Nancy works with projects using Go modules and can run `go list -json -deps ./...` itself or read piped `go list` output.github.com · read 11 Oct 2026
- Input limit
- Nancy accepts up to 100 MB of `go list` output from stdin by default, and the limit can be adjusted.github.com · read 11 Oct 2026
- Installation
- The project offers source builds, downloadable GitHub release binaries, and Homebrew installation on macOS.github.com · read 11 Oct 2026
- Integrations
- The project documents GitHub Actions, CircleCI, Docker, and Sonatype Lifecycle integrations.github.com · read 11 Oct 2026
- License
- The Nancy repository lists the Apache-2.0 license.github.com · read 11 Oct 2026
- Output formats
- Nancy supports text, JSON, pretty JSON, and CSV output.github.com · read 11 Oct 2026
- Purpose
- Nancy checks Go dependencies for vulnerabilities using Sonatype Guide and can also scan with Sonatype Lifecycle.github.com · read 11 Oct 2026
- Scan scope
- The README says `go list -json -m all` can be used to scan all dependencies, including dependencies that do not end up in the final binary.github.com · read 11 Oct 2026
- Security and license
- The GitHub repository identifies the project as Apache-2.0 licensed and links a security policy.github.com · read 11 Oct 2026
- Support
- The maintainers say Nancy is a community project not officially supported by Sonatype, and direct users to GitHub Issues rather than Sonatype support tickets.github.com · read 11 Oct 2026
- Vulnerability database
- Nancy uses Sonatype's vulnerability database to inspect dependency files for potentially vulnerable library usage.github.com · read 11 Oct 2026
