- Home
- Software Composition Analysis Software
- OSV-Scanner
On the recordRead 4 Oct 202613 facts
OSV-Scanner
Plans and prices
OSV-Scanner
Free
Open source scanner · CLI and Go library · SLSA3 compliant binaries
Read 4 Oct 2026 · google.github.io
On the record
- Build provenance
- The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification.google.github.io · read 4 Oct 2026
- Container scanning
- It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python.github.com · read 4 Oct 2026
- Data sent
- The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev.github.com · read 4 Oct 2026
- Dependency coverage
- It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation.google.github.io · read 4 Oct 2026
- Experimental remediation
- Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects.github.com · read 4 Oct 2026
- GitHub integration
- Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered.google.github.io · read 4 Oct 2026
- Known limitations
- Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph.google.github.io · read 4 Oct 2026
- License scanning
- It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list.github.com · read 4 Oct 2026
- Offline mode
- It can scan against a local OSV database without a network connection after the initial database download.google.github.io · read 4 Oct 2026
- Purpose
- OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database.google.github.io · read 4 Oct 2026
- Remediation coverage
- The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml.github.com · read 4 Oct 2026
- Support
- The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.github.com · read 4 Oct 2026
- Ways to use
- It can be run as a command-line tool or imported as a Go library.google.github.io · read 4 Oct 2026
