OSV-Scanner

Features:

• Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0).
• Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default.
• Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems.
• Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans.
• Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation.
• Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings.
• Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin.

Fixes:

• Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
• Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
• Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag.
• Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
• Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges.
• Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested.

Misc:

• Update Go version to 1.26.4.
• Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
• Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857).

New Contributors

• @herdiyana256 made their first contribution in https://github.com/google/osv-scanner/pull/2801
• @zhijie-yang made their first contribution in https://github.com/google/osv-scanner/pull/2772
• @francose made their first contribution in https://github.com/google/osv-scanner/pull/2837
• @rohan-patnaik made their first contribution in https://github.com/google/osv-scanner/pull/2808
• @evilgensec made their first contribution in https://github.com/google/osv-scanner/pull/2807
• @gotgolem made their first contribution in https://github.com/google/osv-scanner/pull/2783
• @Khuzaimx made their first contribution in https://github.com/google/osv-scanner/pull/2857

Full Changelog: https://github.com/google/osv-scanner/compare/v2.3.8...v2.4.0

<picture>

<source srcset="/docs/images/osv-scanner-full-logo-darkmode.svg" media="(prefers-color-scheme: dark)">

<!-- markdown-link-check-disable-next-line -->

<img src="/docs/images/osv-scanner-full-logo-lightmode.svg">

</picture>

---

OpenSSF Scorecard

Checks

codecov

SLSA 3

GitHub Release

Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies.

OSV-Scanner provides an officially supported frontend to the OSV database and CLI interface to OSV-Scalibr that connects a project’s list of dependencies with the vulnerabilities that affect them.

OSV-Scanner supports a wide range of project types, package managers and features, including but not limited to:

• Languages: C/C++, Dart, Elixir, Go, Java, Javascript, PHP, Python, R, Ruby, Rust.
• Package Managers: npm, pip, yarn, maven, go modules, cargo, gem, composer, nuget and others.
• Operating Systems: Detects vulnerabilities in OS packages on Linux systems.
• Containers: Scans container images for vulnerabilities in their base images and included packages.
• Guided Remediation: Provides recommendations for package version upgrades based on criteria such as dependency depth, minimum severity, fix strategy, and return on investment.

OSV-Scanner uses the extensible OSV-Scalibr library under the hood to provide this functionality. If a language or package manager is not supported currently, please file a feature request.

Underlying database

The underlying database, OSV.dev has several benefits in comparison with closed source advisory databases and scanners:

• Covering most open source language and OS ecosystems (including Git), it’s comprehensive.
• Each advisory comes from an open and authoritative source (e.g. GitHub Security Advisories, RustSec Advisory Database, Ubuntu security notices)
• Anyone can suggest improvements to advisories, resulting in a very high quality database.
• The OSV format unambiguously stores information about affected versions in a machine-readable format that precisely maps onto a developer’s list of packages

The above all results in accurate and actionable vulnerability notifications, which reduces the time needed to resolve them. Check out OSV.dev for more details!

Basic installation

To install OSV-Scanner, please refer to the installation section of our documentation. OSV-Scanner releases can be found on the releases page of the GitHub repository. The recommended method is to download a prebuilt binary for your platform. Alternatively, you can use

go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest to build it from source.

Key Features

For more information, please read our detailed documentation to learn how to use OSV-Scanner. For detailed information about each feature, click their titles in this README.

Please note: These are the instructions for the latest OSV-Scanner V2 beta. If you are using V1, checkout the V1 README and documentation instead.

Scanning a source directory

$ osv-scanner scan source -r /path/to/your/dir

This command will recursively scan the specified directory for any supported package files, such as package.json, go.mod, pom.xml, etc. and output any discovered vulnerabilities.

OSV-Scanner has the option of using call analysis to determine if a vulnerable function is actually being used in the project, resulting in fewer false positives, and actionable alerts.

OSV-Scanner can also detect vendored C/C++ code for vulnerability scanning. See here for details.

Supported Lockfiles

OSV-Scanner supports 11+ language ecosystems and 19+ lockfile types. To check if your ecosystem is covered, please check out our detailed documentation.

Container Scanning

OSV-Scanner also supports comprehensive, layer-aware scanning for container images to detect vulnerabilities in the following operating system packages and language-specific dependencies.

| Distro Support | Language Artifacts Support |

| -------------- | -------------------------- |

| Alpine OS | Go |

| Debian | Java |

| Ubuntu | Node |

| | Python |

See the full documentation for details on support.

Usage:

$ osv-scanner scan image my-image-name:tag

screencast of html output of container scanning

License Scanning

Check your dependencies' licenses using deps.dev data. For a summary:

osv-scanner --licenses path/to/repository

To check against an allowed license list (SPDX format):

osv-scanner --licenses="MIT,Apache-2.0" path/to/directory

Offline Scanning

Scan your project against a local OSV database. No network connection is required after the initial database download. The database can also be manually downloaded.

osv-scanner --offline --download-offline-databases ./path/to/your/dir

Guided Remediation (Experimental)

[!WARNING]

Guided remediation (the fix command) can be risky when run on untrusted projects. It may trigger the package manager to execute scripts or follow external registries specified in the project. Please ensure you trust the source code and artifacts before proceeding.

OSV-Scanner provides guided remediation, a feature that suggests package version upgrades based on criteria such as dependency depth, minimum severity, fix strategy, and return on investment.

We currently support remediating vulnerabilities in the following files:

| Ecosystem | File Format (Type) | Supported Remediation Strategies |

| :-------- | :----------------------------- | :--------------------------------------------------------------------------------------------------------------------- |

| npm | package-lock.json (lockfile) | in-place |

| npm | package.json (manifest) | relock |

| Maven | pom.xml (manifest) | override |

This is available as a headless CLI command, as well as an interactive mode.

Example (for npm)

$ osv-scanner fix \
    --max-depth=3 \
    --min-severity=5 \
    --ignore-dev  \
    --strategy=in-place \
    -L path/to/package-lock.json

Interactive mode (for npm)

$ osv-scanner fix \
    -M path/to/package.json \
    -L path/to/package-lock.json

<img src="https://google.github.io/osv-scanner/images/guided-remediation-relock-patches.png" alt="Screenshot of the interactive relock results screen with some relaxation patches selected">

Data Sources and Privacy

OSV-Scanner communicates with the following external services during operation:

OSV.dev API

The primary data source for vulnerability information. OSV-Scanner queries this API to check packages for known vulnerabilities and to identify vendored C/C++ dependencies. Data sent includes package names, versions, ecosystems, and file hashes. Use --offline mode to disable network requests and scan against a local database instead.

deps.dev API

Used for supplementary package information:

• Dependency resolution: Resolves dependency graphs for vulnerability scanning and remediation
• Container image scanning: Queries container image metadata for vulnerability detection
• License scanning (--licenses flag): Retrieves license information for packages
• Package deprecation: Checks if packages are deprecated

Data sent includes package names, versions, and ecosystems. No source code is transmitted.

Package Registries

When using native registry for dependency resolution (instead of deps.dev), OSV-Scanner may query:

| Registry | URL | Used For |

| ------------- | ------------------------------ | ------------------------------------ |

| Maven Central | repo.maven.apache.org/maven2 | Maven package metadata and POM files |

| npm Registry | registry.npmjs.org | npm package metadata |

| PyPI | pypi.org | Python package metadata |

Contribute

Report Problems

If you have what looks like a bug, please use the GitHub issue tracking system. Before you file an issue, please search existing issues to see if your issue is already covered.

Contributing code to osv-scanner

See CONTRIBUTING.md for documentation on how to contribute code.

Star History

Star History Chart