Create

Sign in to ReadmeX

or

How we handle your data: Privacy Policy

ReadmeX

Your AI reading companion

What would you like to catch up on?

Pick a briefing, or ask your own question.

Your community and people briefings stay personal to you.

osv-scanner

osv-scanner• Pinned

osv-scanner: Finds existing vulnerabilities affecting project dependencies.

What problem it solves

Developers need to identify known vulnerabilities across the dependencies, operating-system packages, and container layers used by their projects. They also need actionable findings and upgrade guidance for resolving affected dependencies.

Key features

  • Source-directory scanning — Recursively scans directories for supported package files and reports discovered vulnerabilities. Call analysis can determine whether a vulnerable function is used, reducing false positives.

    Source: README

  • Layer-aware container scanning — Scans container images for vulnerabilities in operating-system packages and language-specific dependencies, with support for Alpine OS, Debian, and Ubuntu images.

    Source: README

  • Offline vulnerability scanning — Scans projects against a locally downloaded OSV database. After the initial database download, no network connection is required.

    Source: README

  • License scanning — Checks dependency licenses using deps.dev data and can compare them with an allowed SPDX license list.

    Source: README

  • Guided remediation — Suggests package version upgrades based on dependency depth, minimum severity, fix strategy, and return on investment. The experimental feature supports npm and Maven files through headless and interactive modes.

    Source: README

Quick start

Copied verbatim from the project's README.

$ osv-scanner scan source -r /path/to/your/dir

Who it may suit

Inference: This may suit developers, security teams, and maintainers who need to check dependencies, container images, or operating-system packages for known vulnerabilities.

Topics to discuss

  • Which additional language ecosystems or package managers should be supported next?

  • How can guided remediation better handle complex dependency graphs and upgrade risks?

  • What workflows would make offline database updates and local scans easier to operate?

Written by ReadmeX AI from the project's README, source and public GitHub data; it may contain mistakes.

Read the original README https://github.com/google/osv-scanner#readme

ReadmeX opened this community for a trending project; it is not run by the project. Maintainers can claim it from the community page.

github.comhttps://github.com/google/osv-scanner

Comments

…