osv-scanner scans dependencies for known vulnerabilities, leveraging the OSV database as its primary data source. It connects a project’s dependency list with vulnerability information, providing actionable alerts. This project addresses the need for a reliable and comprehensive vulnerability scanning tool, offering an alternative to closed-source solutions.
osv-scanner aims to provide a comprehensive and up-to-date vulnerability database utilizing the OSV database. It supports diverse languages, package managers, and container image scanning. It includes guided remediation functionality to suggest fixes, and offers optional offline scanning for environments without network access.
- Source Directory Scanning: Recursively scans project directories for vulnerabilities in various package formats (e.g.,
package.json,pom.xml). - Container Image Scanning: Detects vulnerabilities within container images, including base images and included packages.
- License Scanning: Checks dependencies for SPDX license compliance per directory or file.
- Guided Remediation: Suggests version upgrades for vulnerabilities based on severity, depth, and other factors.
- Offline Scanning: Enables scanning without requiring a network connection after the initial database download.
- Language and Package Manager Support: Supports a wide variety of languages and package managers for comprehensive vulnerability coverage.
- Data Sources: Queries OSV.dev and deps.dev APIs to resolve dependencies, gather metadata, and check for licenses.
osv-scanner is actively maintained, with regular updates and bug fixes. The project has a strong community presence and a clear roadmap. Documentation is comprehensive and includes usage examples, making it easy to integrate into existing workflows. Recent commits and issue resolution indicate ongoing development and support.
osv-scanner benefits developers by automating the identification and remediation of vulnerabilities in project dependencies. It reduces manual effort, improves security posture, and provides actionable insights based on comprehensive, open-source data, addressing a critical need in modern software development practices.