Freedom251 › Software Composition Analysis Software
OSV-Scanner
What OSV-Scanner is
OSV-Scanner is a free tool for finding known vulnerabilities in a project's dependencies with the OSV database. Use it from the command line or import it as a Go library. It scans source dependencies across ecosystems such as C/C++, Dart, Go, Java, JavaScript, .NET, Python, Ruby, and Rust, using supported lockfiles and manifests. It can also inspect container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python. For dependency governance, it checks licenses with deps.dev data against an allowed SPDX license list, and it can generate SBOMs and perform reachability analysis. After downloading the OSV database initially, it can scan against a local copy without a network connection. GitHub Actions workflows cover pull requests, scheduled full scans, and releases. The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says source code is not sent to deps.dev. SLSA3-compliant binaries and release provenance data support verification. Guided remediation is experimental and has limited file coverage.
Who it suits
OSV-Scanner suits development teams that want a free dependency vulnerability scanner they can run in CI or use as a Go library. It also fits teams scanning containers, checking dependency licenses, or working with an offline local database after its initial download.
What it does well
- Free open-source scanner with CLI and Go library options.
- Scans source dependencies across many ecosystems.
- Checks container images for operating-system packages and language artifacts.
- Supports SBOM generation and reachability analysis.
- Can scan from a local OSV database offline.
- GitHub Actions workflows scan pull requests, schedules, and releases.
What to know first
- Transitive dependency scanning currently supports Maven pom.xml only.
- Computed dependency graphs do not support test dependencies.
- Guided remediation is experimental and covers specified npm and Maven files.
- Prebuilt GitHub workflows for other platforms are not currently offered.
Limits
The free plan is the OSV-Scanner CLI and Go library. Transitive dependency scanning currently covers Maven pom.xml only, computed dependency graphs omit test dependencies, and guided remediation is experimental with documented support for npm package-lock.json, package.json, and Maven pom.xml.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| OSV-Scanner | Open source scanner · CLI and Go library · SLSA3 compliant binaries | Free |
As google.github.io lists them, read 4 Oct 2026. The maker's own page has the final word.
Getting started
- Open the OSV-Scanner website.
- Choose the command-line tool or import it as a Go library.
- Use a SLSA3-compliant binary for Linux, macOS, or Windows.
- For GitHub Actions, set up a workflow for pull requests, scheduled full scans, or releases.
- For offline scans, download the local OSV database first.
Verdict
Choose OSV-Scanner if you want a free scanner with broad ecosystem coverage, container scanning, and GitHub Actions workflows. Look elsewhere if transitive scanning beyond Maven or computed graphs that include test dependencies are essential. Treat guided remediation with care in untrusted projects because it can run package-manager scripts or follow external registries.
Questions
How much does OSV-Scanner cost?
The OSV-Scanner plan is free.
Is there a free plan or trial?
It has a free plan and no free trial.
What platforms does it support?
The listed platforms are Linux, macOS, self-hosted, and Windows. SLSA3-compliant binaries are offered for Linux, macOS, and Windows.
Can it scan without a network connection?
Yes, after the initial database download it can scan against a local OSV database offline.
What does the scanner send to OSV.dev?
It sends package names, versions, ecosystems, and file hashes to the OSV.dev API. Its README says source code is not transmitted to deps.dev.
Where can users get support or contribute?
The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.
Facts from OSV-Scanner's own pages
- Build provenance
- The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification. · google.github.io, 4 Oct 2026
- Container scanning
- It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python. · github.com, 4 Oct 2026
- Data sent
- The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev. · github.com, 4 Oct 2026
- Dependency coverage
- It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation. · google.github.io, 4 Oct 2026
- Experimental remediation
- Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects. · github.com, 4 Oct 2026
- GitHub integration
- Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered. · google.github.io, 4 Oct 2026
- Known limitations
- Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph. · google.github.io, 4 Oct 2026
- License scanning
- It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list. · github.com, 4 Oct 2026
- Offline mode
- It can scan against a local OSV database without a network connection after the initial database download. · google.github.io, 4 Oct 2026
- Purpose
- OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database. · google.github.io, 4 Oct 2026
- Remediation coverage
- The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml. · github.com, 4 Oct 2026
- Support
- The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines. · github.com, 4 Oct 2026
- Ways to use
- It can be run as a command-line tool or imported as a Go library. · google.github.io, 4 Oct 2026