OSV-Scanner

OSV-Scanner is Google’s free, open-source vulnerability scanner for open-source dependencies.

I put it in the baseline-SCA bucket because it is free, open source, and anchored on OSV.dev’s normalized advisory data.

With the Synopsys 2024 OSSRA report finding that 96% of commercial codebases contain open-source components, free tooling like OSV-Scanner makes baseline SCA accessible to every team.

Version 2.0, released in March 2025, transformed OSV-Scanner from a basic dependency checker into a full remediation tool with container image scanning, guided upgrade recommendations, and interactive HTML reports. The project has over 10,500 GitHub stars and is written in Go.

The latest release, v2.3.5 (March 2026), enables transitive scanning for Python requirements.txt files using the deps.dev API, giving Python projects visibility into vulnerabilities hiding in indirect dependencies.

What is OSV-Scanner?

OSV-Scanner reads your project’s manifest and lockfiles, identifies every dependency in the tree, and checks each one against the OSV.dev database. Unlike databases that rely solely on CVE identifiers, OSV.dev normalizes advisories across ecosystems so a single vulnerability affecting multiple package managers is tracked consistently.

The scanner goes beyond detection. Its guided remediation engine analyzes your dependency graph and recommends the minimum set of upgrades needed to resolve vulnerabilities, ranked by factors like dependency depth, severity, and return on investment.

What are OSV-Scanner’s key features?

Guided remediation

This is OSV-Scanner’s standout feature. Rather than dumping a list of CVEs and leaving you to figure out what to upgrade, it calculates the optimal set of dependency upgrades. The engine considers:

• Dependency depth – Direct dependencies are easier to upgrade than transitive ones
• Severity – Critical and high findings get priority
• Fix strategy – Whether to use in-place upgrades or relaxed constraints
• Return on investment – How many vulnerabilities a single upgrade resolves

Guided remediation currently supports npm (package.json / package-lock.json) and Maven (pom.xml), with more ecosystems planned.

Layer-aware container scanning

OSV-Scanner V2 doesn’t just scan container images. It understands their layer structure.

For each package found, it reports which layer introduced it, the layer history and commands, the base image, and the OS distribution.

It also filters out vulnerabilities that are unlikely to affect the container in practice, reducing noise compared to flat image scanners.

This feature currently supports Alpine, Debian, and Ubuntu-based images.

Broad ecosystem coverage

OSV-Scanner extracts dependencies from source manifests, lockfiles, and compiled artifacts.

Interactive HTML output

OSV-Scanner V2 can generate an interactive HTML report that visualizes scan results. This makes it easier to share findings with team members who do not work in the terminal, and provides filtering and sorting without additional tooling.

Installation and usage

1. Install the CLI – Use Go, Homebrew, or download a prebuilt binary from the GitHub releases page: go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest
2. Scan your project – Run osv-scanner scan -r /path/to/project to recursively scan all supported lockfiles in a directory.
3. Scan a container image – Run osv-scanner scan image image:tag to perform layer-aware scanning on a container image.
4. Get remediation advice – Run osv-scanner fix -M package.json -L package-lock.json to get guided upgrade recommendations.

# Install via Go
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latest

# Install via Homebrew
brew install osv-scanner

# Scan a directory recursively
osv-scanner scan -r .

# Scan a specific lockfile
osv-scanner scan -L package-lock.json

# Scan a container image
osv-scanner scan image alpine:latest

# Scan an SBOM
osv-scanner scan -L sbom.cdx.json

# Guided remediation for npm
osv-scanner fix -M package.json -L package-lock.json

# Guided remediation for Maven
osv-scanner fix -M pom.xml

# Output as JSON
osv-scanner scan -r . --format json

# Generate HTML report
osv-scanner scan -r . --format html > report.html

CI/CD integration

GitHub Actions

name: OSV-Scanner
on:
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 6 * * 1'

jobs:
  osv-scan:
    uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.0.0"

Note: OSV-Scanner V2 uses a reusable workflow called at the job level, not a regular action step.

OSV-Scanner also supports scheduled scanning via the osv-scanner-action/osv-reporter-action to monitor for newly disclosed vulnerabilities between code changes.

When to use OSV-Scanner

OSV-Scanner is a strong choice for teams that want a free, no-strings-attached vulnerability scanner backed by Google’s infrastructure and the broadest open-source vulnerability database available.

Strengths:

• Completely free with no usage limits or account requirements
• Guided remediation saves time on figuring out which upgrades to apply
• OSV.dev database aggregates 30+ sources for broad coverage
• Layer-aware container scanning filters irrelevant findings
• Interactive HTML reports for non-terminal users

Limitations:

• Guided remediation currently limited to npm and Maven
• No web dashboard or continuous monitoring (CLI-only)
• Container scanning restricted to Debian, Ubuntu, and Alpine images
• No license compliance scanning
• No automated fix PRs (you apply the recommendations manually)

How it compares:

Further reading: What is SCA? | SCA in CI/CD Pipelines

Frequently Asked Questions