google/osv-scanner
Vulnerability scanner written in Go which uses the data provided by https://osv.dev observed · 2026-08-28
Health v2 · maintenance only
99/100
- Activity 99
- Release rhythm 98
- Longevity 99
How is this computed?
round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10) — computed 2026-09-03. Adoption (stars, forks) is never an input.
- gap_med: 27
- age_days: 1389
- days_rel: 16
- days_push: 7
- n_releases_24m: 24
Adoption not part of the score
10924 stars · 774 forks observed · 2026-08-28
What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded
OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across many languages, package managers, OS packages, and container images. It also offers guided remediation recommendations for upgrading vulnerable packages.
Use cases
- scan project dependencies for known vulnerabilities
- audit lockfiles in a CI/CD pipeline for CVEs
- scan container images for vulnerable OS packages
- find vulnerable npm, pip, cargo, or maven packages
- get remediation advice for upgrading dependencies
- integrate vulnerability scanning into a Go application
When to choose
- you want an open, authoritative vulnerability database (OSV.dev) instead of closed scanners
- you need multi-language, multi-ecosystem dependency scanning in one tool
- you want CI/CD-friendly vulnerability auditing with guided fixes
- you need to scan containers and Linux OS packages too
When to avoid
- you need runtime application security testing or SAST rather than dependency scanning
- you require a proprietary commercial scanner with support contracts
- your project uses an ecosystem not covered by OSV.dev
Facets
cli-tool · maturity active
vulnerability-scanning security dependency-audit cli developer-tools security developer-tools testing windows cli go osv sca software-composition-analysis containers ci-cd open-source-vulnerabilities devops linux macos docker
2 sources
- readme: https://github.com/google/osv-scanner · fetched 2026-08-28 · 6e978be5e4a7
- homepage: https://google.github.io/osv-scanner/ · fetched 2026-08-29 · 98959d20aba3
Member repositories
| Repository | Role | Health v2 |
|---|---|---|
| google/osv-scanner | main | 99 |
For agents
markdown · JSON · MCP: product_card(name="google/osv-scanner")
Data as of 2026-08-30T08:39:29.467469+00:00 · Report a problem