# google/osv-scanner

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

Repository: https://github.com/google/osv-scanner
Canonical: https://ross.abutalabs.com/products/osv-scanner
Homepage: https://google.github.io/osv-scanner/
Language: Go
License: Apache-2.0
License Family: permissive
Topics: scanner, security-audit, security-tools, vulnerability-scanner
Last push: 2026-08-26T21:49:07+00:00

## Health v2 (maintenance only)
Score: 99/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 99, release rhythm 98, longevity 99
- inputs: {"age_days": 1389, "days_push": 7, "days_rel": 16, "gap_med": 27, "n_releases_24m": 24}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 10924, forks 774 (observed 2026-08-28T04:10:44.695357+00:00)

## What it is
OSV-Scanner is Google's official CLI and Go library frontend to the OSV.dev vulnerability database, scanning project dependencies across many languages, package managers, OS packages, and container images. It also offers guided remediation recommendations for upgrading vulnerable packages.

## Use cases
- scan project dependencies for known vulnerabilities
- audit lockfiles in a CI/CD pipeline for CVEs
- scan container images for vulnerable OS packages
- find vulnerable npm, pip, cargo, or maven packages
- get remediation advice for upgrading dependencies
- integrate vulnerability scanning into a Go application

## When to choose
- you want an open, authoritative vulnerability database (OSV.dev) instead of closed scanners
- you need multi-language, multi-ecosystem dependency scanning in one tool
- you want CI/CD-friendly vulnerability auditing with guided fixes
- you need to scan containers and Linux OS packages too

## When to avoid
- you need runtime application security testing or SAST rather than dependency scanning
- you require a proprietary commercial scanner with support contracts
- your project uses an ecosystem not covered by OSV.dev

## Facets
- artifact type: cli-tool
- maturity: active
- function: vulnerability-scanning, security, dependency-audit, cli, developer-tools
- domain: security, developer-tools, testing
- platform: windows, cli, go
- tags: osv, sca, software-composition-analysis, containers, ci-cd, open-source-vulnerabilities, devops, linux, macos, docker

## Member repositories
- google/osv-scanner (main) score 99

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:44.695357+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:17:20.491035+00:00, confidence not recorded.
  - readme: https://github.com/google/osv-scanner (fetched 2026-08-28T04:10:44.695357+00:00, sha 6e978be5e4a7)
  - homepage: https://google.github.io/osv-scanner/ (fetched 2026-08-29T08:16:05.795539+00:00, sha 98959d20aba3)
- Data as of 2026-08-30T08:39:29.467469+00:00.