OSV-Scanner

6.9easy start · #13 of 65
in Software Composition Analysis Software

Free to practise onyes
Free trialnot on record
Well documentedyes
Runs where you workyes

Runs on Linux, Mac, self-hosted, Windows.

OSV-Scanner is ranked #13 of 65 in software composition analysis software on The Geeks Club. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OSV-Scanner plans and pricing

All plans

OSV-Scanner Free Open source scanner · CLI and Go library · SLSA3 compliant binaries google.github.io · 4 Oct 2026

Compared on software composition analysis software

Free plan: Yes
Supported ecosystems: C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGet
SBOM generation: Yes
Reachability analysis: Yes
Pull request scanning: Yes
Deployment options: self_hosted

Best OSV-Scanner alternatives

See all 20

Sonatype Nexus Repository 0 of 4 in the starter kit Lesson 18.0 Xygeni 0 of 4 in the starter kit Lesson 27.9 FOSSA 0 of 4 in the starter kit Lesson 37.7 Snyk Open Source 0 of 4 in the starter kit Lesson 47.4 Docker Desktop 0 of 4 in the starter kit Lesson 57.3 Socket 0 of 4 in the starter kit Lesson 67.3

The record

Purpose: OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database.
Ways to use: It can be run as a command-line tool or imported as a Go library.
Dependency coverage: It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation.
Container scanning: It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python.
License scanning: It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list.
Offline mode: It can scan against a local OSV database without a network connection after the initial database download.
GitHub integration: Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered.
Build provenance: The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification.
Data sent: The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev.
Experimental remediation: Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects.
Remediation coverage: The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml.
Known limitations: Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph.
Support: The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.
Price from: Free

Where it ranks on The Geeks Club

Best Software Composition Analysis Software in 2026#13 of 65

Is OSV-Scanner yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OSV-Scanner

Sources

google.github.io/osv-scanner/· checked 4 Oct 2026
google.github.io/osv-scanner/supported-languages-and-loc· checked 4 Oct 2026
github.com/google/osv-scanner· checked 4 Oct 2026
google.github.io/osv-scanner/usage/offline-mode/· checked 4 Oct 2026
google.github.io/osv-scanner/github-action/· checked 4 Oct 2026
google.github.io/osv-scanner/installation/· checked 4 Oct 2026