Stack Gems
Menu
WorkbenchBestNewSkillsLogAboutSubmit
← Catalog

OSV-Scanner

Apache-2.0 OSV.dev vulnerability scanner for lockfiles and images

DevOps / Security · Apache-2.0 · 11.2k

Reviewed 2026-09-13 · last push 2026-10-18 · repo checked 2026-10-19

Visit siteGitHub

What's Good

Apache-2.0. google/osv-scanner. Official frontend to OSV.dev (+ OSV-Scalibr): scan source, lockfiles, SBOMs, and container images; offline DB mode; license scan path. Docs at google.github.io/osv-scanner; source github.com/google/osv-scanner. Slug is `osv-scanner`.

The Catch

Vs Trivy/Grype (broader/image-first scanners) and Syft (*SBOM producer*): OSV-Scanner is the OSV.dev-native vuln CLI, not a replacement for every Trivy filesystem/misconfig check and not the SBOM generator. Complements those tools; do not expect identical CVE sets. Networked API unless you go `--offline`.

Verdict

Apache-2.0 OSV.dev scanner. Free forever; pair with Trivy/Grype/Syft, do not clone them.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Reviewed on Stack Gems

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/osv-scanner.svg)](https://stackgems.com/gems/osv-scanner)

HTML

<a href="https://stackgems.com/gems/osv-scanner"><img src="https://stackgems.com/badge/osv-scanner.svg" alt="OSV-Scanner reviewed on Stack Gems" height="20"></a>

Related

DevOps →