OSV-Scanner
Google's open-source software composition analyzer that maps project dependencies to vulnerabilities via the OSV database and to license risks via deps.dev.
Technical Architecture & Overview
OSV-Scanner is an open-source software composition analysis tool that connects a project's dependencies with vulnerabilities in the OSV.dev database. It supports license scanning, container image scanning, and generating dependency graphs for multiple ecosystems.
Targeted Technical Use Cases
Auditing open-source dependencies for known vulnerabilities and license compliance in CI/CD.
Evaluation & Trade-offs
Core Strengths
- +Uses the open and distributed OSV.dev vulnerability database.
- +Supports many language ecosystems and container image metadata.
- +Provides JSON, SARIF, and CycloneDX output formats.
Trade-Offs & Limitations
- -Vulnerability coverage depends on the OSV database and supported ecosystems.
- -Does not perform proprietary source code SAST.
Defensive Security Application
Blocking builds that contain dependencies with known CVEs or incompatible licenses.
Frequently Asked Questions
What is OSV-Scanner?→
OSV-Scanner is an open-source software composition analysis tool that connects a project's dependencies with vulnerabilities in the OSV.dev database. It supports license scanning, container image scanning, and generating dependency graphs for multiple ecosystems.
What is OSV-Scanner used for?→
Auditing open-source dependencies for known vulnerabilities and license compliance in CI/CD.
What are the strengths of OSV-Scanner?→
- +Uses the open and distributed OSV.dev vulnerability database.
- +Supports many language ecosystems and container image metadata.
- +Provides JSON, SARIF, and CycloneDX output formats.
What are the limitations of OSV-Scanner?→
- +Vulnerability coverage depends on the OSV database and supported ecosystems.
- +Does not perform proprietary source code SAST.
How is OSV-Scanner used defensively?→
Blocking builds that contain dependencies with known CVEs or incompatible licenses.