osv-scanner
Matches dependencies in a local source tree or lockfile against the OSV vulnerability database. Run it on a checkout you already have before you spend time on libraries that are already patched.
Tags: dependencies, sbom, osv
- Category
- vuln
- Maintenance signal
- active
Use this when: CI trust. Match a lockfile to published advisories.
Install
go
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latestwinget
winget install Google.OSVScannerbrew
brew install osv-scannerCommand templates
Scan a local tree
osv-scanner scan source -r {file}