google/osv-scanner
Vulnerability scanner written in Go which uses the data provided by https://osv.dev
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
3 releases in the last 90 days, the latest 26 days ago, with 131 contributors on GitHub.
Peaked at #54 in the weekly ranking the week of May 3, its best in the past year.
Use Cases & Benefits
- Provides a vulnerability scanner that detects security issues in project dependencies using the OSV.dev database.
- Offers comprehensive multi-language and multi-package manager support with accurate, actionable vulnerability detection and guided remediation.
- Use for scanning source code directories to identify vulnerable dependencies across various programming languages and package managers.
- Use for scanning container images to detect vulnerabilities in OS packages and language-specific artifacts within container layers.
- Use for offline vulnerability scanning with a locally stored OSV database to enable security audits without network connectivity.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Apache 2.0
Permissive: commercial use, modification and redistribution are allowed with attribution; includes an explicit patent grant from contributors.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
Use OSV-Scanner to find existing vulnerabilities affecting your project's dependencies. OSV-Scanner provides an officially supported frontend to the OSV database and CLI interface to OSV-Scalibr that connects a project’s list of dependencies with the vulnerabilities that affect them.
OSV-Scanner supports a wide range of project types, package managers and features, including but not limited to:
OSV-Scanner uses the extensible OSV-Scalibr library under the hood to provide this functionality. If a language or package manager is not supported currently, please file a feature request.
The underlying database, OSV.dev has several benefits in comparison with closed source advisory databases and scanners:
The above all results in accurate and actionable vulnerability notifications, which reduces the time needed to resolve them. Check out OSV.dev for more details!
To install OSV-Scanner, please refer to the installation section of our documentation. OSV-Scanner releases can be found on the releases page of the GitHub repository. The recommended method is to download a prebuilt binary for your platform. Alternatively, you can use
go install github.com/google/osv-scanner/v2/cmd/osv-scanner@latestto build it from source.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+650 stars over 90 days across 26 snapshot days; best day +22 on Aug 19.
Forks
845+96
Open issues
118-3
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Nov 8, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 69.3K | +10.7K | 75 | — |
| vxcontrol/pentagi | 33.9K | +719 | 75 | 36 days ago |
| GyulyVGC/sniffnet | 42.3K | +422 | 75 | 111 days ago |
| soxoj/maigret | 39.9K | +332 | 60 | 87 days ago |
| Asymptote-Labs/agent-beacon | 3.4K | +315 | 75 | 1 day ago |
| google/osv-scanner | 11.4K | — | 64 | 26 days ago |
| Category median | 39.9K | +422 | 75 | — |
Also by google
Other repositories from this maintainer that GStars tracks
- 54.3K stars
material-design-icons
Material Design icons by Google (Material Symbols)
- Java51.9K stars
guava
Google core libraries for Java
- JavaScript45.8K stars
zx
A tool for writing better scripts
- C++39.7K stars
googletest
GoogleTest - Google Testing and Mocking Framework
- Python39.3K stars
langextract
A Python library for extracting structured information from unstructured text using LLMs with precise source grounding and interactive visualization.
Discover Repositories
Search across tracked repositories by name or description