OSV-Scanner

OSV-Scanner is Google's open-source dependency vulnerability scanner that checks your project's packages against the OSV.dev vulnerability database. Unlike Snyk or GitHub Dependabot which focus on specific ecosystems, OSV-Scanner covers virtually every package manager — npm, PyPI, RubyGems, Go modules, Cargo, Maven, NuGet, pub, and more — using a single unified database format. It scans lockfiles, SBOMs, Docker images, and source directories, producing machine-readable JSON output suitable for CI/CD integration. The guided remediation feature suggests the minimum version bumps needed to fix all vulnerabilities simultaneously, avoiding dependency hell. OSV-Scanner is designed for supply chain security at scale, with offline scanning support and SBOM generation. With nearly 9,000 GitHub stars, it is becoming a standard part of secure development pipelines alongside Trivy and Grype.