google/osv-scanner

Features

• Dependency Vulnerability Scanning - Matches project dependencies against known advisory databases to identify security vulnerabilities.
• Software Composition Analysis Tools - Identifies known security vulnerabilities and license issues in project dependencies via an advisory database.
• Dependency Lockfiles - Parses manifest and lock files to build a complete graph of direct and transitive dependencies.
• Constraint Regeneration - Recomputes the dependency graph from the manifest to allow newer package versions to resolve vulnerabilities.
• In-Place Fixes - Replaces vulnerable package versions in a lockfile while respecting existing dependency constraints.
• Transitive Dependency Resolution - Computes the full dependency graph from manifest files to ensure both direct and indirect dependencies are scanned.
• Image Layer Analyzers - Deconstructs container images into individual layers to attribute vulnerabilities to specific image stages.
• Vulnerability Auto-Remediation - Automatically updates package manifests and lockfiles to resolve identified security vulnerabilities.
• Interactive Remediation Interfaces - Provides an interactive terminal user interface for selecting and applying vulnerability patches.
• Dependency Vulnerability Scanners - Analyzes project dependencies and container images against the Open Source Vulnerabilities database.
• Automated Security Remediation - Executes vulnerability fixes in non-interactive mode for automated patching within CI/CD pipelines.
• Interactive Interfaces - Provides a terminal user interface to navigate discovered vulnerabilities and apply remediation patches step-by-step.
• Reachability Analysis - Uses call analysis to determine if a vulnerable function is actually invoked to reduce false positives.
• Container Image Vulnerability Scanners - Analyzes container image layers to detect known OS and application-layer vulnerabilities.
• Reachability Analyzers - Analyzes function call paths to determine if vulnerable code is actually reachable, reducing false positives.
• Local Data Caches - Downloads and stores vulnerability data locally to enable offline scanning and reduce network latency.
• Command Line Interfaces - Provides a terminal-based command line interface to run vulnerability scanning and management.
• Commit-Based Version Matching - Identifies vulnerabilities in C/C++ dependencies by matching specific git commit hashes against advisory data.
• Dependency Constraints - Restricts automatic dependency updates to specific semantic version levels to avoid breaking changes.
• Pre-commit Hooks - Integrates vulnerability scans into the version control commit process via pre-commit hooks.
• Programmable Scan Interfaces - Exposes scanning logic as a programmable interface for integration into external applications and internal processes.
• Version Constraint Mapping - Calculates safe package upgrades by comparing vulnerability ranges against semantic versioning rules.
• Go Library Integrations - Provides a Go library that allows scanning logic to be embedded directly into custom Go applications.
• Security Scanning Integrations - Integrates vulnerability scanning into CI/CD pipelines and git hooks to catch insecure dependencies.
• Version Overrides - Forces a specific dependency version in a manifest to resolve vulnerabilities when automatic updates fail.
• License Compliance Tools - Audits project dependencies against an allow-list of licenses to identify legal compliance risks.
• Programmable Security Libraries - Provides a programmable Go package for integrating vulnerability scanning logic directly into custom applications.
• C/C++ Vendored Dependencies - Detects vulnerabilities in vendored or submoduled C/C++ dependencies using commit-level version data.
• Remediation Filtering - Limits the scope of proposed fixes based on dependency depth, severity scores, or specific vulnerability identifiers.
• Vulnerability Report Generation - Generates summarized tables and detailed HTML reports that categorize vulnerabilities and fix availability.
• Layer Tracing - Attributes discovered vulnerabilities to the specific container layer where the affected package was first introduced.
• Offline Vulnerability Analysis - Provides a local vulnerability database to enable scanning in air-gapped or offline environments.
• License Validation Engines - Validates dependency licenses against a predefined allow-list to ensure open source compliance.
• Vulnerability Scanners - Vulnerability scanner using the OSV database.

Star history