google/osv-scanner
Osv Scanner
osv-scanner is a software composition analysis tool and vulnerability scanner that checks project dependencies and container images against the Open Source Vulnerabilities database. It functions as a dependency remediation tool and can be integrated into custom Go applications as a programmable security library.
The project distinguishes itself through a remediation workflow that includes an interactive terminal user interface and automated scripting for upgrading vulnerable packages in lockfiles and manifests. It employs call-graph reachability analysis to determine if vulnerable code is actually invoked and utilizes layer-aware scanning to attribute vulnerabilities to specific stages of a container image.
Broad capabilities cover the identification of known security vulnerabilities, open source license compliance auditing, and the resolution of transitive dependencies. The system supports offline scanning via local database synchronization and integrates into development pipelines through pre-commit hooks and CI/CD security checks.
The scanner can be executed as a standalone command line interface or run from a Docker container.
Features
- Dependency Vulnerability Scanning - Matches project dependencies against known advisory databases to identify security vulnerabilities.
- Software Composition Analysis Tools - Identifies known security vulnerabilities and license issues in project dependencies via an advisory database.
- Dependency Lockfiles - Parses manifest and lock files to build a complete graph of direct and transitive dependencies.
- Constraint Regeneration - Recomputes the dependency graph from the manifest to allow newer package versions to resolve vulnerabilities.
- In-Place Fixes - Replaces vulnerable package versions in a lockfile while respecting existing dependency constraints.
- Transitive Dependency Resolution - Computes the full dependency graph from manifest files to ensure both direct and indirect dependencies are scanned.
- Image Layer Analyzers - Deconstructs container images into individual layers to attribute vulnerabilities to specific image stages.
- Vulnerability Auto-Remediation - Automatically updates package manifests and lockfiles to resolve identified security vulnerabilities.
- Interactive Remediation Interfaces - Provides an interactive terminal user interface for selecting and applying vulnerability patches.
- Dependency Vulnerability Scanners - Analyzes project dependencies and container images against the Open Source Vulnerabilities database.
- Automated Security Remediation - Executes vulnerability fixes in non-interactive mode for automated patching within CI/CD pipelines.
- Interactive Interfaces - Provides a terminal user interface to navigate discovered vulnerabilities and apply remediation patches step-by-step.
- Reachability Analysis - Uses call analysis to determine if a vulnerable function is actually invoked to reduce false positives.
- Container Image Vulnerability Scanners - Analyzes container image layers to detect known OS and application-layer vulnerabilities.
- Reachability Analyzers - Analyzes function call paths to determine if vulnerable code is actually reachable, reducing false positives.
- Local Data Caches - Downloads and stores vulnerability data locally to enable offline scanning and reduce network latency.
- Command Line Interfaces - Provides a terminal-based command line interface to run vulnerability scanning and management.
- Commit-Based Version Matching - Identifies vulnerabilities in C/C++ dependencies by matching specific git commit hashes against advisory data.
- Dependency Constraints - Restricts automatic dependency updates to specific semantic version levels to avoid breaking changes.
- Pre-commit Hooks - Integrates vulnerability scans into the version control commit process via pre-commit hooks.
- Programmable Scan Interfaces - Exposes scanning logic as a programmable interface for integration into external applications and internal processes.
- Version Constraint Mapping - Calculates safe package upgrades by comparing vulnerability ranges against semantic versioning rules.
- Go Library Integrations - Provides a Go library that allows scanning logic to be embedded directly into custom Go applications.
- Security Scanning Integrations - Integrates vulnerability scanning into CI/CD pipelines and git hooks to catch insecure dependencies.
- Version Overrides - Forces a specific dependency version in a manifest to resolve vulnerabilities when automatic updates fail.
- License Compliance Tools - Audits project dependencies against an allow-list of licenses to identify legal compliance risks.
- Programmable Security Libraries - Provides a programmable Go package for integrating vulnerability scanning logic directly into custom applications.
- C/C++ Vendored Dependencies - Detects vulnerabilities in vendored or submoduled C/C++ dependencies using commit-level version data.
- Remediation Filtering - Limits the scope of proposed fixes based on dependency depth, severity scores, or specific vulnerability identifiers.
- Vulnerability Report Generation - Generates summarized tables and detailed HTML reports that categorize vulnerabilities and fix availability.
- Layer Tracing - Attributes discovered vulnerabilities to the specific container layer where the affected package was first introduced.
- Offline Vulnerability Analysis - Provides a local vulnerability database to enable scanning in air-gapped or offline environments.
- License Validation Engines - Validates dependency licenses against a predefined allow-list to ensure open source compliance.
- Static Analysis - Vulnerability scanner for project dependencies.
- Vulnerability Scanners - Vulnerability scanner using the OSV database.
