# osv-scanner | Google | Knowledge Base | Instagit

Vulnerability scanner written in Go which uses the data provided by https://osv.dev

GitHub Stars: 9.7k

Repository: https://github.com/google/osv-scanner

---

## Articles

### [How OSV-Scanner's Version Matching Algorithm Works for Accurate Vulnerability Detection](/google/osv-scanner/how-osv-scanner-version-matching-vulnerability-detection)

Discover how OSV-Scanner's version matching algorithm accurately detects vulnerabilities using semantic versioning, explicit lists, and commit hash matching for precise security analysis.

- Tags: internals
- Published: 2026-04-25

### [Troubleshooting OSV-Scanner Scanning Issues: A Complete Guide to Fixing Common Errors](/google/osv-scanner/troubleshoot-common-osv-scanner-scanning-issues)

Fix osv-scanner scanning issues like no packages found or extraction errors. Learn troubleshooting steps for lockfiles, exclude patterns, and extractor plugins.

- Tags: how-to-guide
- Published: 2026-04-25

### [Internal Architecture of the OSV-Scanner Security Scanning Engine: A Deep Dive into the Source Code](/google/osv-scanner/internal-architecture-osv-scanner-scanning-engine)

Explore the internal architecture of the OSV-Scanner security scanning engine. Discover how it transforms source code into vulnerability reports via its pipeline. Learn more.

- Tags: deep-dive
- Published: 2026-04-25

### [How osv-scanner Processes CycloneDX SBOM Files for Security Analysis](/google/osv-scanner/how-osv-scanner-process-cyclonedx-sbom-files)

Learn how osv-scanner processes CycloneDX SBOM files for security analysis. Discover component details and vulnerability mapping for enhanced software supply chain security.

- Tags: how-to-guide
- Published: 2026-04-25

### [How to Configure Package Overrides in the OSV-Scanner Configuration File](/google/osv-scanner/how-to-configure-package-overrides-osv-scanner-config)

Learn to configure package overrides in the osv-scanner configuration file create an osv-scanner.toml file to manage vulnerabilities by defining ignore and override actions for specific packages.

- Tags: how-to-guide
- Published: 2026-04-25

### [How OSV-Scanner Groups Related Vulnerabilities and Manages Aliases](/google/osv-scanner/how-osv-scanner-group-vulnerabilities-manage-aliases)

Discover how OSV-Scanner groups related vulnerabilities by converting OSV records to ID-alias representations and merging them using a union-find algorithm. Learn alias management.

- Tags: internals
- Published: 2026-04-25

### [Functional Difference Between OSV-Scanner's --recursive and --no-ignore Flags](/google/osv-scanner/difference-osv-scanner-recursive-no-ignore-flags)

Understand osv-scanner's --recursive and --no-ignore flags. Discover how recursive scans find lockfiles in subdirectories and --no-ignore forces inclusion of ignored files.

- Tags: how-to-guide
- Published: 2026-04-25

### [How OSV-Scanner Handles Deprecated Packages: Detection, Filtering, and Reporting](/google/osv-scanner/how-osv-scanner-handle-deprecated-package-vulnerabilities)

Learn how OSV-Scanner detects, filters, and reports deprecated packages. Discover security findings even without CVEs using its dedicated deprecation plugin.

- Tags: deep-dive
- Published: 2026-04-25

### [How to Use Experimental Exclude Patterns in osv-scanner Scans](/google/osv-scanner/how-to-use-experimental-exclude-patterns-osv-scanner-scans)

Learn how to use experimental exclude patterns in osv-scanner scans with the --experimental-exclude flag. Skip directories using exact matches, globs, or regex for precise vulnerability scanning.

- Tags: how-to-guide
- Published: 2026-04-25

### [How osv-scanner Determines and Assigns Severity Ratings to Detected Vulnerabilities](/google/osv-scanner/how-osv-scanner-determine-severity-ratings-vulnerabilities)

Learn how osv-scanner assigns severity ratings. It parses CVSS vectors and Ubuntu severities, calculates scores using go-cvss, and converts them to Critical/High/Medium/Low for clear reporting.

- Tags: deep-dive
- Published: 2026-04-25

### [MCP Server Integration in OSV-Scanner: Complete Guide to LLM-Based Vulnerability Scanning](/google/osv-scanner/mcp-server-integration-osv-scanner-usage)

Master MCP server integration in OSV-Scanner for LLM-based vulnerability scanning. Access dependency scans and advisory details via JSON-RPC. Explore the complete guide.

- Tags: deep-dive
- Published: 2026-04-25

### [How OSV-Scanner Analyzes Transitive Dependencies for Vulnerabilities](/google/osv-scanner/how-osv-scanner-transitive-dependency-vulnerability-analysis)

Learn how OSV-Scanner analyzes transitive dependencies to find vulnerabilities. Discover its use of deps.dev and the OSV database for comprehensive security scanning.

- Tags: deep-dive
- Published: 2026-04-25

### [How OSV-Scanner License Scanning Works with SPDX Allowlists](/google/osv-scanner/how-osv-scanner-license-scanning-spdx-allowlists)

Learn how OSV-Scanner performs license scanning using SPDX allowlists and boolean logic to identify violations. Get actionable insights for your project.

- Tags: how-to-guide
- Published: 2026-04-25

### [OSV-Scanner Output Formats: JSON, SARIF, CycloneDX, and 7 Other Formats](/google/osv-scanner/osv-scanner-output-formats-json-sarif)

Explore OSV-Scanner's 10 output formats for scan results, including JSON, SARIF, CycloneDX, and SPDX. Easily generate reports with the --format flag.

- Tags: api-reference
- Published: 2026-04-25

### [How to Integrate OSV-Scanner with GitHub Actions: Complete Setup Guide](/google/osv-scanner/integrate-osv-scanner-github-actions-workflows)

Integrate OSV-Scanner with GitHub Actions seamlessly. Learn how to leverage reusable workflows for automatic SARIF result uploads to GitHub Code Scanning. Get the complete setup guide.

- Tags: how-to-guide
- Published: 2026-04-25

### [How the osv-scanner fix Command Automates Vulnerability Patching for npm and Maven](/google/osv-scanner/how-osv-scanner-fix-command-automate-vulnerability-patching-npm-maven)

Automate npm and Maven vulnerability patching with osv-scanner fix. Discover how it builds dependency graphs, finds vulns, and applies patches for secure code.

- Tags: how-to-guide
- Published: 2026-04-25

### [Package Managers and Lockfile Formats Supported by OSV-Scanner](/google/osv-scanner/package-managers-lockfile-formats-supported-osv-scanner)

Discover the 15+ package managers like npm, Maven, PyPI, and Go modules supported by OSV-Scanner. Learn which lockfile formats it parses for comprehensive vulnerability scanning.

- Tags: supported-features
- Published: 2026-04-25

### [How OSV-Scanner Enables Layer-Aware Scanning for Container Images](/google/osv-scanner/how-osv-scanner-layer-aware-scanning-container-images)

Discover how OSV-Scanner performs layer-aware scanning for container images. Learn how its integration with Scalibr identifies vulnerabilities within specific image layers for enhanced security.

- Tags: how-to-guide
- Published: 2026-04-25

### [How OSV-Scanner Performs Offline Scanning with Local Vulnerability Databases](/google/osv-scanner/how-osv-scanner-offline-scanning-local-vulnerability-databases)

Learn how OSV-Scanner performs offline scanning using local vulnerability databases and cached zip archives. Discover secure scanning without network requests.

- Tags: how-to-guide
- Published: 2026-04-25

### [How to Configure Vulnerability Ignore Rules in osv-scanner.toml](/google/osv-scanner/how-to-configure-vulnerability-ignore-rules-osv-scanner-toml)

Learn how to configure vulnerability ignore rules in osv-scanner.toml. Suppress specific vulnerabilities with clear reasons and optional expiry dates for precise scan results.

- Tags: how-to-guide
- Published: 2026-04-25

### [How osv-scanner Reduces False Positives in Vulnerability Analysis](/google/osv-scanner/how-osv-scanner-reduce-false-positives-vulnerability-analysis)

Discover how osv-scanner minimizes false positives in vulnerability analysis with precise parsing, strict version matching, configurable filters, and OSV validation. Get accurate results.

- Tags: internals
- Published: 2026-04-25