Package Managers and Lockfile Formats Supported by OSV-Scanner

OSV-Scanner supports 15+ package managers—including npm, Maven, PyPI, Go modules, Rust Cargo, and NuGet—by parsing specific lockfile names defined in pkg/osvscanner/internal/scanners/lockfile.go and registered via the Scalibr extractor framework in internal/scalibrplugin/presets.go.

The google/osv-scanner CLI detects vulnerable dependencies by analyzing lockfiles and OS package listings. Its parsing capabilities are defined by a central filename-to-extractor mapping in the source code and a plugin preset system that registers Scalibr extractors for each supported ecosystem.

Supported Package Managers and Lockfile Formats

OSV-Scanner recognizes lockfiles from major programming languages and operating systems. The scanner matches filenames against a hardcoded map in pkg/osvscanner/internal/scanners/lockfile.go (lines 45-78) that associates each file with a specific Scalibr extractor.

JavaScript and Node.js

• package-lock.json – npm lockfile resolved to packagelockjson extractor
• yarn.lock – Yarn lockfile
• pnpm-lock.yaml – pnpm lockfile
• bun.lock – Bun lockfile

Python

• Pipfile.lock – Pipenv lockfile
• poetry.lock – Poetry lockfile
• pdm.lock – PDM lockfile
• uv.lock – uv lockfile
• pylock.toml – PEP 751 standard lockfile
• requirements.txt – pip requirements file

Java

• pom.xml – Maven project object model
• gradle.lockfile – Gradle dependency lock
• buildscript-gradle.lockfile – Gradle buildscript dependencies
• verification-metadata.xml – Gradle verification metadata

Go

• go.mod – Go modules file

Rust

• Cargo.lock – Cargo package manager lockfile

PHP

• composer.lock – Composer dependency lock

Ruby

• Gemfile.lock – Bundler lockfile
• gems.locked – Alternative Bundler lockfile

.NET

• packages.lock.json – Central package management lockfile
• packages.config – Legacy NuGet packages
• deps.json – Dependency manifest

Dart and Flutter

• pubspec.lock – Dart package manager lockfile

Additional Ecosystems

• Erlang: mix.lock (Mix build tool)
• R: renv.lock (renv package manager)
• Haskell: cabal.project.freeze, stack.yaml.lock
• C/C++: conan.lock (Conan package manager)
• OSV-Scanner native: osv-scanner.json (special parser for the tool's own JSON output format)

Linux OS Packages

• apk-installed – Alpine Linux package database
• dpkg-status – Debian/Ubuntu package status file

How OSV-Scanner Identifies Lockfile Types

When scanning a project, OSV-Scanner uses two core mechanisms in the source code to determine which parser to invoke.

Filename-to-Extractor Mapping

In pkg/osvscanner/internal/scanners/lockfile.go, the scanner maintains a map linking filenames to Scalibr extractor names. When the CLI encounters package-lock.json, it resolves to packagelockjson.Name according to the mapping defined at lines 45-78.

Plugin Registration

The internal/scalibrplugin/presets.go file registers these extractors under the "lockfile" preset (lines 73-110). This preset aggregates all supported extractors into a single group that the CLI can activate.

Path Parsing Logic

The ParseLockfilePath function (lines 80-124 in lockfile.go) implements the extraction workflow:

1. Splits any parseAs: prefix from the file path using string parsing
2. Invokes ParseAsToPlugin to locate the matching extractor by filename or explicit override
3. Returns "could not determine extractor" if the filename is absent from the mapping

Scanning Lockfiles: Practical Examples

Scan a Single npm Lockfile

osv-scanner scan path/to/package-lock.json

The CLI resolves package-lock.json to the npm extractor and queries the OSV database for vulnerabilities in all listed packages.

Scan Multiple Ecosystems Simultaneously

osv-scanner scan \
  frontend/package-lock.json \
  backend/go.mod \
  python/requirements.txt

OSV-Scanner iterates over each path, invokes the appropriate extractor (npm, Go modules, Python requirements), and aggregates results into a unified report.

Enable the Lockfile Preset Explicitly

osv-scanner scan --preset lockfile ./my-project/

This command loads ExtractorPresets["lockfile"] from presets.go, activating all lockfile extractors to discover any recognized files under ./my-project/.

Force a Specific Parser

osv-scanner scan "npm:./my-dir/package-lock.json"

The parseAs prefix (npm:) bypasses filename lookup and directly selects the npm extractor, supporting non-standard filenames or custom lockfile names.

Key Source Files and Implementation

Understanding these files helps when debugging scan failures or contributing new extractors:

• pkg/osvscanner/internal/scanners/lockfile.go: Contains the ParseLockfilePath and ParseAsToPlugin functions and the central filename-to-extractor mapping (lines 45-78).

• internal/scalibrplugin/presets.go: Defines ExtractorPresets["lockfile"] which registers all Scalibr extractors for the scanner (lines 73-110).

• pkg/osvscanner/scan.go: Orchestrates the scanning workflow and invokes lockfile parsing logic for each CLI argument.

Summary

• OSV-Scanner supports 15+ package managers across JavaScript, Python, Java, Go, Rust, PHP, Ruby, .NET, Dart, Erlang, R, Haskell, C/C++, and major Linux distributions including Alpine and Debian/Ubuntu.
• Lockfile detection relies on a hardcoded filename map in pkg/osvscanner/internal/scanners/lockfile.go that associates files like Cargo.lock and poetry.lock with specific Scalibr extractors.
• The Scalibr plugin system in internal/scalibrplugin/presets.go registers these extractors under the "lockfile" preset.
• Use parseAs: prefixes to force specific parsers when filenames don't match standard patterns.
• The scanner also supports OS-level vulnerability detection via apk-installed and dpkg-status files.

Frequently Asked Questions

Can OSV-Scanner detect operating system package vulnerabilities?

Yes. According to the source code in pkg/osvscanner/internal/scanners/lockfile.go, OSV-Scanner supports Alpine Linux (apk-installed) and Debian/Ubuntu (dpkg-status) package databases to detect vulnerabilities in system-level dependencies.

How do I scan a lockfile if OSV-Scanner cannot determine the extractor?

If your lockfile uses a non-standard name absent from the filename map, prepend the path with the parseAs: prefix followed by the ecosystem identifier. For example, osv-scanner scan "npm:./custom-name.lock" forces the npm extractor regardless of the actual filename, bypassing the normal ParseAsToPlugin resolution logic.

Does OSV-Scanner support Python Poetry and UV lockfiles?

Yes. The lockfile.go source maps both poetry.lock and uv.lock to their respective Scalibr extractors, alongside other Python formats including Pipfile.lock, pdm.lock, pylock.toml, and requirements.txt.

What is the osv-scanner.json format listed among supported lockfiles?

This is OSV-Scanner's native JSON output format. By specifying osv-scanner.json as an input, you can re-scan previous results or integrate with external tools that generate OSV-Scanner compatible manifests. This format is handled by a dedicated special parser in the scanner implementation, distinct from the standard package manager extractors.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}