OSV-Scanner (Google)

What it is

A command line client for the open OSV.dev database, where each advisory comes from an open source such as GitHub Security Advisories or the RustSec database. It connects a project's dependency list with the vulnerabilities that affect each version.

What it helps with

- Checking lockfiles across more than 11 language ecosystems
- Scanning container images layer by layer for OS and language packages
- Suggesting upgrades through guided remediation
- Checking dependency licenses against an allowed list

Who it's for

Developers and AppSec engineers who want vulnerability checks on their own code and builds.

Worth knowing

Optional call analysis checks whether a vulnerable function is actually reached, which cuts false positives. An offline mode works with a local copy of the database.

How is it different from Grype?
Grype matches packages against its own vulnerability database and can read SBOMs, while OSV-Scanner draws on OSV.dev and adds guided remediation and license checks.

Can it replace Trivy?
In our view only partly, since Trivy also covers misconfigurations and secrets that OSV-Scanner does not.