EverythingXiaomi
For vendors
AdvertiseTop spots, featured rows, home sponsor Get listedAdd a product we don't cover yet Claim a listingFree: verify the domain, then correct your page Vendor dashboardNumbers, orders and placements
List your app
Vendor dashboard

OSV-Scanner

B
B tier on Software Composition Analysis SoftwareScore 7.0 · #12 of 64
Android app
Not listed
Free plan
Yes
Runs on
Linux, Mac, self-hosted, Windows
google.github.io
The OSV-Scanner homepage
Visit site Alternatives

Summary

OSV-Scanner is ranked #12 of 64 in software composition analysis software on Everything Xiaomi. It runs on Linux, macOS, Self-hosted, Windows. There is a free plan.

OSV-Scanner plans and pricing

All plans
OSV-Scanner Free Open source scanner · CLI and Go library · SLSA3 compliant binaries google.github.io · 4 Oct 2026

Compared on software composition analysis software

Free plan
Yesgoogle.github.io
Supported ecosystems
C/C++, Dart, Elixir, Go, Haskell, Java, JavaScript, .NET, PHP, Python, R, Ruby, Rust; npm, pip, Maven, Go Modules, Cargo, Gem, Composer, NuGetgoogle.github.io
SBOM generation
Yesgoogle.github.io
Reachability analysis
Yesgoogle.github.io
Pull request scanning
Yesgoogle.github.io
Deployment options
self_hostedgoogle.github.io

Facts

Purpose
OSV-Scanner finds known vulnerabilities affecting a project's dependencies using the OSV database.google.github.io · 4 Oct 2026
Ways to use
It can be run as a command-line tool or imported as a Go library.google.github.io · 4 Oct 2026
Dependency coverage
It supports source scanning across ecosystems including C/C++, Go, Java, JavaScript, Python, Ruby, and Rust, with supported lockfiles and manifests listed in its documentation.google.github.io · 4 Oct 2026
Container scanning
It scans container images for operating-system packages and language artifacts, including Alpine, Debian, Ubuntu, Go, Java, Node, and Python.github.com · 4 Oct 2026
License scanning
It can check dependency licenses using deps.dev data and compare them with an allowed SPDX license list.github.com · 4 Oct 2026
Offline mode
It can scan against a local OSV database without a network connection after the initial database download.google.github.io · 4 Oct 2026
GitHub integration
Its GitHub Actions workflows support pull-request scans, scheduled full scans, and scans on release; the documentation says prebuilt workflows for other platforms are not currently offered.google.github.io · 4 Oct 2026
Build provenance
The project offers SLSA3-compliant binaries for Linux, macOS, and Windows, and releases include SLSA provenance data for verification.google.github.io · 4 Oct 2026
Data sent
The scanner sends package names, versions, ecosystems, and file hashes to the OSV.dev API; its README says no source code is transmitted to deps.dev.github.com · 4 Oct 2026
Experimental remediation
Guided remediation suggests package version upgrades and is marked experimental; the README warns it can run package-manager scripts or follow external registries in untrusted projects.github.com · 4 Oct 2026
Remediation coverage
The documented guided-remediation support covers npm package-lock.json and package.json, and Maven pom.xml.github.com · 4 Oct 2026
Known limitations
Transitive dependency scanning is currently supported for Maven pom.xml, and test dependencies are not supported in its computed dependency graph.google.github.io · 4 Oct 2026
Support
The project directs users to GitHub issues to report problems and accepts code contributions through its contribution guidelines.github.com · 4 Oct 2026

Best OSV-Scanner alternatives

See all 12
Btier Sonatype Nexus Repository #1 7.4 $162.50/moBtier Endor Labs #2 7.3 FreeBtier Snyk Open Source #3 7.3 $25/moBtier Socket #4 7.3 $25/moBtier Accessibility Test Framework for Android #5 7.2 Android FreeBtier Docker Desktop #6 7.2 $9/mo

Where it ranks on Everything Xiaomi

Is OSV-Scanner yours?

Claim it for free: prove the domain, then correct facts, plans and screenshots. An editor reviews every change.

Claim it free Promote OSV-Scanner

Sources