Start with the dependency evidence you need to scan
OSV-Scanner can fit a dependency-checking workflow, but its usefulness depends on what you give it. A source manifest, a resolved lockfile and an installed container artifact can describe different dependency versions.
The project's README describes OSV-Scanner as an officially supported frontend to the OSV database and a CLI interface to OSV-Scalibr. Those are documented capabilities, not findings from our sandbox. Our recorded run covers setup, a build step and repository tests; it contains no representative vulnerability-scanning workload.
What our recorded run establishes
On October 10, 2026, we recorded commit 85c61ee, full SHA 85c61eee3bcccbf489da94c1c5f55c96f5b41e3d. The setup step exited zero in 93.303 seconds and recorded a dependency count of 475. Its visible tail says it downloaded Go 1.27.0. Calling that a successful OSV-Scanner installation would go beyond the evidence: there is no separate installed-binary check.
The build step exited zero in 99.938 seconds; its tail records vet-exit:0. The go test step exited zero in 78.753 seconds. The stored parser summary reports 74 successful package results, zero failed package results and 16 packages with no test files. These figures do not count individual test cases. The supplied count-scope record also says exhaustive unique coverage was not verified, and the retained tail repeats package results in a summary section. We therefore report the parser's counts without presenting them as a reconciled test inventory.
The configured sandbox had 3 CPUs and 8 GB of RAM, using image golang:1.24-bookworm. The image name does not establish the toolchain that executed every step. Repository metrics recorded 1,130 files, about 73,845 source lines and 52.7 MB. Detection found 19 CI workflow files, no Dockerfile and no top-level tests directory. The Go test output itself includes packages with tests, so the directory signal does not mean tests are absent. Overall recorded harness time was 275 seconds.
No new execution was performed for this review. The record provides no measured detection accuracy, advisory total, audited-package count, scan coverage, remediation outcome or comparison with another scanner.
Match the extractor to the deployed dependency
The README advertises 11+ language ecosystems and 19+ lockfile types. Use the detailed supported-artifacts documentation to check your exact input rather than treating those headline counts as coverage guarantees.
That documentation recommends a resolved lockfile for the dependency versions selected for an environment. If none is available, it recommends a fully pinned manifest generated from the environment. Manifest extraction is best effort: a manifest may contain ranges, and an extracted version may differ from the installed version.
The detailed container matrix includes Alpine packages, Debian and Ubuntu packages, Ubuntu chiseled packages, Go binaries, Rust binaries built with cargo-auditable, Java uber jars, Node modules and Python wheels. This is more specific than the README's shorter Go, Java, Node and Python table. Rust support here depends on the documented binary format; it is not a promise to inspect every Rust binary.
The source documentation also identifies limits worth checking before adoption. Maven pom.xml transitive resolution is disabled in offline mode, and its computed dependency graph does not support test dependencies. C/C++ commit-level advisory coverage is incomplete. A successful scan should therefore be reviewed alongside its extracted inventory and the documented limits for that input.
Offline mode changes both networking and coverage
The README says online OSV.dev queries send package names, versions, ecosystems and file hashes. It describes deps.dev requests for supplementary package information and says no source code is transmitted. Native dependency resolution may contact package registries.
The offline documentation makes a useful distinction. With a previously downloaded database, --offline does not send project or dependency information, download updates or require a network connection. A missing local database causes an error. By contrast, --offline-vulnerabilities uses a local vulnerability database while allowing other features to make network requests.
Downloading or refreshing the database is a separate operation. Offline mode also lacks commit-level scanning. For a disconnected workflow, record database freshness and validate that the remaining supported inputs meet your needs; the offline switch alone does not preserve every online capability.
Guided remediation needs a separate decision
The README labels the fix command experimental. Its documented remediation files are npm package-lock.json, npm package.json and Maven pom.xml, with different strategies for each. Broad scan support does not imply equally broad automatic remediation.
The README warns that guided remediation can cause a package manager to execute scripts or follow external registries specified by an untrusted project. Review the project before running fixes, inspect any proposed dependency changes and run the project's own validation before accepting them. Our recorded run did not exercise remediation.
Treat reported regressions as dated cases
The v2.5.1 release notes list fixes for package namespaces in OSV.dev queries, the local database cache environment variable and local vulnerability matching. Our measured checkout is commit 85c61ee; it should not be relabeled as a test of the v2.5.1 release binary.
Issue 3017 reports incorrect Go standard-library findings when scanning an SPDX SBOM with v2.5.0 and v2.5.1. A maintainer said on August 27, 2026 that the issue was fixed upstream in e8af798 and would be included in the next release. The supplied issue extract shows it closed as completed on October 26, 2026, while retaining an await-release label. That establishes the report and upstream fix statement, but does not independently verify which release contains the fix or reproduce it in our run.
Issue 3018 reports outdated Python transitive resolution with the default data source. A maintainer said the deps.dev fix was merged on August 27, 2026, and the issue was closed as completed on September 1. Neither issue should be described as an open current regression. Their reproductions remain useful candidates for acceptance checks if your workflow uses those inputs.
Choose by the checks you need
Trivy documents vulnerability, secret and infrastructure-misconfiguration scanners across several targets. Grype documents vulnerability scanning for container images, filesystems and SBOMs. Those roles make them relevant alternatives, but our evidence contains no head-to-head workload establishing that one detects more findings or runs faster.
For OSV-Scanner, the next useful step is to select representative resolved dependency files or installed artifacts, confirm extraction coverage and check expected advisory matches. Test offline behavior separately if you need it. The successful repository command steps are a starting point for that evaluation.
How to read the scores
These are editorial assessments on a five-point scale, not measured product ratings: 1 means major unresolved obstacles or very little evidence; 2 means limited evidence; 3 means a documented basis for evaluation with material gaps; 4 means strong support within a defined scope; 5 requires broad, corroborated evidence. Community scores assess the evidence available here, not adoption or popularity. No overall score is calculated.