tldr/pages/common/osv-scanner.md

osv-scanner

Scan various mediums for dependencies and matches them against the OSV database. More information: https://osv.dev/about.

• Scan a Docker image:

osv-scanner -D {{docker_image_name}}

• Scan a package lockfile:

osv-scanner -L {{path/to/lockfile}}

• Scan an SBOM file:

osv-scanner -S {{path/to/sbom_file}}

• Scan multiple directories recursively:

osv-scanner -r {{directory1 directory2 ...}}

• Skip scanning Git repositories:

osv-scanner --skip-git {{-r|-D}} {{target}}

• Output result in JSON format:

osv-scanner --json {{-D|-L|-S|-r}} {{target}}