OSV-Scanner

• Category: sca
• Fingerprint: cve-package-version-v1
• License: Apache-2.0

Google's aggregated vulnerability database covers Go, npm, PyPI, Maven, Packagist, RubyGems, crates.io, and more. Runs in parallel with Trivy — findings collapse on the CVE+package tuple so duplicates on the same advisory never double-count.

When to enable

Any polyglot repo benefits from OSV over any single-ecosystem scanner because the OSV database aggregates advisories from the ecosystem's own feeds (GitHub advisories, PyPA, RubySec, …).

sca:
  osv_scanner: { enabled: true }

Distinguishing from Trivy

• OSV has broader ecosystem coverage (crates.io, Packagist) but no container OS-package signal.
• Trivy owns container images + OS packages.
• Running both is the default configuration and covers every dependency surface without gaps.