Technology
OSV-Scanner: vulnerabilities with a source of truth
OSV-Scanner is Google's dependency scanner, announced in 2022, that queries the open OSV.dev database rather than raw CVE advisories. Because OSV pins each vulnerability to precise commit or semantic version ranges, matching against your actual dependencies becomes deterministic and produces far less noise. It reads npm, Python, Go, Ruby, PHP, Rust and Maven manifests.
