Scan Dependencies with OSV-Scanner

Scan lockfiles and container images for known vulnerabilities with OSV-Scanner and fail CI only on actionable findings.

~30 minsecuritysupply-chaintesting

Task

Integrate OSV-Scanner into CI to surface vulnerable dependencies with fix versions.

When to use this

Vulnerable transitive dependencies ship unnoticed because no one scans lockfiles on each change.

Prerequisites

OSV-Scanner installed
Lockfiles committed to the repository
A CI pipeline

Steps

1. Scan lockfiles and the built image.

osv-scanner --lockfile=package-lock.json
osv-scanner --sbom=sbom.spdx.json

Expected output: Findings list the vulnerable package, advisory id, and fixed version.

2. Fail only on reachable or high-severity issues.

osv-scanner --lockfile=package-lock.json --format=json > osv.json
jq '.results[].packages[].vulnerabilities[] | select(.database_specific.severity == "HIGH")' osv.json

Expected output: CI gates on high-severity findings while tracking lower ones for triage.

Troubleshooting

Problem

Too many low findings

Solution

Set a severity threshold and track the rest with owners rather than blocking everything.

Problem

False positives in unused packages

Solution

Confirm reachability before escalating; not every installed package is loaded.

Limitations

Vulnerability databases lag behind disclosures.
Does not judge exploitability in your context.
Lockfiles must be complete and committed.

What this recipe does

Integrate OSV-Scanner into CI to surface vulnerable dependencies with fix versions.

Vulnerable transitive dependencies ship unnoticed because no one scans lockfiles on each change.

Prerequisites

OSV-Scanner installed
Lockfiles committed to the repository
A CI pipeline

Procedure

Scan lockfiles and the built image.

osv-scanner --lockfile=package-lock.json
osv-scanner --sbom=sbom.spdx.json

Expected result: Findings list the vulnerable package, advisory id, and fixed version.

Fail only on reachable or high-severity issues.

osv-scanner --lockfile=package-lock.json --format=json > osv.json
jq '.results[].packages[].vulnerabilities[] | select(.database_specific.severity == "HIGH")' osv.json

Expected result: CI gates on high-severity findings while tracking lower ones for triage.

How to confirm it worked

Run the commands above and confirm every expected result in order. If a step does not produce the stated output, use the troubleshooting notes before continuing. A passing run shows CI fails on a newly introduced high-severity finding and passes once the dependency is upgraded.

Troubleshooting

Too many low findings — Set a severity threshold and track the rest with owners rather than blocking everything.

False positives in unused packages — Confirm reachability before escalating; not every installed package is loaded.

Limitations

Vulnerability databases lag behind disclosures.
Does not judge exploitability in your context.
Lockfiles must be complete and committed.