OSV & SCA scanners
Find known CVEs in your dependencies, exploited ones first, with verified, Spring Boot-aware fixes.
On this page 7 sections
Two scanners share one engine, so they always agree on every dependency and advisory. They read your lockfiles, manifests and Maven or Gradle builds, and check every resolved package version against OSV.dev, which includes the GitHub Advisory Database, PyPA, Go, RustSec and more. No account, API key or CLI is needed.
| Scanner | Use it for |
|---|---|
| OSV Vulnerability Scanner | Known CVEs and GHSA advisories in every dependency, with the fixed version and the upgrade command for your package manager. Exports an HTML or JSON report. |
| SCA Scanner | Everything above, plus CISA known-exploited CVEs first, CVSS from NVD where OSV has none, dependency health, project selection and Spring Boot-aware fixes you preview as a diff. Exports JSON or CSV. |
| To… | Do this |
|---|---|
| Open the OSV dashboard | Tools sidebar → Security & Auth → OSV Vulnerability Scanner, or run DevSnip Pro: OSV Vulnerability Scanner |
| Scan the workspace straight away | Run DevSnip Pro: Scan Workspace Dependencies for Vulnerabilities (OSV) |
| Scan one lockfile, manifest or project folder | Right-click it in the Explorer → Scan for Vulnerabilities (OSV) |
| Scan files without opening a folder | Scan Files… in the OSV dashboard |
| Open the SCA Scanner | Tools sidebar → Security & Auth → SCA Scanner, or run DevSnip Pro: SCA Scanner |
| Scan with the SCA Scanner straight away | Run DevSnip Pro: Scan Dependencies (SCA…) |
| Ecosystem | Files read |
|---|---|
| npm | package-lock., yarn. (v1 and Berry), pnpm-lock., bun., package. |
| PyPI | poetry., uv., pdm., Pipfile., conda-lock., requirements*., pyproject., Pipfile, environment. |
| Maven / Gradle | pom., build., gradle., version catalogs |
| Go | go. (with replace) |
| crates.io | Cargo., Cargo. |
| RubyGems | Gemfile., Gemfile |
| NuGet | packages., obj/, . (with central package versions), packages. |
| Packagist | composer., composer. |
| Pub | pubspec., pubspec. |
| Hex | mix. |
| SwiftPM | Package., Package. |
| CRAN | renv. |
Files in formats it does not support (sbt, CocoaPods, Conan, vcpkg, Bazel and others) are listed by name, and the scan is marked incomplete.
- Full dependency tree. Libraries that starters, parents and BOMs bring in (Tomcat, Spring Framework, Jackson, SnakeYAML, Logback…) are checked too.
- Maven or Gradle itself resolves the tree when you allow it once per trusted workspace. They run read-only: nothing is compiled, installed or changed.
- Otherwise, a built-in resolver follows Maven’s rules (parents, BOM imports, properties, nearest wins, exclusions, ranges), and a Gradle build-script reader understands the Spring Boot plugin,
mavenBom,platform, version catalogs andextra["tomcat.-style overrides.version"] - Multi-module reactors and multi-project builds resolve as one build. Your own modules are never queried as packages.
- Confirmed: a lockfile or an exact pin gives the installed version.
- Potential: only a range is known, and the advisory can reach it.
- Not analysed: the version is unknown, the query failed, or the source is outside OSV (git, paths, private registries), with the reason.
- Severity comes from the advisory: GitHub’s reviewed rating, then the CVSS score. The SCA Scanner fills gaps from NVD and names the source. No score is ever invented.
- Scan complete and Scan incomplete are always told apart, and an incomplete scan with no findings is never shown as clean.
- Known exploited: CVEs in CISA’s Known Exploited Vulnerabilities catalog are marked Exploited and sorted first, with CISA’s required action and ransomware use.
- Dependency health: deprecated, yanked, abandoned or inactive packages are maintenance risks; outdated ones are informational. A package is never called vulnerable because it is old.
- Projects: Maven reactors, Gradle builds and npm, Yarn, pnpm or Bun workspaces are listed with their Spring Boot version. Scan all of them or tick the ones you want.
- Tabs: Vulnerabilities, Remediation, Dependency health, Dependencies, and Sources & notes, which shows each advisory source’s status and how long each stage took.
The SCA Scanner records where each managed version comes from — your POM, spring-boot-starter-parent, a BOM Boot imports or one you import — and proposes the fix where it belongs, safest first:
- Upgrade Spring Boot to the lowest release whose BOM manages a fixed version: patch releases first, then minor, then major (flagged with the Java 17 and
jakarta.note for Boot 3).* - Override the Boot property (
tomcat.,version snakeyaml.) or the nested BOM’s (version spring-framework.), so a library family moves together.version - Pin it in your own
<dependencyManagement>when an imported BOM sets it. On Gradle: upgrade the Boot plugin or setext['…'].
Example: overriding a Boot property
When Tomcat is affected and a newer Boot release is too big a jump, the scanner can propose the property Spring Boot’s BOM reads:
<properties>
<tomcat.version>10.1.35</tomcat.version>
</properties>Every Tomcat artifact Boot manages moves to that version together.
Direct dependencies get a version edit in pom., build., package., requirements., ., composer. or Cargo.; transitive npm dependencies get overrides, resolutions or pnpm..
Nothing changes on its own. Preview Change opens a diff, and Apply… or Run… asks first. Edits keep your formatting and range operators, lockfiles are never edited, and nothing is installed or built. Edits are disabled in untrusted workspaces.
| Service | Receives |
|---|---|
| OSV.dev | Package names and versions |
| Package registries (SCA health checks) | Package names |
| NVD (SCA) | CVE ids |
| Maven Central | POM and BOM coordinates |
| CISA (SCA) | Nothing: the public catalog is downloaded |
Source code, file contents, paths, project names and credentials are never sent.
The scanners report affected versions; they do not check whether your code calls the vulnerable function. Only advisories published in OSV at scan time are reported. Commit your lockfiles: without one, findings are only Potential.