OSV-Scanner finds known vulnerabilities in project dependencies,
lockfiles, SBOMs, and container images using the OSV database.

Building requires google-go-lang (Go 1.27 or newer). The supplied vendor
archive allows offline compilation. Go is not needed to run the binary.
This recipe targets x86_64 and aarch64; upstream excludes 32-bit builds.

Scan a source tree with:

  osv-scanner scan source -r /path/to/project

Online scans send dependency metadata (names, versions, and sometimes
Git commits) to OSV.dev and deps.dev, which also see your IP address.
These lookups are distinct from usage telemetry; separate analytics
behavior has not been verified here.
Offline scanning is separate from offline compilation: use --offline
with previously downloaded vulnerability databases. The vendor archive
does not include those databases. --offline-vulnerabilities only makes
vulnerability lookups offline; other features can still use the network.

Set OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY to choose the local database
cache root, or use the default user cache location. This release reads
databases from <cache-root>/osv-scalibr/<ecosystem>/all.zip. See
docs/offline-mode.md under /usr/doc/osv-scanner-<version>/ for database
setup and limitations.
No databases are downloaded or updated by this SlackBuild.

Run scans as your normal user. Exit status 1 can indicate that
vulnerabilities were found, not a broken installation. Image and
guided-remediation features may need network access or ecosystem tools.
Linux package support does not imply Slackware package coverage.

Documentation: https://google.github.io/osv-scanner/