OSV-Scanner

Guide to using the OSV-Scanner tool with CodeRabbit’s AI code reviews.

OSV-Scanner is Google’s vulnerability scanner that identifies vulnerabilities in your project’s dependencies using the OSV.dev database.

CodeRabbit runs OSV-Scanner v2.6.0.

Files

OSV-Scanner scans the following manifest and lock files:

• bun.lock, package-lock.json, pnpm-lock.yaml, yarn.lock
• requirements.txt, Pipfile.lock, poetry.lock, pdm.lock, pylock.toml, uv.lock
• go.mod
• pom.xml, buildscript-gradle.lockfile, gradle.lockfile, gradle/verification-metadata.xml
• Gemfile.lock, gems.locked
• composer.lock
• Cargo.lock
• pubspec.lock
• mix.lock
• renv.lock
• cabal.project.freeze, stack.yaml.lock
• conan.lock
• deps.json
• packages.lock.json, packages.config

Configuration

enabled · boolean · default: true

Enable OSV Scanner: OSV Scanner is a tool for vulnerability package scanning

.coderabbit.yaml

.coderabbit.yaml

reviews:
  tools:
    osvScanner:
      enabled: true

Web UI

In your organization or repository settings, go to Reviews → Tools and turn the tool on or off with its toggle.

You can customize OSV-Scanner by adding an optional osv-scanner.toml configuration file to your repository.

OSV-Scanner runs without a config file. If your repository contains an osv-scanner.toml file, CodeRabbit uses it when running OSV-Scanner.

Notes

• OSV-Scanner scans dependency manifest and lock files to identify known vulnerabilities.
• Findings include vulnerability severity scores and details from the OSV.dev database.

Profile behavior

• In Chill mode, CodeRabbit keeps high, critical, and unknown severity findings. Unknown severity findings remain visible when a CVSS score cannot be parsed or uses an unsupported format.
• In Assertive mode, CodeRabbit reports findings across all severities.

Links

• OSV-Scanner GitHub Repository
• OSV-Scanner Documentation
• OSV.dev Database