# dependencies/osv-scanner

> Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database.

Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database.

Part of the [`dependencies`](/reference/configurations/dependencies/) configuration, at the `recommended` [level](/start/concepts/#levels). It runs at the `push` [stage](/start/concepts/#stage), once for the repository. It runs osv-scanner. It needs network access.

## Why

An advisory identifies a vulnerability in a dependency version.

## What to do

Upgrade the package the finding names. When no fix exists, accept the advisory until a recheck date with `gspot ignore dependencies/osv-scanner --rule <advisory-id> --reason "<why>" --until <YYYY-MM-DD>`.

## Example

A locked package version named in an OSV advisory reports a finding. Upgrade to a fixed version, and update the lockfile.

## Turn it off

Turn it off for some files, or one of its lint rules, with a reason:

```shell
gspot ignore dependencies/osv-scanner --paths "<glob>" --reason "<why>"
gspot ignore dependencies/osv-scanner --rule <rule> --reason "<why>"
```