google / osv-scanner
active 2023-08-15 → 2026-08-25 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 1107 days from 2023-08-15 to 2026-08-25. Pushes: 1,759 total, peak 12 in a day. Pull requests: 2,819 total, peak 21 in a day. Issues: 726 total, peak 13 in a day. Comments: 5,186 total, peak 60 in a day. Stars: 2,887 total, peak 198 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| another-rex | 4K | 800 | 933 | 924 |
| cuixq | 1.8K | 292 | 367 | 473 |
| G-Rath | 1.5K | 73 | 381 | 642 |
| codecov-commenter | 1.1K | 0 | 0 | 1.1K |
| oliverchang | 997 | 75 | 59 | 401 |
| hogo6002 | 925 | 107 | 177 | 231 |
| michaelkedar | 688 | 78 | 158 | 182 |
| osv-robot | 307 | 216 | 91 | 0 |
| github-actions[bot] | 296 | 0 | 10 | 223 |
| renovate-bot | 279 | 0 | 279 | 0 |
| andrewpollock | 188 | 38 | 54 | 47 |
| hayleycd | 174 | 8 | 22 | 75 |
| josieang | 171 | 7 | 17 | 78 |
| dependabot[bot] | 149 | 20 | 82 | 47 |
| forking-renovate[bot] | 117 | 0 | 15 | 102 |
| jess-lowe | 71 | 11 | 14 | 14 |
| Ly-Joey | 56 | 19 | 5 | 9 |
| spencerschrock | 50 | 0 | 1 | 37 |
| github-advanced-security[bot] | 47 | 0 | 0 | 39 |
| gemini-code-assist[bot] | 41 | 0 | 0 | 36 |
Recent activity
Latest issues, pull requests and releases
- Issue#2947G-Rath2026-07-31 09:35Residual to #2749: legacy V1 `##[` workflow-command grammar needs no line terminator, so it survives every `\r`/`\n` sanitization fix
- Issue#2909hypergalois2026-06-30 00:54CVE-2019-10219: executable affected-version evidence for osv-scanner
- Pull request#2884another-rex2026-06-12 05:58
- Issue comment#2867another-rex2026-06-11 23:52IsAffected panics on an advisory with an unrecognized ecosystem, crashing the whole scan
- Issue#2670another-rex2026-06-04 01:56--format=gh-annotations: unsanitized \r enables GitHub Actions workflow command injection
- Issue comment#2854codecov-commenter2026-06-01 06:24chore: ignore vulnerabilities in locks-dotnet test data
- Pull request#2851renovate-bot2026-06-01 05:28
- Issue comment#2852codecov-commenter2026-06-01 00:28chore(deps): update workflows
- Pull request#2849osv-robot2026-06-01 00:11
- Issue comment#2850G-Rath2026-05-31 07:30npm finding for git package on yarn.lock - false positive?
- Issue#2775another-rex2026-05-29 01:28`--offline-vulnerabilities` also disables transitive scanning
- Issue comment#2205G-Rath2026-05-29 01:24Multiple --config args
- Issue comment#2205bmendonca32026-05-29 01:16Multiple --config args
- Pull request#2847osv-robot2026-05-28 23:40
- Issue comment#2847codecov-commenter2026-05-28 20:05test: update snapshots
- Issue comment#2666codecov-commenter2026-05-28 04:29Add a docker variant of the pre-commit hook
- Issue#2831another-rex2026-05-28 03:35Offline scan panics with "unsupported ecosystem GitHub Actions" on SBOMs containing actions that have OSV advisories
- Pull request#2836another-rex2026-05-27 00:57
- Pull request#2819osv-robot2026-05-27 00:36
- Issue comment#2670github-actions[bot]2026-05-21 01:34--format=gh-annotations: unsanitized \r enables GitHub Actions workflow command injection
- Pull request#2816another-rex2026-05-20 23:20
- Issue#2582G-Rath2026-05-20 03:49Next major (v3)
- Pull request#2820renovate-bot2026-05-19 04:37
- Issue comment#2534github-actions[bot]2026-05-18 23:19feat: add experimental support for updating config files
- Issue comment#2801codecov-commenter2026-05-18 01:51feat: enable swift/packageresolved plugin to detect SwiftURL vulnerabilities
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 2,887 stars here means stars gained during the window, not the repo's star count.