Features: Feature #2885 Include package URLs (purl) in JSON output when available. Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags. Feature #3113 Include vulnerability severity and rating in CycloneDX output when available. Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295). Dependency…
Features: Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action. Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins. Dependency scanning & lockfile improvements via osv-scalibr: Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock,…
What's Changed Fixes: Preserve package namespaces when querying osv.dev API (fixes #2978). Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #2983). Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline. Full Changelog: v2.5.0...v2.5.1
What's Changed Features & Refactors: Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935). New extractors and ecosystem support via osv-scalibr: Add javascript/vsix extractor to support scanning VS Code extension (.vsix) pack…
Features: Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0). Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default. Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems. Feature #28…
Fixes: Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec). (#2782) Bug #2762 Skip packages with short commit hashes instead of aborting scan. Bug #2781 Secure file path handling with os.OpenRoot. Bug #2766 Correct typos across docs, configs, and Go source. Misc: Update osv-scalibr to v0.4.6-0.20260504…
fix: schrodinger's lint (#2780)
Features: Feature #2658 Support regex matching for package name overrides. Feature #2510 Scan Homebrew inventory using git repository metadata. Fixes: Bug #2750 Sanitize \r/\n in default/table/vertical output to prevent GitHub Actions workflow command injection. Bug #2641 Correctly output packages from osv-scanner.json source in spdx format. Bug #2729 Increase color contrast of vulnerability stats…
v2.3.5 Features: Feature #2571 Enable transitive scanning for Python requirements.txt files using the deps.dev API. Feature #2649 Add ability to allow unsafe plugins, logging a warning when any unsafe plugin is enabled. Fixes: Bug #2630 Improve startup performance on Windows Terminal by updating lipgloss. Bug #2599 Ensure the package deprecation enricher respects the same configuration as other pl…
Update changelog and snapshots in preparation for release. Required because data changes are causing tests to fail, and there are new changes since the last updates. Co-authored-by: Xueqin Cui 72771658+cuixq@users.noreply.github.com
Features: Feature #2458 Add --exclude flag to skip paths during scanning. Feature #2477 Add pylock extractor. Feature #2475 Add base image info to container scanning output header (in table, markdown and vertical formats). Misc: Update Go version to 1.25.7. Update osv-scalibr from v0.4.1 to v0.4.2. Release note. Refactor to better align with osv-scalibr plugins and inventory data structure. Full C…
v2.3.2 This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates. Fixes: Bug #2415 Add more PURL-to-ecosystem mappings Bug #2422 MCP error for get_vulnerability_id becau…
v2.3.1 Features: Feature #2370 Add support for the packagedeprecation plugin via the new --experimental-flag-deprecated-packages flag. The result is available in all output formats except SPDX. Fixes: Bug #2395 Fix license scanning to correctly match new deps.dev package names. Bug #2333 Deduplicate SARIF outputs for GitHub. Bug #2259 Fix lookup of Go packages with major versions by including the…
This release migrates to the new osv.dev and osv-schema proto bindings for its internal data models (#2328). This is primarily an internal change and should not impact users. Features: Feature #2321 Add support for license checks for RubyGems. Feature #2294 Replace requirementsenhanceable extractor with transitive enricher. Feature #2344 Use osduplicate annotators. Fixes: Bug #2329 Add --ignore-sc…