OSV Scanner Updates & Release Notes

Features

Feature #2885 Include package URLs (purl) in JSON output when available.

Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags.

Feature #3113 Include vulnerability severity and rating in CycloneDX output when available.

Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).

Dependency scanning & lockfile improvements via osv-scalibr:

Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.

Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).

Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).

Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.

New extractors and plugin support via osv-scalibr:

Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes

Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).

Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.

Bug #3134 Preserve call analysis information when diffing vulnerability results.

Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).

Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.

Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).

Fixes via osv-scalibr:

Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).

Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).

Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).

Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).

Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).

Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).

Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).

Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).

Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).

Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).

Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc

Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).

Remove unused root Dockerfile (#3130).

New Contributors

@sanjay20m made their first contribution in #3102

@manenim made their first contribution in #3133

Full Changelog: v2.6.0...v2.7.0

Features

• Feature #2885 Include package URLs (purl) in JSON output when available.
• Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
• Feature #3113 Include vulnerability severity and rating in CycloneDX output when available.
• Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
• Dependency scanning & lockfile improvements via osv-scalibr:
  • Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
  • Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
  • Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
  • Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
• New extractors and plugin support via osv-scalibr:
  • Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes

• Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
• Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
• Bug #3134 Preserve call analysis information when diffing vulnerability results.
• Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).
• Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
• Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).
• Fixes via osv-scalibr:
  • Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
  • Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
  • Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
  • Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
  • Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
  • Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
  • Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
  • Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
  • Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
  • Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
  • Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc

• Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).
• Remove unused root Dockerfile (#3130).

Features

• Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action.
• Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins.

Dependency scanning & lockfile improvements via osv-scalibr:

• Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock).
• Assign pkg:git PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages (#2863).
• Retain packages without a version or PURL in SPDX output (google/osv-scalibr#2375) and merge related packages based on lineage relationships.

New extractors and plugin support via osv-scalibr:

• Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use --experimental-plugins flag. See "Supported Inventory Types" for the extractor name.

Fixes

• Bug #3075 Ensure results property in JSON output is an empty array [] instead of null when scanning with --allow-no-lockfiles and no lockfiles are found.
• Bug #3071 Preserve valid UTF-8 sequences when truncating multibyte text in vertical output.
• Bug #2919 Add filter to show packages with license violations but no vulnerabilities in the HTML report.
• Bug #3049 Keep filter dropdown checklist open when clicking options in the HTML report.
• Bug #3023 Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation.
• Bug #3032 Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions.
• Bug #3061 Remove purl caching in scan filtering to avoid dropping SBOM packages without purls.
• Bug #3063 Log plugin and enricher errors during container scans instead of failing silently.
• Bug #2977 Return an error instead of aborting the process (log.Fatalf) when an rlib archive has no object file during Rust source analysis.
• Bug #3083 Return a descriptive error from DoContainerScan when ScannerActions.Image is empty instead of panicking.

Fixes via osv-scalibr:

• Fix false-positive Go standard library matches for packages with module paths ending in /go (e.g. pkg:golang/github.com/json-iterator/go) (#3017).
• Secure guided remediation file operations with os.Root to prevent path traversal attacks (google/osv-scalibr#2363).
• Prevent OOM and disk exhaustion issues with tar bombs during archive extraction.
• Strip platform suffix from RubyGems versions in CycloneDX (google/osv-scalibr#2313).
• Ignore .deps.json files that don't have an object as their root in dotnet/depsjson extractor (google/osv-scalibr#2423).

Misc

• Update osv-scalibr to v0.5.3-0.20260911142458-3090dbb7aaa2 (#3079).
• Update Go to v1.27 and golangci-lint to v2.13 (#3046).
• This now supports call analysis on go v1.27 projects.
• Update google.golang.org/grpc to v1.83.2 (#3062).

New Contributors

• @summerpan688 made their first contribution in #2919
• @BenkiNew made their first contribution in #3038
• @Amey-Thakur made their first contribution in #3032
• @sl4x0 made their first contribution in #3023
• @shubhransh-gupta made their first contribution in #3049
• @kobihikri made their first contribution in #2977
• @skialpine made their first contribution in #2888
• @keeltrace made their first contribution in #3071
• @Muszic made their first contribution in #3083
• @knQzx made their first contribution in google/osv-scalibr#2313
• @micrictor made their first contribution in google/osv-scalibr#2047
• @srossross made their first contribution in google/osv-scalibr#2375

Full Changelog: v2.5.1...v2.6.0

Features

• Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action.
• Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins.
• Dependency scanning & lockfile improvements via osv-scalibr:
  • Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock).
  • Assign pkg:git PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages (#2863).
  • Retain packages without a version or PURL in SPDX output (google/osv-scalibr#2375) and merge related packages based on lineage relationships.
• New extractors and plugin support via osv-scalibr:
  • Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use --experimental-plugins flag. See "Supported Inventory Types" for the extractor name.

Fixes

• Bug #3075 Ensure results property in JSON output is an empty array [] instead of null when scanning with --allow-no-lockfiles and no lockfiles are found.
• Bug #3071 Preserve valid UTF-8 sequences when truncating multibyte text in vertical output.
• Bug #2919 Add filter to show packages with license violations but no vulnerabilities in the HTML report.
• Bug #3049 Keep filter dropdown checklist open when clicking options in the HTML report.
• Bug #3023 Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation.
• Bug #3032 Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions.
• Bug #3061 Remove purl caching in scan filtering to avoid dropping SBOM packages without purls.
• Bug #3063 Log plugin and enricher errors during container scans instead of failing silently.
• Bug #2977 Return an error instead of aborting the process (log.Fatalf) when an rlib archive has no object file during Rust source analysis.
• Bug #3083 Return a descriptive error from DoContainerScan when ScannerActions.Image is empty instead of panicking.
• Fixes via osv-scalibr:
  • Fix false-positive Go standard library matches for packages with module paths ending in /go (e.g. pkg:golang/github.com/json-iterator/go) (#3017).
  • Secure guided remediation file operations with os.Root to prevent path traversal attacks (google/osv-scalibr#2363).
  • Prevent OOM and disk exhaustion issues with tar bombs during archive extraction.
  • Strip platform suffix from RubyGems versions in CycloneDX (google/osv-scalibr#2313).
  • Ignore .deps.json files that don't have an object as their root in dotnet/depsjson extractor (google/osv-scalibr#2423).

Misc

• Update osv-scalibr to v0.5.3-0.20260911142458-3090dbb7aaa2 (#3079).
• Update Go to v1.27 and golangci-lint to v2.13 (#3046).
  • This now supports call analysis on go v1.27 projects.
• Update google.golang.org/grpc to v1.83.2 (#3062).

What's Changed

Features & Refactors:

Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935).

New extractors and ecosystem support via osv-scalibr:

Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.

Extend ecosystem mapping for:

• SUSE
• Azure Linux / Mariner
• Alpaquita
• Mageia
• openSUSE Leap
• Debian and Ubuntu PURL

PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

Bug #2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.

Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #2940, #2931)

Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

New Contributors

@Korulag made their first contribution in #2915

Full Changelog: v2.4.0...v2.5.0

Features & Refactors:

• Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935).
• New extractors and ecosystem support via osv-scalibr:
  • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
  • Extend ecosystem mapping for:
    • SUSE
    • Azure Linux / Mariner
    • Alpaquita
    • Mageia
    • openSUSE Leap
    • Debian and Ubuntu PURL
• PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

• Bug #2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
• Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #2940, #2931)
• Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

Features

• Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0).
• Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default.
• Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems.
• Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans.
• Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation.
• Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings.
• Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin.

Fixes

• Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
• Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
• Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag.
• Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
• Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges.
• Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested.

Misc

• Update Go version to 1.26.4.
• Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
• Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857).

Fixes:

• Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec).
• Bug #2762 Skip packages with short commit hashes instead of aborting scan.
• Bug #2781 Secure file path handling with os.OpenRoot.
• Bug #2766 Correct typos across docs, configs, and Go source.

Misc:

• Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.
• Remove replace directive (#2782).
• Update contributing.md (#2779).

Features

• Feature #2658 Support regex matching for package name overrides.
• Feature #2510 Scan Homebrew inventory using git repository metadata.

Fixes

• Bug #2750 Sanitize \r/\n in default/table/vertical output to prevent GitHub Actions workflow command injection.
• Bug #2641 Correctly output packages from osv-scanner.json source in spdx format.
• Bug #2729 Increase color contrast of vulnerability stats.
• Bug #2664 Remove second newline at end of vertical output.
• Bug #2669 Sanitize \r in gh-annotations to prevent GitHub Actions workflow command injection.

Misc

• Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
• Update Go version to 1.26.2 (#2706).

Features

• Feature #2458 Add --exclude flag to skip paths during scanning.
• Feature #2477 Add pylock extractor.
• Feature #2475 Add base image info to container scanning output header (in table, markdown and vertical formats).

Misc

• Update Go version to 1.25.7.
• Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
• Refactor to better align with osv-scalibr plugins and inventory data structure.

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes

• Bug #2415 Add more PURL-to-ecosystem mappings
• Bug #2422 MCP error for get_vulnerability_id because type definition is incorrect.
• Bug #2460 Enable osv-scanner.json git queries
• Bug #2456 Properly track if an ignore entry has been used
• Bug #2450 Performance: Avoid loading the entire advisory unless it will actually be used
• Bug #2445 Performance: Don't read the entire zip into memory
• Bug #2433 Allow specifying user agent in v2 osvscanner package

Misc

• Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
• Misc #2447 Include bun.lock as a supported lockfile
• Misc #2444 Document GoVersionOverride in configuration.md

Features

• Feature #2370 Add support for the packagedeprecation plugin via the new --experimental-flag-deprecated-packages flag. The result is available in all output formats except SPDX.

Fixes

• Bug #2395 Fix license scanning to correctly match new deps.dev package names.
• Bug #2333 Deduplicate SARIF outputs for GitHub.
• Bug #2259 Fix lookup of Go packages with major versions by including the subpath of Go PURLs, preventing false positives.

Misc

• Updated Go version to v1.25.5 to support Go reachability analysis for the latest version.