v2.5.1

What's Changed

Fixes:

• Preserve package namespaces when querying osv.dev API (fixes #2978).
• Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #2983).
• Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline.

Full Changelog: v2.5.0...v2.5.1

v2.5.0

What's Changed

Features & Refactors:

• Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#2935).
• New extractors and ecosystem support via osv-scalibr:
  • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
  • Extend ecosystem mapping for:
    • SUSE
    • Azure Linux / Mariner
    • Alpaquita
    • Mageia
    • openSUSE Leap
    • Debian and Ubuntu PURL
• PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

• Bug #2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
• Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #2940, #2931)
• Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

New Contributors

• @Korulag made their first contribution in #2915

Full Changelog: v2.4.0...v2.5.0

v2.4.0

Features:

• Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0).
• Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default.
• Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems.
• Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans.
• Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation.
• Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings.
• Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin.

Fixes:

• Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
• Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
• Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag.
• Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
• Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges.
• Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested.

Misc:

• Update Go version to 1.26.4.
• Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
• Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857).

New Contributors

• @herdiyana256 made their first contribution in #2801
• @zhijie-yang made their first contribution in #2772
• @francose made their first contribution in #2837
• @rohan-patnaik made their first contribution in #2808
• @evilgensec made their first contribution in #2807
• @gotgolem made their first contribution in #2783
• @Khuzaimx made their first contribution in #2857

Full Changelog: v2.3.8...v2.4.0

v2.3.8

Fixes:

• Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec). (#2782)
• Bug #2762 Skip packages with short commit hashes instead of aborting scan.
• Bug #2781 Secure file path handling with os.OpenRoot.
• Bug #2766 Correct typos across docs, configs, and Go source.

Misc:

• Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.

v2.3.6

Features:

• Feature #2658 Support regex matching for package name overrides.
• Feature #2510 Scan Homebrew inventory using git repository metadata.

Fixes:

• Bug #2750 Sanitize \r/\n in default/table/vertical output to prevent GitHub Actions workflow command injection.
• Bug #2641 Correctly output packages from osv-scanner.json source in spdx format.
• Bug #2729 Increase color contrast of vulnerability stats.
• Bug #2664 Remove second newline at end of vertical output.
• Bug #2669 Sanitize \r in gh-annotations to prevent GitHub Actions workflow command injection.

Misc:

• Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
• Update Go version to 1.26.2 (#2706).

New Contributors

• @djvirus9 made their first contribution in #2669
• @jonjensen made their first contribution in #2695
• @dosisod made their first contribution in #2729
• @ibondarenko1 made their first contribution in #2748
• @sjhddh made their first contribution in #2744
• @Mananshah237 made their first contribution in #2641
• @majiayu000 made their first contribution in #2658
• @hits313 made their first contribution in #2750

Full Changelog: v2.3.5...v2.3.6

v2.3.5

v2.3.5

Features:

• Feature #2571 Enable transitive scanning for Python requirements.txt files using the deps.dev API.
• Feature #2649 Add ability to allow unsafe plugins, logging a warning when any unsafe plugin is enabled.

Fixes:

• Bug #2630 Improve startup performance on Windows Terminal by updating lipgloss.
• Bug #2599 Ensure the package deprecation enricher respects the same configuration as other plugins.
• Bug #2600 Ensure the Java extractor plugin for call analysis respects the same configuration as other plugins.

Misc:

• Update osv-scalibr from v0.4.2 to v0.4.5. Release notes: v0.4.3, v0.4.4, v0.4.5.
• Fix broken release workflow.

New Contributors

• @gurusai-voleti made their first contribution in #2520
• @hopkincame made their first contribution in #2564
• @tobyhawker made their first contribution in #2639

Full Changelog: v2.3.3...v2.3.5

v2.3.3

Features:

• Feature #2458 Add --exclude flag to skip paths during scanning.
• Feature #2477 Add pylock extractor.
• Feature #2475 Add base image info to container scanning output header (in table, markdown and vertical formats).

Misc:

• Update Go version to 1.25.7.
• Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
• Refactor to better align with osv-scalibr plugins and inventory data structure.

Full Changelog: v2.3.2...v2.3.3

v2.3.2

v2.3.2

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

• Bug #2415 Add more PURL-to-ecosystem mappings
• Bug #2422 MCP error for get_vulnerability_id because type definition is incorrect.
• Bug #2460 Enable osv-scanner.json git queries
• Bug #2456 Properly track if an ignore entry has been used
• Bug #2450 Performance: Avoid loading the entire advisory unless it will actually be used
• Bug #2445 Performance: Don't read the entire zip into memory
• Bug #2433 Allow specifying user agent in v2 osvscanner package

Misc:

• Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
• Misc #2447 Include bun.lock as a supported lockfile
• Misc #2444 Document GoVersionOverride in configuration.md

New Contributors

• @catatsuy made their first contribution in #2437
• @google-labs-jules[bot] made their first contribution in #2444
• @fumblehool made their first contribution in #2447
• @scop made their first contribution in #2453
• @Ankitsinghsisodya made their first contribution in #2457

Full Changelog: v2.3.1...v2.3.2

v2.3.1

v2.3.1

Features:

• Feature #2370 Add support for the packagedeprecation plugin via the new --experimental-flag-deprecated-packages flag. The result is available in all output formats except SPDX.

Fixes:

• Bug #2395 Fix license scanning to correctly match new deps.dev package names.
• Bug #2333 Deduplicate SARIF outputs for GitHub.
• Bug #2259 Fix lookup of Go packages with major versions by including the subpath of Go PURLs, preventing false positives.

Misc:

• Updated Go version to v1.25.5 to support Go reachability analysis for the latest version.

v2.3.0

This release migrates to the new osv.dev and osv-schema proto bindings for its internal data models (#2328). This is primarily an internal change and should not impact users.

Features:

• Feature #2321 Add support for license checks for RubyGems.
• Feature #2294 Replace requirementsenhanceable extractor with transitive enricher.
• Feature #2344 Use osduplicate annotators.

Fixes:

• Bug #2329 Add --ignore-scripts flag to npm lockfile generation.
• Bug #2311 Improve logic for --all-packages flag.
• Bug #2309 Exit with a non-zero code when showing help.
• Bug #2316 Pre-commit hook now defaults to scanning current directory instead of failing.
• Bug #1507 (osv-scalibr) Interpolate Maven projects before extracting repositories.

New Contributors

• @Ly-Joey made their first contribution in #2311
• @pcastellazzi made their first contribution in #2316

Full Changelog: v2.2.4...v2.3.0