v2.6.0

Features:

• Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action.
• Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins.
• Dependency scanning & lockfile improvements via osv-scalibr:
  • Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock).
  • Assign pkg:git PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages (#2863).
  • Retain packages without a version or PURL in SPDX output (google/osv-scalibr#2375) and merge related packages based on lineage relationships.
• New extractors and plugin support via osv-scalibr:
  • Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use --experimental-plugins flag. See "Supported Inventory Types" for the extractor name.

Fixes:

• Bug #3075 Ensure results property in JSON output is an empty array [] instead of null when scanning with --allow-no-lockfiles and no lockfiles are found.
• Bug #3071 Preserve valid UTF-8 sequences when truncating multibyte text in vertical output.
• Bug #2919 Add filter to show packages with license violations but no vulnerabilities in the HTML report.
• Bug #3049 Keep filter dropdown checklist open when clicking options in the HTML report.
• Bug #3023 Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation.
• Bug #3032 Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions.
• Bug #3061 Remove purl caching in scan filtering to avoid dropping SBOM packages without purls.
• Bug #3063 Log plugin and enricher errors during container scans instead of failing silently.
• Bug #2977 Return an error instead of aborting the process (log.Fatalf) when an rlib archive has no object file during Rust source analysis.
• Bug #3083 Return a descriptive error from DoContainerScan when ScannerActions.Image is empty instead of panicking.
• Fixes via osv-scalibr:
  • Fix false-positive Go standard library matches for packages with module paths ending in /go (e.g. pkg:golang/github.com/json-iterator/go) (#3017).
  • Secure guided remediation file operations with os.Root to prevent path traversal attacks (google/osv-scalibr#2363).
  • Prevent OOM and disk exhaustion issues with tar bombs during archive extraction.
  • Strip platform suffix from RubyGems versions in CycloneDX (google/osv-scalibr#2313).
  • Ignore .deps.json files that don't have an object as their root in dotnet/depsjson extractor (google/osv-scalibr#2423).

Misc:

• Update osv-scalibr to v0.5.3-0.20260911142458-3090dbb7aaa2 (#3079).
• Update Go to v1.27 and golangci-lint to v2.13 (#3046).
  • This now supports call analysis on go v1.27 projects.
• Update google.golang.org/grpc to v1.83.2 (#3062).

New Contributors

• @summerpan688 made their first contribution in #2919
• @BenkiNew made their first contribution in #3038
• @Amey-Thakur made their first contribution in #3032
• @sl4x0 made their first contribution in #3023
• @shubhransh-gupta made their first contribution in #3049
• @kobihikri made their first contribution in #2977
• @skialpine made their first contribution in #2888
• @keeltrace made their first contribution in #3071
• @Muszic made their first contribution in #3083
• @knQzx made their first contribution in google/osv-scalibr#2313
• @micrictor made their first contribution in google/osv-scalibr#2047
• @srossross made their first contribution in google/osv-scalibr#2375

Full Changelog: v2.5.1...v2.6.0