google/osv-scanner v2.7.0

on GitHub

Features:

• Feature #2885 Include package URLs (purl) in JSON output when available.
• Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
• Feature #3113 Include vulnerability severity and rating in CycloneDX output when available.
• Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
• Dependency scanning & lockfile improvements via osv-scalibr:
  • Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
  • Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
  • Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
  • Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
• New extractors and plugin support via osv-scalibr:
  • Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes:

• Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
• Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
• Bug #3134 Preserve call analysis information when diffing vulnerability results.
• Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).
• Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
• Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).
• Fixes via osv-scalibr:
  • Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
  • Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
  • Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
  • Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
  • Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
  • Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
  • Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
  • Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
  • Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
  • Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
  • Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc:

• Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).
• Remove unused root Dockerfile (#3130).

New Contributors

• @sanjay20m made their first contribution in #3102
• @manenim made their first contribution in #3133

Full Changelog: v2.6.0...v2.7.0