OSV Scanner 2.7.0

What's new in 2.7.0

Features:

• Feature #2885 Include package URLs (purl) in JSON output when available.
• Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
• Feature #3113 Include vulnerability severity and rating in CycloneDX output when available.
• Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
• Dependency scanning & lockfile improvements via osv-scalibr:
• Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
• Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
• Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
• Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
• New extractors and plugin support via osv-scalibr:
• Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes:

• Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
• Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
• Bug #3134 Preserve call analysis information when diffing vulnerability results. …

Full release notes »