OSV Scanner: baixar versions anteriors

### Features:

• [Feature #2885](https://github.com/google/osv-scanner/pull/2885) Include package URLs (`purl`) in JSON output when available.
• [Feature #2589](https://github.com/google/osv-scanner/pull/2589) Add shorter `--x-` flag aliases and deprecate `--experimental-` flags.
• [Feature #3113](https://github.com/google/osv-scanner/pull/3113) Include vulnerability severity and rating in CycloneDX output when available.
• [Feature #3102](https://github.com/google/osv-scanner/pull/3102) Enable Dart `package_config.json` (`dart/packageconfig`) extractor by default for lockfile scans ([google/osv-scalibr#2295](https://github.com/google/osv-scalibr/pull/2295)).
• **Dependency scanning & lockfile improvements via `osv-scalibr`**:
• Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
• Support scanning Bitnami container SPDX SBOMs (`sbom/spdx`) ([google/osv-scalibr#2156](https://github.com/google/osv-scalibr/pull/2156)).
• Add MinimOS ecosystem mapping to the APK extractor (`os/apk`) ([google/osv-scalibr#2406](https://github.com/google/osv-scalibr/pull/2406)).
• Apply `--max-file-size` limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
• **New extractors and plugin support via `osv-scalibr`**:
• Added `zig/buildzigzon` (`build.zig.zon`, [google/osv-scalibr#1841](https://github.com/google/osv-scalibr/pull/1841)), available via `--x-plugins` (`--experimental-plugins`). See ["Supported Inventory Types"](https://github.com/google/osv-scalibr/blob/5be78a00e3c294c19a0b03949e4eb643653c0218/docs/supported_inventory_types.md) for the extractor name.

### Fixes:

• [Bug #3137](https://github.com/google/osv-scanner/pull/3137) Delegate package normalization to `osv-scalibr`'s `osvutil` to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes [#3099](https://github.com/google/osv-scanner/issues/3099)).
• [Bug #3135](https://github.com/google/osv-scanner/pull/3135) Prevent network-requiring plugins (such as base image enrichment) from running when `--offline` is combined with `--download-offline-databases`.
• [Bug #3134](https://github.com/google/osv-scanner/pull/3134) Preserve call analysis information when diffing vulnerability results.
• [Bug #3121](https://github.com/google/osv-scanner/pull/3121) Wrap `[[PackageOverrides]]` ecosystem suffix alternatives in a non-capturing group so `Ecosystem` regex matching applies correctly to all variants (fixes [#3120](https://github.com/google/osv-scanner/issues/3120)).
• [Bug #3103](https://github.com/google/osv-scanner/pull/3103) Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
• [Bug #3087](https://github.com/google/osv-scanner/pull/3087) Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. `Alpine` and `Alpine:v3.18`) (fixes [#3086](https://github.com/google/osv-scanner/issues/3086)).
• **Fixes via `osv-scalibr`**:
• Skip OSV queries for local npm packages (`file:`, workspace, and local tarballs) and avoid extracting bogus versions or commits for `file:` and URL-based dependencies in `bun.lock` ([google/osv-scalibr#2443](https://github.com/google/osv-scalibr/pull/2443), [google/osv-scalibr#2444](https://github.com/google/osv-scalibr/pull/2444)).
• Restrict `#commit` fragment extraction in JS lockfiles to Git-based dependency resolutions ([google/osv-scalibr#2448](https://github.com/google/osv-scalibr/pull/2448)).
• Prevent slice-bounds panic in `javascript/pnpmlock` on malformed scoped dependency paths ([google/osv-scalibr#2263](https://github.com/google/osv-scalibr/pull/2263)).
• Emit valid Hackage PURLs (`pkg:hackage/...`) and add `Hackage` OSV ecosystem mapping for Haskell (`cabal` and `stack.yaml.lock`) extractors ([google/osv-scalibr#2419](https://github.com/google/osv-scalibr/pull/2419)).
• Match Python `setup.py` pa

### Features:

• [Feature #2888](https://github.com/google/osv-scanner/pull/2888) Publish multi-arch (`linux/arm64`) image for `osv-scanner-action`.
• [Feature #3066](https://github.com/google/osv-scanner/pull/3066) Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins.
• **Dependency scanning & lockfile improvements via `osv-scalibr`**:
• Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`).
• Assign `pkg:git` PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages ([#2863](https://github.com/google/osv-scanner/pull/2863)).
• Retain packages without a version or PURL in SPDX output ([google/osv-scalibr#2375](https://github.com/google/osv-scalibr/pull/2375)) and merge related packages based on lineage relationships.
• **New extractors and plugin support via `osv-scalibr`**:
• Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use `--experimental-plugins` flag. See ["Supported Inventory Types"](https://github.com/google/osv-scalibr/blob/3f6473abebb329f3e0dc7e9e0d9c91e0c6e51277/docs/supported_inventory_types.md) for the extractor name.

### Fixes:

• [Bug #3075](https://github.com/google/osv-scanner/pull/3075) Ensure `results` property in JSON output is an empty array `[]` instead of `null` when scanning with `--allow-no-lockfiles` and no lockfiles are found.
• [Bug #3071](https://github.com/google/osv-scanner/pull/3071) Preserve valid UTF-8 sequences when truncating multibyte text in vertical output.
• [Bug #2919](https://github.com/google/osv-scanner/pull/2919) Add filter to show packages with license violations but no vulnerabilities in the HTML report.
• [Bug #3049](https://github.com/google/osv-scanner/pull/3049) Keep filter dropdown checklist open when clicking options in the HTML report.
• [Bug #3023](https://github.com/google/osv-scanner/pull/3023) Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation.
• [Bug #3032](https://github.com/google/osv-scanner/pull/3032) Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions.
• [Bug #3061](https://github.com/google/osv-scanner/pull/3061) Remove purl caching in scan filtering to avoid dropping SBOM packages without purls.
• [Bug #3063](https://github.com/google/osv-scanner/pull/3063) Log plugin and enricher errors during container scans instead of failing silently.
• [Bug #2977](https://github.com/google/osv-scanner/pull/2977) Return an error instead of aborting the process (`log.Fatalf`) when an `rlib` archive has no object file during Rust source analysis.
• [Bug #3083](https://github.com/google/osv-scanner/pull/3083) Return a descriptive error from `DoContainerScan` when `ScannerActions.Image` is empty instead of panicking.
• **Fixes via `osv-scalibr`**:
• Fix false-positive Go standard library matches for packages with module paths ending in `/go` (e.g. `pkg:golang/github.com/json-iterator/go`) ([#3017](https://github.com/google/osv-scanner/issues/3017)).
• Secure guided remediation file operations with `os.Root` to prevent path traversal attacks ([google/osv-scalibr#2363](https://github.com/google/osv-scalibr/pull/2363)).
• Prevent OOM and disk exhaustion issues with tar bombs during archive extraction.
• Strip platform suffix from RubyGems versions in CycloneDX ([google/osv-scalibr#2313](https://github.com/google/osv-scalibr/pull/2313)).
• Ignore `.deps.json` files that don't have an object as their root in `dotnet/depsjson` extractor ([google/osv-scalibr#2423](https://github.com/google/osv-scalibr/pull/2423)).

### Misc:

• Update `osv-scalibr` to `v0.5.3-0.20260911142458-3090dbb7aaa2` ([#3079](https://github.com/google/osv-scanner/pull/3079)).
• Update Go to v1.27 and `gola

Features:
- Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0).
- Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default.
- Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems.
- Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans.
- Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation.
- Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings.
- Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin.
Fixes:
- Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
- Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
- Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag.
- Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
- Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges.
- Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested.
Misc:
- Update Go version to 1.26.4.
- Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
- Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857).
New Contributors
- @herdiyana256 made their first contribution in #2801
- @zhijie-yang made their first contribution in #2772
- @francose made their first contribution in #2837
- @rohan-patnaik made their first contribution in #2808
- @evilgensec made their first contribution in #2807
- @gotgolem made their first contribution in #2783
- @Khuzaimx made their first contribution in #2857
Full Changelog: v2.3.8...v2.4.0

Fixes:
- Fix installation issues with go install due to dependency conflicts (downgrade containerd/cgroups/v3, moby/buildkit and opencontainers/runtime-spec). (#2782)
- Bug #2762 Skip packages with short commit hashes instead of aborting scan.
- Bug #2781 Secure file path handling with os.OpenRoot.
- Bug #2766 Correct typos across docs, configs, and Go source.
Misc:
- Update osv-scalibr to v0.4.6-0.20260504042738-9293bfa4f86f.

Features:
- Feature #2658 Support regex matching for package name overrides.
- Feature #2510 Scan Homebrew inventory using git repository metadata.
Fixes:
- Bug #2750 Sanitize \r/\n in default/table/vertical output to prevent GitHub Actions workflow command injection.
- Bug #2641 Correctly output packages from osv-scanner.json source in spdx format.
- Bug #2729 Increase color contrast of vulnerability stats.
- Bug #2664 Remove second newline at end of vertical output.
- Bug #2669 Sanitize \r in gh-annotations to prevent GitHub Actions workflow command injection.
Misc:
- Update osv-scalibr to v0.4.6-0.20260428235529-7791e288d6c1.
- Update Go version to 1.26.2 (#2706).
New Contributors
- @djvirus9 made their first contribution in #2669
- @jonjensen made their first contribution in #2695
- @dosisod made their first contribution in #2729
- @ibondarenko1 made their first contribution in #2748
- @sjhddh made their first contribution in #2744
- @Mananshah237 made their first contribution in #2641
- @majiayu000 made their first contribution in #2658
- @hits313 made their first contribution in #2750
Full Changelog: v2.3.5...v2.3.6

v2.3.5
Features:
- Feature #2571 Enable transitive scanning for Python requirements.txt files using the deps.dev API.
- Feature #2649 Add ability to allow unsafe plugins, logging a warning when any unsafe plugin is enabled.
Fixes:
- Bug #2630 Improve startup performance on Windows Terminal by updating lipgloss.
- Bug #2599 Ensure the package deprecation enricher respects the same configuration as other plugins.
- Bug #2600 Ensure the Java extractor plugin for call analysis respects the same configuration as other plugins.
Misc:
- Update osv-scalibr from v0.4.2 to v0.4.5. Release notes: v0.4.3, v0.4.4, v0.4.5.
- Fix broken release workflow.
New Contributors
- @gurusai-voleti made their first contribution in #2520
- @hopkincame made their first contribution in #2564
- @tobyhawker made their first contribution in #2639
Full Changelog: v2.3.3...v2.3.5

Features:
- Feature #2458 Add --exclude flag to skip paths during scanning.
- Feature #2477 Add pylock extractor.
- Feature #2475 Add base image info to container scanning output header (in table, markdown and vertical formats).
Misc:
- Update Go version to 1.25.7.
- Update osv-scalibr from v0.4.1 to v0.4.2. Release note.
- Refactor to better align with osv-scalibr plugins and inventory data structure.
Full Changelog: v2.3.2...v2.3.3

v2.3.2
This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.
Fixes:
- Bug #2415 Add more PURL-to-ecosystem mappings
- Bug #2422 MCP error for get_vulnerability_id because type definition is incorrect.
- Bug #2460 Enable osv-scanner.json git queries
- Bug #2456 Properly track if an ignore entry has been used
- Bug #2450 Performance: Avoid loading the entire advisory unless it will actually be used
- Bug #2445 Performance: Don't read the entire zip into memory
- Bug #2433 Allow specifying user agent in v2 osvscanner package
Misc:
- Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
- Misc #2447 Include bun.lock as a supported lockfile
- Misc #2444 Document GoVersionOverride in configuration.md
New Contributors
- @catatsuy made their first contribution in #2437
- @google-labs-jules[bot] made their first contribution in #2444
- @fumblehool made their first contribution in #2447
- @scop made their first contribution in #2453
- @Ankitsinghsisodya made their first contribution in #2457
Full Changelog: v2.3.1...v2.3.2

v2.3.1
Features:
- Feature #2370 Add support for the packagedeprecation plugin via the new --experimental-flag-deprecated-packages flag. The result is available in all output formats except SPDX.
Fixes:
- Bug #2395 Fix license scanning to correctly match new deps.dev package names.
- Bug #2333 Deduplicate SARIF outputs for GitHub.
- Bug #2259 Fix lookup of Go packages with major versions by including the subpath of Go PURLs, preventing false positives.
Misc:
- Updated Go version to v1.25.5 to support Go reachability analysis for the latest version.

This release migrates to the new osv.dev and osv-schema proto bindings for its internal data models (#2328). This is primarily an internal change and should not impact users.
Features:
- Feature #2321 Add support for license checks for RubyGems.
- Feature #2294 Replace requirementsenhanceable extractor with transitive enricher.
- Feature #2344 Use osduplicate annotators.
Fixes:
- Bug #2329 Add --ignore-scripts flag to npm lockfile generation.
- Bug #2311 Improve logic for --all-packages flag.
- Bug #2309 Exit with a non-zero code when showing help.
- Bug #2316 Pre-commit hook now defaults to scanning current directory instead of failing.
- Bug #1507 (osv-scalibr) Interpolate Maven projects before extracting repositories.
New Contributors
- @Ly-Joey made their first contribution in #2311
- @pcastellazzi made their first contribution in #2316
Full Changelog: v2.2.4...v2.3.0

Features:
- Feature #2256 Add experimental OSV-Scanner MCP server. (osv-scanner experimental-mcp)
- Feature #2284 Update osv-scalibr integration, replacing baseimagematch with the base image enricher.
- Feature #2216 Warn when vulnerabilities specified in the ignore config are not found during a scan (fixes #2206).
Fixes:
- Bug #2305 Ignore common protocols and .git suffix when checking if an advisory affects a git repository (fixes #2291).
- Bug #2300 Ensure the global logger is used in cmdlogger and osv-scalibr when set (fixes #2081).
- Bug #2295 Fix Go stdlib license result matching (fixes #2191).
Full Changelog: v2.2.3...v2.2.4

Changelog
Features:
- Feature #2209 Add support for resolving git packages that have a version specified.
- Feature #2210 Make the --experimental-plugins flag additive by default, and introduce a new --experimental-no-default-plugins flag.
- Feature #2203 Update osv-scalibr to 0.3.4 for improved dependency extraction. See osv-scalibr changelog for additional information.
Fixes:
- Bug #2214 Fix issue where input.Path was incorrectly constructed on Windows when using the -L flag.
- Fix #2241 Performance: Greatly reduce memory usage in the local matcher by only loading advisories relevant to the packages being scanned.
Full Changelog: v2.2.2...v2.2.3

Features:
- Feature #2113 Add support for Java reachability analysis to identify uncalled vulnerabilities in JAR files.
- Feature #2177 Automatically parse osv-scanner-custom.json files as osv-scanner.json custom lockfiles.
Fixes:
- Bug #2204 Add a warning to guide users to the correct GitHub Action.
- Bug #2202 Fix incorrect exit code when unimportant vulnerabilities are found in non-container scans.
- Bug #2188 Fix handling of absolute paths on Windows.
Full Changelog: v2.2.1...v2.2.2

Fixes
- Bug #2151 Filter by ecosystem before querying.
Full Changelog: v2.2.0...v2.2.1

v2.2.0
OSV-Scanner now supports all OSV-Scalibr features behind experimental flags (--experimental-plugins, see details here)!
Features:
- Feature #2146 Allow manual OSV-Scalibr plugin selection.
- Feature #2144 Add OSV-Scalibr version to osv-scanner --version output.
- Feature #2021 Add experimental support for running OSV-Scalibr detectors.
- Feature #2079 Fall back to offline extractor if the transitive one fails, so at least direct dependencies are returned.
- Feature #2032 Add summary section at the top of outputs and a 'Fixed Version' column.
- Feature #2076 Support Ubuntu severity type.
Fixes:
- Bug #2141 Fix OSV-Scanner json scans not matching with correct ecosystem.
- Bug #2084 Show absolute paths when scanning containers.
- Bug #2126 Log and preserve package count before continuing on db error.
- Bug #2095 Pass through plugin capabilities correctly.
- Bug #2051 Properly flag if running on Linux or Mac OSs for plugin compatibility.
- Bug #2072 Add missing "text" property in description fields.
- Bug #2068 Change links in output to go to the specific vulnerability page instead of the list page.
- Bug #2064 Fix SARIF v3 output to include results.
API Changes:
- API Change #2096 Allow log handler to be overridden.
New Contributors
- @brabster made their first contribution in #2072
- @Aejkatappaja made their first contribution in #2032
- @dizzydroid made their first contribution in #2106
Full Changelog: v2.1.0...v2.2.0

v2.1.0
Features:
- Feature #2038 Add CycloneDX location field to the output source string.
- Feature #2036 Include upstream source information in vulnerability grouping to improve accuracy.
- Feature #1970 Hide unimportant vulnerabilities by default to reduce noise, and adds a --show-all-vulns flag to show all.
- Feature #2003 Add experimental summary output format for the reporter.
- Feature #1988 Add support for CycloneDX 1.6 report format.
- Feature #1987 Add support for gems.locked files used by Bundler.
- Feature #1980 Enable transitive dependency extraction for Python requirements.txt files.
- Feature #1961 Deprecate the --sbom flag in favor of the existing -L/--lockfile flag for scanning SBOMs.
- Feature #1963 Stabilize various experimental fields in the output by moving them out of the experimental struct.
- Feature #1957 Use a dedicated exit code for invalid configuration files.
Fixes:
- Bug #2046 Correctly set the user agent string for all outgoing requests.
- Bug #2019 Use more natural language in the descriptions for extractor-related flags.
- Bug #1982 Correctly parse Ubuntu package information with suffixes (e.g. :Pro, :LTS).
- Bug #2000 Ensure CDATA content in XML is correctly outputted in guided remediation.
- Bug #1949 Fix filtering of package types in vulnerability counts.
New Contributors
- @Vialathor made their first contribution in #1949
Full Changelog: v2.0.3...v2.1.0

v2.0.3
Features:
- Feature #1943 Added a flag to suppress "no package sources found" error.
- Feature #1844 Allow flags to be passed after scan targets, e.g. osv-scanner ./scan-this-dir --format=vertical, by updating to cli/v3
- Feature #1882 Added a stable tag to container images for releases that follow semantic versioning.
- Feature #1846 Experimental: Add --experimental-extractors and --experimental-disable-extractors flags to allow for more granular control over which OSV-Scalibr dependency extractors are used.
Fixes:
- Bug #1856 Improve XML output by guessing and matching the indentation of existing <dependency> elements.
- Bug #1850 Prevent escaping of single quotes in XML attributes for better readability and correctness.
- Bug #1922 Prevent a potential panic in MatchVulnerabilities when the API response is nil, particularly on timeout.
- Bug #1916 Add the "ubuntu" namespace to the debian purl type to correctly parse dpkg BOMs generated on Ubuntu.
- Bug #1871 Ensure inventories are sorted by PURL in addition to name and version to prevent incorrect deduplication of packages.
- Bug #1919 Improve error reporting by including the underlying error when the response body from a Maven registry cannot be read.
- Bug #1857 Fix an issue where SPDX output is not correctly outputted because it was getting overwritten.
- Bug #1873 Fix the GitHub Action to not ignore general errors during execution.
- Bug #1955 Fix issue causing error messages to be spammed when not running in a git repository.
- Bug #1930 Fix issue where Maven client loses auth data during extraction.
Misc:
- Update dependencies and updated golang to 1.24.4
New Contributors
- @jacj9 made their first contribution in #1860
- @ikkebr made their first contribution in #1830
- @LeonLow97 made their first contribution in #1882
- @osv-robot made their first contribution in #1912
- @laojianzi made their first contribution in #1922
- @Avgor46 made their first contribution in #1916
Full Changelog: v2.0.2...v2.0.3

Fixes:
- Bug #1842 Fix an issue in the GitHub Action where call analysis for Go projects using the tool directive (Go 1.24+) in go.mod files would fail. The scanner image has been updated to use a newer Go version.
- Bug #1806 Fix an issue where license overrides were not correctly reflected in the final scan results and license summary.
- Fix #1825, #1809, #1805, #1803, #1787 Enhance XML output stability and consistency by preserving original spacing and minimizing unnecessary escaping. This helps reduce differences when XML files are processed.
New Contributors
- @s-index made their first contribution in #1812
- @shahar-h made their first contribution in #1842
Full Changelog: v2.0.1...v2.0.2

Changelog
Features:
- Feature #1730 Add support for extracting dependencies from .NET packages.config and packages.lock.json files.
- Feature #1770 Add support for extracting dependencies from rust binaries compiled with cargo-auditable.
- Feature #1761 Improve output when scanning for OS packages, we now show binary packages associated with a source package in the table output.
Fixes:
- Bug #1752 Fix paging depth issue when querying the osv.dev API.
- Bug #1747 Ensure osv-reporter prints warnings instead of errors for certain messages to return correct exit code (related to osv-scanner-action#65).
- Bug #1717 Fix issue where nested CycloneDX components were not being parsed.
- Bug #1744 Fix issue where empty CycloneDX SBOMs was causing a panic.
- Bug #1726 De-duplicate references in CycloneDX report output for improved validity.
- Bug #1727 Remove automatic opening of HTML reports in the browser (fixes #1721).
- Bug #1735 Require a tag when scanning container images to prevent potential errors.
API Changes:
- API Change #1763 Made the SourceType enum public.
New Contributors
- @AlexLaroche made their first contribution in #1730
- @kuscar made their first contribution in #1726
Full Changelog: v2.0.0...v2.0.1