Attributed metadata history
Up to 100 retained publisher events per page for a39caf01630d9672209cea3ecea202e89c0cfbdc5efd5a9bff66a1b72475a88c. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_c675c564d013a8a4c9
observed · 2026-10-12 15:09:04 UTC
Features: Feature #2885 Include package URLs (purl) in JSON output when available. Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags. Feature #3113 Include vulnerability severity and rating in CycloneDX output when available. Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295). Dependency scanning & lockfile improvements via osv-scalibr: Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution. Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156). Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406). Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata. New extractors and plugin support via osv-scalibr: Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name. Fixes: Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs
Fingerprint: 46df396f629590c1fc844acaaed58147aab0796e3a9dec3160170b304b359770
intelligence_src_c675c564d013a8a4c9
observed · 2026-10-12 15:09:04 UTC
available
Fingerprint: ebe56682a460fbbd8fc896db7195b35f1ac95a62a2029ef19bb828e7976e6b0e