Attributed metadata history
Up to 100 retained publisher events per page for afe832fad7950e39e26b48d6471e7bd852c9b56fd7843c9cec095310073581c2. Withdrawals and unavailable references remain attributed to their publishers.
intelligence_src_c675c564d013a8a4c9
observed · 2026-10-12 15:09:04 UTC
Features: Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action. Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins. Dependency scanning & lockfile improvements via osv-scalibr: Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock). Assign pkg:git PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages (#2863). Retain packages without a version or PURL in SPDX output (google/osv-scalibr#2375) and merge related packages based on lineage relationships. New extractors and plugin support via osv-scalibr: Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use --experimental-plugins flag. See "Supported Inventory Types" for the extractor name. Fixes: Bug #3075 Ensure results property in JSON output is an empty array [] instead of null when scanning with --allow-no-lockfiles and no lockfiles are found. Bug #3071 Preserve valid UTF-8 sequences when
Fingerprint: 1bf0fbb3f97f9d6f0c26cc4d2e30924c1f2752a21ea50cad27b3c01101c00a02
intelligence_src_c675c564d013a8a4c9
observed · 2026-10-12 15:09:04 UTC
available
Fingerprint: ebe56682a460fbbd8fc896db7195b35f1ac95a62a2029ef19bb828e7976e6b0e