Attributed metadata history

v2.4.0

Features: Feature #2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0). Feature #2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default. Feature #2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems. Feature #2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans. Feature #2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation. Feature #2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings. Feature #2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin. Fixes: Bug #2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files. Bug #2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs. Bug #2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag. Bug #2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead. Bug #2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges. Bug #2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested. Misc: Update Go version to 1.26.4. Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e. Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#2857). New Contributors @herdiyana256 made their first contribution in #2801 @zhijie-yang made their first contribution in #2772 @francose made their first contribution in #2837 @rohan-patnaik made their first contribution in #2808 @evilgensec made their first contribution in #2807 @gotgolem made their first contribution in #2783 @Khuzaimx made their first contribution in #2857 Full Changelog: v2.3.8...v2.4.0

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.