Attributed metadata history

v2.7.0

Features: Feature #2885 Include package URLs (purl) in JSON output when available. Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags. Feature #3113 Include vulnerability severity and rating in CycloneDX output when available. Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295). Dependency scanning & lockfile improvements via osv-scalibr: Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution. Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156). Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406). Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata. New extractors and plugin support via osv-scalibr: Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name. Fixes: Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099). Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases. Bug #3134 Preserve call analysis information when diffing vulnerability results. Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120). Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans. Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086). Fixes via osv-scalibr: Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444). Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448). Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263). Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419). Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162). Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012). Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398). Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456). Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429). Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445). Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439). Misc: Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137). Remove unused root Dockerfile (#3130). New Contributors @sanjay20m made their first contribution in #3102 @manenim made their first contribution in #3133 Full Changelog: v2.6.0...v2.7.0

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.