Issues

• feat(output): include scan failures and skipped inputs in JSON results

  google/osv-scanner#3271 · Filter by author coygeek opened on Nov 10, 2026

• fix(output): vulnerability API failures are labelled as extraction errors

  google/osv-scanner#3270 · Filter by author coygeek opened on Nov 10, 2026

• 2.7.1 cannot scan readable lockfiles when Landlock denies opening filesystem root

  google/osv-scanner#3268 · Filter by author chenrui333 opened on Nov 9, 2026

• fix(output): gh-annotations ignores --output-file and leaves an empty report

  google/osv-scanner#3266 · Filter by author coygeek opened on Nov 9, 2026

• fix(cli): reject silently ignored extra image targets

  google/osv-scanner#3265 · Filter by author coygeek opened on Nov 9, 2026

• fix(mcp): surface invalid adjacent config in scan results

  google/osv-scanner#3264 · Filter by author coygeek opened on Nov 9, 2026
  1

• JSON output drops the version specifier of requirements.txt packages

  google/osv-scanner#3263 · Filter by author yanirz opened on Nov 8, 2026

• requirements.txt: unpinned and compound requirements are dropped before transitive resolution

  google/osv-scanner#3262 · Filter by author yanirz opened on Nov 8, 2026
  1

• Recursive scan skips lockfiles that git tracks when a .gitignore pattern also matches them

  google/osv-scanner#3261 · Filter by author wils0ns opened on Nov 8, 2026

• Report write failures are swallowed by table, vertical, Markdown and CycloneDX reporters

  google/osv-scanner#3256 · Filter by author rajatkaliani opened on Nov 6, 2026
  1

• fix(output): CycloneDX reports omit scanned Swift packages and their vulnerabilities

  google/osv-scanner#3240 · Filter by author coygeek opened on Nov 5, 2026
  

• fix(config): GoVersionOverride changes the reported stdlib version but not its advisories

  google/osv-scanner#3239 · Filter by author coygeek opened on Nov 5, 2026
  

• fix(output): CycloneDX export puts npm scope inside the PURL name

  google/osv-scanner#3238 · Filter by author coygeek opened on Nov 5, 2026
  

• fix(output): CycloneDX affects references do not resolve to scanned components

  google/osv-scanner#3237 · Filter by author coygeek opened on Nov 5, 2026
  

• fix(output): CycloneDX license.id holds SPDX expressions and non-SPDX values

  google/osv-scanner#3236 · Filter by author coygeek opened on Nov 5, 2026
  

• fix(fix): in-place JSON classifies direct dependency upgrades as transitive

  google/osv-scanner#3235 · Filter by author coygeek opened on Nov 5, 2026
  

• fix(cli): exact directory-name exclusions still scan matching directories

  google/osv-scanner#3233 · Filter by author coygeek opened on Nov 5, 2026
  1

  

• fix(docs): matrix workflow example contains invalid YAML lists

  google/osv-scanner#3231 · Filter by author coygeek opened on Nov 4, 2026
  

• feat(html): include scan time and scanner version in saved reports

  google/osv-scanner#3228 · Filter by author coygeek opened on Nov 4, 2026
  

• fix(docs): published matrix example loses GitHub Actions expressions

  google/osv-scanner#3227 · Filter by author coygeek opened on Nov 4, 2026
  

• feat(html): make saved reports render without remote assets

  google/osv-scanner#3226 · Filter by author coygeek opened on Nov 4, 2026
  

• fix(osvscannerjson): Debian and Alpine custom inputs silently miss advisories

  google/osv-scanner#3222 · Filter by author coygeek opened on Nov 4, 2026
  1

  

• fix(output): CycloneDX reports omit OS packages and their vulnerabilities

  google/osv-scanner#3218 · Filter by author coygeek opened on Nov 4, 2026
  1

• fix(mcp): scan tool silently discards ignore_glob_patterns

  bug
  google/osv-scanner#3206 · Filter by author coygeek opened on Nov 3, 2026
  3

• SARIF artifact paths are only made repo-relative inside the Docker action, not when running on a runner with GITHUB_WORKSPACE

  google/osv-scanner#3182 · Filter by author okarin1511 opened on Oct 28, 2026
  1