https://cybertoolchain.io/tools/osv-scanner New releases and features in OSV-Scanner, tracked by The Cyber Toolchain. en Mon, 12 Oct 2026 01:32:07 GMT https://github.com/google/osv-scanner/releases/tag/v2.7.0 https://github.com/google/osv-scanner/releases/tag/v2.7.0 Mon, 12 Oct 2026 01:32:07 GMT OSV-Scanner v2.7.0 adds `purl` in JSON output, shorter `--x-` flag aliases, Zig extractor, and Bitnami SPDX SBOM scanning.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `purl` (package URL) fields to JSON output when available.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds shorter `--x-` flag aliases as replacements for the deprecated `--experimental-` flags. • Adds a `zig/buildzigzon` extractor for `build.zig.zon` files, available via `--x-plugins`, and adds support for scanning Bitnami container SPDX SBOMs via the `sbom/spdx` extractor. • Enables the Dart `package_config.json` (`dart/packageconfig`) extractor by default for lockfile scans and adds MinimOS ecosystem mapping to the APK extractor (`os/apk`). • Applies `--max-file-size` limit to container image contents and tags container image layers with Buildpacks lifecycle metadata. • Includes vulnerability severity and rating in CycloneDX output when available. • Adds best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.6.0 https://github.com/google/osv-scanner/releases/tag/v2.6.0 Mon, 14 Sep 2026 02:55:16 GMT OSV-Scanner v2.6.0 adds multi-arch container images, `--experimental-plugins` for new extractors, and `pkg:git` PURL typing for Git-pinned dependencies.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Enables additional file-type extractors (not on by default) via the `--experimental-plugins` flag — see the 'Supported Inventory Types' doc for extractor names.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Extracts Git repository URLs and supports local OSV tag matching for Git-based dependencies in JavaScript lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`). • Publishes a multi-arch (`linux/arm64`) container image for `osv-scanner-action`. • Retains packages without a version or PURL in SPDX output and merges related packages based on lineage relationships. • Configures retry policy with exponential backoff for transient gRPC errors in scalibr plugins. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.5.0 https://github.com/google/osv-scanner/releases/tag/v2.5.0 Fri, 07 Aug 2026 05:23:52 GMT OSV-Scanner v2.5.0 completes the OSV-Scalibr pipeline migration, adds VSIX scanning, and expands ecosystem support for SUSE, Azure Linux, and more. • Enables most `osv-scalibr` plugins via the `--experimental-plugins` flag after migrating scanning, filtering, and matching to the full `osv-scalibr` end-to-end pipeline. • Adds a `javascript/vsix` extractor to support scanning VS Code extension (`.vsix`) packages. • Extends ecosystem mapping in `osv-scalibr` to cover SUSE, Azure Linux / Mariner, Alpaquita, Mageia, openSUSE Leap, and Debian/Ubuntu PURL. • Updates the `osvscannerjson` extractor with PURL type resolution, mapping ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.4.0 https://github.com/google/osv-scanner/releases/tag/v2.4.0 Thu, 18 Jun 2026 13:35:18 GMT OSV-Scanner v2.4.0 adds CycloneDX 1.7, Swift/Chisel extraction, .csproj scanning and a new `ScanGoModVersion` config key • `os/chisel` extractor plugin to scan container images built with Canonical Chisel. • Enables the `swift/packageresolved` plugin by default for SwiftURL vulnerability scans. • Supports CycloneDX 1.7 specification via updated `cyclonedx-go` dependency. • Adds `.csproj` and Central Package Management (`nugetcpm`) source scanning plugins, enabled by default. • New `ScanGoModVersion` configuration setting (disabled by default) to control parsing of toolchain version directives in `go.mod`. • Extracts Alpine OS distro version from PURL `distro` qualifiers to scan packages under respective Alpine ecosystems. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.3.6 https://github.com/google/osv-scanner/releases/tag/v2.3.6 Fri, 01 May 2026 00:58:10 GMT OSV-Scanner v2.3.6 adds Homebrew git metadata scanning and regex package overrides • Enables regex matching for package name overrides via the `override` field in config files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.3.5 https://github.com/google/osv-scanner/releases/tag/v2.3.5 Wed, 25 Mar 2026 00:23:10 GMT Adds transitive scanning for requirements.txt via deps.dev API and configurable unsafe plugin warnings • Enables transitive scanning for Python requirements.txt files using the deps.dev API • Add ability to allow unsafe plugins, logging a warning when any unsafe plugin is enabled Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.3.3 https://github.com/google/osv-scanner/releases/tag/v2.3.3 Thu, 12 Feb 2026 00:12:48 GMT OSV-Scanner v2.3.3 adds --exclude flag, pylock extractor, and enhanced container scanning headers. • `--exclude` flag to skip paths during scanning • `pylock` extractor for parsing Python lockfiles • Container scanning output now includes base image info in the header table, markdown, and vertical formats Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.3.2 https://github.com/google/osv-scanner/releases/tag/v2.3.2 Thu, 15 Jan 2026 01:35:40 GMT OSV-Scanner v2.3.2 adds bun.lock support and allows specifying user agent in the osvscanner package • Adds `bun.lock` as a supported lockfile for dependency scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.3.1 https://github.com/google/osv-scanner/releases/tag/v2.3.1 Thu, 11 Dec 2025 06:03:17 GMT Adds `--experimental-flag-deprecated-packages` flag for `packagedeprecation` plugin support. • Excludes SPDX output format from `packagedeprecation` results Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.3.0 https://github.com/google/osv-scanner/releases/tag/v2.3.0 Wed, 19 Nov 2025 05:14:53 GMT OSV-Scanner v2.3.0 adds RubyGems license checks, replaces requirements-enhanceable with transitive enricher, and uses osduplicate annotators. • Adds RubyGems license checks for dependency analysis • Replaces `requirementsenhanceable` extractor with a transitive enricher • Uses `osduplicate` annotators for internal data processing Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.2.4 https://github.com/google/osv-scanner/releases/tag/v2.2.4 Wed, 29 Oct 2025 05:34:48 GMT Adds `osv-scanner experimental-mcp` subcommand for the MCP server • Updates the base image enrichment logic by replacing the `baseimagematch` component with a new 'base image enricher' in the `osv-scalibr` integration. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.2.3 https://github.com/google/osv-scanner/releases/tag/v2.2.3 Wed, 01 Oct 2025 04:55:36 GMT OSV-Scanner v2.2.3 adds `--experimental-no-default-plugins` flag and improves git package resolution. • Adds `--experimental-no-default-plugins` CLI flag to disable default experimental plugins while keeping explicitly listed ones via `--experimental-plugins` • Adds support for resolving git packages that have a version specified • Updates `osv-scalibr` dependency to v0.3.4 for improved dependency extraction Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.2.2 https://github.com/google/osv-scanner/releases/tag/v2.2.2 Wed, 27 Aug 2025 03:34:15 GMT OSV-Scanner v2.2.2 adds Java JAR reachability analysis and auto-parses `osv-scanner-custom.json` custom lockfiles. • Automatically parses `osv-scanner-custom.json` files as `osv-scanner.json` custom lockfiles, eliminating manual file naming requirements. • Adds Java reachability analysis for JAR files to identify uncalled (non-reachable) vulnerabilities and reduce noise. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.1.0 https://github.com/google/osv-scanner/releases/tag/v2.1.0 Fri, 11 Jul 2025 04:42:31 GMT OSV-Scanner v2.1.0 adds CycloneDX location field, `--show-all-vulns` flag, and experimental summary output format. • Adds the CycloneDX `location` field to the output source string for SBOM scanning results • Adds a new `summary` output format option to the reporter that can be enabled as an experimental feature • Adds the `--show-all-vulns` flag to display all vulnerabilities instead of hiding unimportant ones by default • Enables transitive dependency extraction for Python `requirements.txt` files, unlocking full graph analysis from flat lists • Adds support for parsing `gems.locked` files used by Bundler as a recognized lockfile type • Adds support for CycloneDX 1.6 report format ingestion Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.0.3 https://github.com/google/osv-scanner/releases/tag/v2.0.3 Mon, 16 Jun 2025 02:20:16 GMT OSV-Scanner v2.0.3 adds flags for extractor control, quiet mode, and post-positional CLI parsing • Adds `--experimental-extractors` flag to specify which OSV-Scalibr dependency extractors are used • Adds `--experimental-disable-extractors` flag to disable specific OSV-Scalibr dependency extractors • Adds a new quiet mode flag to suppress the "no package sources found" error • Updates CLI parsing to accept global flags after scan targets (e.g. `osv-scanner <path> --format=...`) • Adds a `stable` tag to container images for semver releases Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.0.1 https://github.com/google/osv-scanner/releases/tag/v2.0.1 Thu, 03 Apr 2025 04:10:55 GMT OSV-Scanner v2.0.1 adds .NET packages.config support and Cargo audit extraction for OS packages • Adds support for extracting dependencies from `.NET` `packages.config` and `packages.lock.json` files. • Adds support for extracting dependencies from rust binaries compiled with `cargo-auditable`. • The SourceType enum is now public. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v2.0.0 https://github.com/google/osv-scanner/releases/tag/v2.0.0 Mon, 17 Mar 2025 03:58:44 GMT OSV-Scanner v2.0 adds `osv-scanner scan image`, interactive HTML via `--serve`/`--port`, Maven guided remediation, and several new lockfile formats. • `scan image <image-name>:<tag>` command with layer-aware container scanning for Debian, Ubuntu, and Alpine • Interactive HTML output served by the `--serve` flag, controllable port via `--port` • Guided remediation for Maven `pom.xml` in non-interactive mode with `override` strategy support • `osv-scalibr` enhanced dependency extraction: `cabal.project.freeze`, `stack.yaml.lock`, `deps.json`, `uv.lock`, and artifacts (node_modules, wheels, uber jars, Go binaries) • New `osv-scanner update` command for updating the local vulnerability database (formerly experimental) • Container scanning information added to vertical output format • Severity support in SARIF report format • Support for `bun.lock` lockfiles Breaking changes: • Guided remediation now defaults to non-interactive mode; use the `--interactive` flag for interactive mode • Removed the `--verbosity=verbose` verbosity level • Experimental flag mechanism has been removed and all previous experimental flags are now out of experimental • Multiple license flags have been merged into a single `--license` flag • API: `reporter` removed; logging now uses `slog`, which can be overridden • API: Deprecated packages removed, including `lockfile` (migrated to `OSV-Scalibr`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.9.1 https://github.com/google/osv-scanner/releases/tag/v1.9.1 Thu, 31 Oct 2024 00:20:54 GMT OSV-Scanner v1.9.1 adds offline DB support to fix subcommand, private Maven registry support, and `vulnerabilities.ignore` in package overrides. • `--experimental-offline-vulnerabilities` and `--experimental-no-resolve` flags added for the fix subcommand to enable offline database usage • Support added for private registries when scanning Maven packages • `vulnerabilities.ignore` key now supported within package overrides to ignore specific vulnerabilities Breaking changes: • The `config`, `depsdev`, `grouper`, and `spdx` auxiliary packages are deprecated in the public API. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.8.5 https://github.com/google/osv-scanner/releases/tag/v1.8.5 Wed, 11 Sep 2024 05:58:36 GMT OSV-Scanner v1.8.5 adds Maven snapshot support, composite package overrides, and FIXED-VULN-IDS in guided remediation output • Support for composite-based package overrides allows ignoring entire manifests when scanning • Adds `FIXED-VULN-IDS` field to guided remediation non-interactive output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.8.4 https://github.com/google/osv-scanner/releases/tag/v1.8.4 Thu, 22 Aug 2024 04:49:46 GMT Adds `--upgrade-config` flag to allow per-package upgrade controls in OSV-Scanner v1.8.4. • Adds `--upgrade-config` flag for configuring allowed upgrades on a per-package basis. Breaking changes: • The `--disallow-major-upgrades` flag is deprecated and no longer active. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.8.3 https://github.com/google/osv-scanner/releases/tag/v1.8.3 Wed, 07 Aug 2024 04:39:08 GMT OSV-Scanner v1.8.3 adds 'vertical' output format for better readability. • Improves DiffVulnerabilityResults performance Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.8.2 https://github.com/google/osv-scanner/releases/tag/v1.8.2 Wed, 10 Jul 2024 06:21:54 GMT OSV-Scanner v1.8.2 adds CycloneDX 1.4 and 1.5 output formats • Adds support for generating reports in CycloneDX 1.4 format. • Adds support for generating reports in CycloneDX 1.5 format. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.8.1 https://github.com/google/osv-scanner/releases/tag/v1.8.1 Fri, 21 Jun 2024 02:49:00 GMT osv-scanner v1.8.1 adds transitive Maven scanning and package override configuration • Adds `--experimental-download-offline-databases` flag to download vulnerability databases before running in offline mode • Supports `[[PackageOverrides]]` sections in `osv-scanner.toml` to filter or license-override specific packages • Scans transitive dependencies in Maven `pom.xml` files Breaking changes: • The `--experimental-local-db` flag has been removed; use `--experimental-offline --experimental-download-offline-databases` to replicate its offline behavior Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.7.4 https://github.com/google/osv-scanner/releases/tag/v1.7.4 Thu, 30 May 2024 01:58:25 GMT OSV-Scanner v1.7.4 adds support for scanning gradle/verification-metadata.xml files • Supports scanning `gradle/verification-metadata.xml` files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.7.3 https://github.com/google/osv-scanner/releases/tag/v1.7.3 Thu, 09 May 2024 00:54:39 GMT OSV-Scanner v1.7.3 adds support for PNPM v9 lockfiles • Adds support for PNPM v9 lockfiles to the scanning engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.7.2 https://github.com/google/osv-scanner/releases/tag/v1.7.2 Fri, 19 Apr 2024 00:53:52 GMT OSV-Scanner v1.7.2 adds MakeVersionRequestsWithContext() API and exit code 129 for network errors • Adds MakeVersionRequestsWithContext() to the Go API for making OSV.dev requests with context support • Returns exit code 129 for API and networking related errors Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.7.0 https://github.com/google/osv-scanner/releases/tag/v1.7.0 Wed, 06 Mar 2024 04:34:57 GMT OSV-Scanner v1.7.0 adds the `osv-scanner fix` command for guided remediation and CVSS MaxSeverity in JSON output. • Adds the `osv-scanner fix` subcommand to provide guided remediation for npm dependencies • Include CVSS MaxSeverity in JSON output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.6.2 https://github.com/google/osv-scanner/releases/tag/v1.6.2 Wed, 31 Jan 2024 04:13:49 GMT OSV-Scanner v1.6.2 adds top-level `scan` subcommand, PDM lockfile support, and dependency groups to flattened output. • `scan` is now the top-level subcommand; omitting a command defaults to `scan` • Adds `pdm.lock` lockfile detection and parsing • Flattened vulnerability output now includes `dependency_group` field Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.6.1 https://github.com/google/osv-scanner/releases/tag/v1.6.1 Thu, 18 Jan 2024 01:37:27 GMT OSV-Scanner v1.6.1 adds NuGet lock file v2 support and `--ignore-vulns` flag • Adds support for scanning NuGet lock files version 2. • Adds the `--ignore-vulns` option to skip failing on vulnerability findings for GitHub Actions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.4.3 https://github.com/google/osv-scanner/releases/tag/v1.4.3 Thu, 02 Nov 2023 01:12:00 GMT Adds scanning for vendored C/C++ files and submodule commit hashes • Add support for scanning vendored C/C++ files • Scan submodules commit hashes Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.4.1 https://github.com/google/osv-scanner/releases/tag/v1.4.1 Fri, 06 Oct 2023 00:56:52 GMT OSV-Scanner v1.4.1 adds per-vulnerability SARIF output format and an experimental GitHub Action. • Adds `--sarif-format=vuln` to produce a SARIF file with one result object per individual vulnerability instead of a single aggregated finding • Introduces an experimental `osv-scanner` GitHub Action for repository integration • Exposes new ecosystem entries and a slice containing all known ecosystems in the library API Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.4.0 https://github.com/google/osv-scanner/releases/tag/v1.4.0 Thu, 14 Sep 2023 02:02:57 GMT OSV-Scanner v1.4.0 adds experimental offline mode, Rust call analysis, Go stdlib scanning, custom lockfile parsers, and io.Reader support. • Adds experimental offline mode for scanning without network access • Adds (experimental) Rust call analysis to detect if vulnerable functions are actually called • Detects the installed `go` version and checks for vulnerabilities in the Go standard library • Supports custom lockfile parsers via intermediate `osv-scanner.json` format • Lockfile package now supports extracting dependencies directly from any `io.Reader` Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.3.6 https://github.com/google/osv-scanner/releases/tag/v1.3.6 Wed, 19 Jul 2023 05:47:35 GMT OSV-Scanner v1.3.6 adds models.PURLToPackage() for programmatic package resolution • GoVulnCheck integration updated with minor enhancements. Breaking changes: • osvscanner.PURLToPackage() is deprecated; users should migrate to models.PURLToPackage(). This will break builds relying on the old package path if the library maintainers remove it in a future major version, but for now it is just marked as deprecated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.3.5 https://github.com/google/osv-scanner/releases/tag/v1.3.5 Wed, 28 Jun 2023 06:16:53 GMT OSV-Scanner v1.3.5 adds severity column to table output and expands OSV schema models • Adds a `severity` column to the default table output format • Adds `withdrawn` field to OSV model structs • Adds `related` field to OSV model structs • Adds new ecosystem constants to the OSV models package • Adds new reference types to the OSV models package • Implements YAML tags for improved serialization in OSV models Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.3.3 https://github.com/google/osv-scanner/releases/tag/v1.3.3 Wed, 17 May 2023 05:05:08 GMT OSV-Scanner v1.3.3 allows overriding the HTTP client in `pkg/osv` • Exposes `pkg/osv` with support for overriding the HTTP client and transport Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.3.0 https://github.com/google/osv-scanner/releases/tag/v1.3.0 Tue, 28 Mar 2023 03:28:12 GMT OSV-Scanner v1.3.0 adds --experimental-call-analysis flag for Go vulnerability scanning and -r support in requirements.txt • Adds `--experimental-call-analysis` flag to enable GoVulnCheck integration for Go code scanning • Supports `-r` flag in `requirements.txt` files for pip dependency resolution • Makes `IgnoredVulns` ignore aliases in addition to direct matches • Improves OSV models library API to allow 3rd party use of the library Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.2.0 https://github.com/google/osv-scanner/releases/tag/v1.2.0 Thu, 23 Feb 2023 01:36:03 GMT OSV-Scanner v1.2.0 adds debian status file scanning, `--lockfile` parser selection, and markdown/table output formats. • Supports parsing `/var/lib/dpkg/status` files for Debian package vulnerabilities • Adds `--lockfile` flag to explicitly specify the lockfile parser (e.g., `pip`, `npm`) instead of inferring from filename • Adds `--format` flag to control output format, supporting `json` and now `markdown-table` • Respects `.gitignore` files by default during directory scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.1.0 https://github.com/google/osv-scanner/releases/tag/v1.1.0 Thu, 12 Jan 2023 03:49:44 GMT OSV-Scanner v1.1.0 adds NuGet and Pipfile.lock ecosystem support • Adds `NuGet` ecosystem scanning capability • Adds `Pipfile.lock` file scanning capability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner https://github.com/google/osv-scanner/releases/tag/v1.0.1 https://github.com/google/osv-scanner/releases/tag/v1.0.1 Fri, 16 Dec 2022 01:54:10 GMT OSV-Scanner v1.0.1 adds `version` subcommand and ARM64 builds. • Adds the `version` subcommand to display the current OSV-Scanner version • Enables ARM64 build target for new OS releases Full history on Cyber Toolchain: https://cybertoolchain.io/tools/osv-scanner