Issues

• SARIF artifact paths are only made repo-relative inside the Docker action, not when running on a runner with GITHUB_WORKSPACE

  google/osv-scanner#3182 · Filter by author okarin1511 opened on Oct 28, 2026
  1

• v2.7.0 reports no vulnerabilities for NPM packages

  google/osv-scanner#3177 · Filter by author jescalada opened on Oct 27, 2026
  5

• sarif output omits deprecated/yanked packages that have no vulnerability

  google/osv-scanner#3164 · Filter by author night-warden opened on Oct 24, 2026
  1

• Go call analysis marks called vulnerabilities as uncalled when an uncalled finding comes last (last-wins aggregation)

  cleanup
  google/osv-scanner#3162 · Filter by author Subhan1794 opened on Oct 23, 2026
  2

  

• panic: unchecked type assertion on DW_AT_linkage_name crashes Rust call analysis on crafted DWARF

  google/osv-scanner#3127 · Filter by author LanZeroth opened on Oct 5, 2026
  2

• Memory usage grows beyond 6 GB when scanning a dpkg status file containing linux-libc-dev (Ubuntu 24.04)

  google/osv-scanner#3105 · Filter by author xWuWux opened on Sep 25, 2026
  13

  

• SARIF output emits one result per matched advisory in an alias group, creating duplicate code scanning alerts

  google/osv-scanner#3093 · Filter by author pmig opened on Sep 16, 2026
  5

• npm lockfile: CDN-resolved SheetJS releases are reported against npm-registry ranges

  google/osv-scanner#3073 · Filter by author j-del-fel opened on Sep 10, 2026
  3

• Explicit --licenses=false enables license scanning

  google/osv-scanner#3057 · Filter by author Muszic opened on Sep 7, 2026
  4

  

• Feature request - Container scanning - HTML output: Add a filter to only show items with a fix available

  good first issue
  Feature

  google/osv-scanner#3016 · Filter by author KoenDG opened on Aug 25, 2026
  13

  

• exit_code_redirect.sh ignores --allow-no-lockfiles=false in multiline Action input

  google/osv-scanner#3005 · Filter by author darpadebt opened on Aug 19, 2026
  8

• Config-driven vulnerability suppression leaves no trace in machine-readable output

  google/osv-scanner#3001 · Filter by author herdiyana256 opened on Aug 17, 2026
  4

  

• osv-scanner fix erroneously reports blocked vulnerabilities as fixed

  google/osv-scanner#2988 · Filter by author joshuatqualtrics opened on Aug 13, 2026
  1

  

• SARIF output always reports level=warning, ignoring the vulnerability's severity

  google/osv-scanner#2981 · Filter by author nvuillam opened on Aug 11, 2026
  6

• requirements.txt transitive traversal could potentially leak other files on the same image in CI

  backlognext-major
  google/osv-scanner#2954 · Filter by author another-rex opened on Aug 4, 2026
  2

• npm finding for local package on package-lock.lock - false positive?

  google/osv-scanner#2881 · Filter by author nirhaas opened on Jun 11, 2026
  3

  

• Feature request: GitLab Security Report output format + CI/CD component

  backlog
  google/osv-scanner#2875 · Filter by author AlexLaroche opened on Jun 10, 2026
  1

• Add ability to list plugins from CLI

  backlognext-major
  google/osv-scanner#2798 · Filter by author dosisod opened on May 13, 2026
  4

• Next major (v3)

  backlognext-major
  google/osv-scanner#2582 · Filter by author G-Rath opened on Mar 4, 2026
  

• Try to support CGO

  google/osv-scanner#2553 · Filter by author G-Rath opened on Feb 26, 2026
  6

  

• Python reachability

  google/osv-scanner#2540 · Filter by author cuixq opened on Feb 20, 2026
  

• surface upstream summary/description info of record with only one upstream and empty human fields

  google/osv-scanner#2476 · Filter by author i-bs opened on Oct 28, 2025
  5

  

• Filter vulnerabilities by malicious or just vuln

  backlog
  google/osv-scanner#2226 · Filter by author another-rex opened on Sep 9, 2025
  2

• Python Call graph analysis

  enhancement
  google/osv-scanner#2225 · Filter by author another-rex opened on Sep 9, 2025
  1

  

• Add distinct status code for vulnerabilities with available fixes

  backlogenhancement
  google/osv-scanner#2145 · Filter by author brabster opened on Aug 6, 2025
  3