Issues

• javascript/packagejson: package.json skipped when contributors is a string

  google/osv-scalibr#2499 · Filter by author AstralunaProject opened on Oct 20, 2026
  1

• javascript/yarnlock: patched packages are reported twice in yarn berry lockfiles

  google/osv-scalibr#2497 · Filter by author drawliin opened on Oct 20, 2026

• pnpmlock: lockfileVersion 6 entries whose parenthesised peer-dependency suffix contains a scoped package are silently dropped

  google/osv-scalibr#2479 · Filter by author curphey opened on Oct 6, 2026

• reachability/java marks every dependency unreachable when its JAR cannot be downloaded

  google/osv-scalibr#2477 · Filter by author wils0ns opened on Oct 5, 2026
  1

• Windows path traversal in TARToTempDir: entry names validated with slash-only semantics, written with filepath.Join

  google/osv-scalibr#2417 · Filter by author jav1er8 opened on Sep 10, 2026
  2

• Extract git repository URLs

  google/osv-scalibr#2410 · Filter by author another-rex opened on Sep 9, 2026

• containerd extractor builds content blob paths from an unvalidated image digest, escaping ScanRoot

  google/osv-scalibr#2408 · Filter by author herdiyana256 opened on Sep 8, 2026

• Docker Compose extractor resolves include/extends paths against the host filesystem without ScanRoot validation

  google/osv-scalibr#2407 · Filter by author herdiyana256 opened on Sep 8, 2026

• Git submodule extractor does not validate submodule worktree paths against ScanRoot — junction/symlink traversal

  google/osv-scalibr#2403 · Filter by author mrteresteresearchsecurity-svg opened on Sep 7, 2026

• Version release semantics

  google/osv-scalibr#2378 · Filter by author GuillemSeCa opened on Aug 21, 2026
  2

• list.FromCapabilities(NetworkOffline) requires HTTP and GRPC clients

  google/osv-scalibr#2377 · Filter by author custcodian-dev opened on Aug 19, 2026
  4

  

• osvutil ignores PURL namespaces / groups from SBOMs when generating queries for osv.dev

  google/osv-scalibr#2355 · Filter by author Ly-Joey opened on Aug 12, 2026

• stats.Collector from ScanConfig not propagated to Extractors

  google/osv-scalibr#2316 · Filter by author evankanderson opened on Jul 21, 2026
  2

• PRP: Extend r/renvlock extractor to support Bioconductor packages (currently skipped with continue)

  PRP:RequestPRP
  google/osv-scalibr#2292 · Filter by author herdiyana256 opened on Jul 8, 2026
  1

  

• PRP: Fix dotnet MSBuild parser to support the <Version> child-element form of PackageReference (currently drops those packages)

  PRP:RequestPRP
  google/osv-scalibr#2288 · Filter by author h1-mrz opened on Jul 7, 2026
  1

  

• PRP: Extractor for CircleCI Orbs (.circleci/config.yml)

  google/osv-scalibr#2271 · Filter by author KirtiRamchandani opened on Jun 28, 2026

• PRP: Extractor for YOCTO/BitBake Recipe (.bb, .bbappend) Metadata

  google/osv-scalibr#2270 · Filter by author KirtiRamchandani opened on Jun 28, 2026

• Rework how SCALIBR stores package metadata for packages extracted from SBOMs

  google/osv-scalibr#2213 · Filter by author another-rex opened on Jun 12, 2026
  

• PRP: Extractor for Pipfile dependencies

  PRP:AcceptedPRP:RequestPRP
  google/osv-scalibr#2205 · Filter by author Abhinav-143x opened on Jun 11, 2026
  4

  

• PRP: Extractor for .NET local tool manifests (dotnet-tools.json)

  google/osv-scalibr#2204 · Filter by author danyu6666 opened on Jun 11, 2026
  1

• PRP: Enricher for CISA Known Exploited Vulnerabilities (KEV) Catalog

  PRP:Out of scopePRP:RequestPRP
  google/osv-scalibr#2194 · Filter by author Para-dox00 opened on Jun 9, 2026
  2

  

• PRP: Extractor for Haskell Cabal Package Manager

  PRP:AcceptedPRP
  google/osv-scalibr#2147 · Filter by author 0xXA opened on May 26, 2026
  3

  

• PRP: Extractor for Haskell Stack Package Manager

  PRP:AcceptedPRP:RequestPRP
  google/osv-scalibr#2146 · Filter by author 0xXA opened on May 26, 2026
  2

  

• PRP: Extractor for Python inline script metadata (PEP 723)

  google/osv-scalibr#2144 · Filter by author SuhaifengEric opened on May 26, 2026
  2

• PRP: Extractor for Hex Package Manager

  PRP:Out of scopePRP:RequestPRP
  google/osv-scalibr#2140 · Filter by author 0xXA opened on May 25, 2026
  3