Repository: google/osv-scanner

Issue:
`--all-packages` flag should also show unscannable filtered packages.
Currently `--all-packages` flag only adds/includes packages that don't have any vulnerabilities. It should also add packages that have been filtered out because it can't be scanned for whatever reason.

In `osvscanner.go` after the initial scanning phase we do multiple filtering steps (most of the logic will be in `filter.go`). Specifically before querying packages are filtered out according to the config rules and according to whether they are scannable or not. 

These filtered packages should be set aside somewhere and then re-added back into the final result if the `--all-packages` flag is passed in. 

Discussion:
@SavvyHex: can I please be assigned to this issue?@another-rex: Sure, assigned to you.@SavvyHex: Hi, I've fixed the issue and `--all-packages` now shows all the unscannable filtered packages. Would you like me to make it so that it shows all of the packages that would normally be filtered out? I'm talking about the following functions :
- `filterNonContainerRelevantPackages`
- `filterIgnoredPackages`
- `filterResults`
- `filterPackageVulns`@another-rex: Thanks, I think the rest is still good to keep filtered, as they are mostly user defined. I can see `filterNonContainerRelevantPackages` as a potential one to also allow, but let's leave it for now.@SavvyHex: Okay, understood. I've submitted a PR for this issue. Please tell me if I need to change anything.

Solution patch:
diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
index 81fb6b86..f59816aa 100755
--- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
@@ -1776,7 +1776,7 @@ Total 8 packages affected by 17 known vulnerabilities (4 Critical, 4 High, 3 Med
 
 [TestCommand_CommitSupport/online_uses_git_commits - 1]
 Scanned <rootdir>/testdata/locks-git/osv-scanner.json file as a osv-scanner and found 11 packages
-Total 10 packages affected by 37 known vulnerabilities (6 Critical, 7 High, 14 Medium, 4 Low, 6 Unknown) from 1 ecosystem.
+Total 11 packages affected by 41 known vulnerabilities (6 Critical, 9 High, 16 Medium, 4 Low, 6 Unknown) from 1 ecosystem.
 0 vulnerabilities can be fixed.
 
 
@@ -1812,6 +1812,10 @@ Total 10 packages affected by 37 known vulnerabilities (6 Critical, 7 High, 14 M
 | https://osv.dev/CVE-2025-9230  | 7.5  | GIT       |        https://github.com/openssl/openssl@45fda76b       | --            | testdata/locks-git/osv-scanner.json |
 | https://osv.dev/CVE-2025-9231  | 6.5  | GIT       |        https://github.com/openssl/openssl@45fda76b       | --            | testdata/locks-git/osv-scanner.json |
 | https://osv.dev/CVE-2025-9232  | 5.9  | GIT       |        https://github.com/openssl/openssl@45fda76b       | --            | testdata/locks-git/osv-scanner.json |
+| https://osv.dev/CVE-2016-2183  | 7.5  | GIT       |        https://github.com/openssl/openssl@aea7aaf2       | --            | testdata/locks-git/osv-scanner.json |
+| https://osv.dev/CVE-2025-9230  | 7.5  | GIT       |        https://github.com/openssl/openssl@aea7aaf2       | --            | testdata/locks-git/osv-scanner.json |
+| https://osv.dev/CVE-2025-9231  | 6.5  | GIT       |        https://github.com/openssl/openssl@aea7aaf2       | --            | testdata/locks-git/osv-scanner.json |
+| https://osv.dev/CVE-2025-9232  | 5.9  | GIT       |        https://github.com/openssl/openssl@aea7aaf2       | --            | testdata/locks-git/osv-scanner.json |
 | https://osv.dev/CVE-2023-53159 | 9.1  | GIT       |  https://github.com/sfackler-fork/rust-openssl@3b064fdb  | --            | testdata/locks-git/osv-scanner.json |
 | https://osv.dev/CVE-2023-6180  | 5.3  | GIT       |  https://github.com/sfackler-fork/rust-openssl@3b064fdb  | --            | testdata/locks-git/osv-scanner.json |
 | https://osv.dev/CVE-2025-24898 | 6.3  | GIT       |  https://github.com/sfackler-fork/rust-openssl@3b064fdb  | --            | testdata/locks-git/osv-scanner.json |
@@ -2570,6 +2574,48 @@ could not determine extractor, requested package-lock.json
 
 ---
 
+[TestCommand_Filter/Show_all_Packages_with_empty_config - 1]
+{
+  "results": [
+    {
+      "source": {
+        "path": "<rootdir>/testdata/locks-insecure/osv-scanner-with-unscannables.json",
+        "type": "lockfile"
+      },
+      "packages": [
+        {
+          "package": {
+            "name": "stdlib",
+            "version": "1.999.1",
+            "ecosystem": "Go"
+          }
+        },
+        {
+          "package": {
+            "name": "toolchain",
+            "version": "1.24.4",
+            "ecosystem": ""
+          }
+        }
+      ]
+    }
+  ],
+  "experimental_config": {
+    "licenses": {
+      "summary": false,
+      "allowlist": null
+    }
+  }
+}
+
+---
+
+[TestCommand_Filter/Show_all_Packages_with_empty_config - 2]
+Scanned <rootdir>/testdata/locks-insecure/osv-scanner-with-unscannables.json file as a osv-scanner and found 2 packages
+Filtered 1 local/unscannable package/s from the scan.
+
+---
+
 [TestCommand_GithubActions/scanning_osv-scanner_custom_format - 1]
 Scanned <rootdir>/testdata/locks-insecure/osv-scanner-flutter-deps.json file as a osv-scanner and found 3 packages
 Total 1 package affected by 2 known vulnerabilities (0 Critical, 2 High, 0 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
diff --git a/cmd/osv-scanner/update/__snapshots__/command_test.snap b/cmd/osv-scanner/update/__snapshots__/command_test.snap
index 7bfc2b3d..268a5ec4 100755
--- a/cmd/osv-scanner/update/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/update/__snapshots__/command_test.snap
@@ -256,7 +256,7 @@ file not found: ./testdata/does_not_exist.xml
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.20.0</version>
+      <version>2.20.1</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
diff --git a/docs/usage.md b/docs/usage.md
index 1f0d0ddf..ec45db6f 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -123,6 +123,10 @@ See [licenses scanning](./license-scanning.md) for more details.
 
 The `--all-packages` flag can be used to output all packages in JSON format (make sure to set `--format=json`).
 
+Note that the `PackageOverrides` configuration, specifically the `ignore` action, takes precedence over this flag.
+
+See [configuration](./configuration.md#override-packages) for more details.
+
 ```bash
 osv-scanner --all-packages --format=json path/to/repository
 ```
diff --git a/pkg/osvscanner/filter.go b/pkg/osvscanner/filter.go
index 551b2114..a721e099 100644
--- a/pkg/osvscanner/filter.go
+++ b/pkg/osvscanner/filter.go
@@ -13,10 +13,11 @@ import (
 )
 
 // filterUnscannablePackages removes packages that don't have enough information to be scanned or
-// are not a supported ecosystem
+// are not a supported ecosystem, and returns the list of removed packages (if --all-packages flag is passed in)
 // e,g, local packages that specified by path
-func filterUnscannablePackages(scanResults *results.ScanResults) {
+func filterUnscannablePackages(scanResults *results.ScanResults, actions ScannerActions) []imodels.PackageScanResult {
 	packageResults := make([]imodels.PackageScanResult, 0, len(scanResults.PackageScanResults))
+	filteredPsr := make([]imodels.PackageScanResult, 0, len(scanResults.PackageScanResults))
 	for _, psr := range scanResults.PackageScanResults {
 		p := psr.PackageInfo
 
@@ -25,6 +26,10 @@ func filterUnscannablePackages(scanResults *results.ScanResults) {
 		case !p.Ecosystem().IsEmpty() && p.Name() != "" && p.Version() != "":
 		case p.Commit() != "":
 		default:
+			if actions.ShowAllPackages {
+				filteredPsr = append(filteredPsr, psr)
+			}
+
 			continue
 		}
 
@@ -32,6 +37,10 @@ func filterUnscannablePackages(scanResults *results.ScanResults) {
 		// If **any** of the following cases are true, skip this package
 		case p.Ecosystem().Ecosystem == osvschema.EcosystemMaven && p.Name() == "unknown", // Is Maven with package name unknown
 			p.Ecosystem().GetValidity() != nil && !p.Ecosystem().IsEmpty(): // Is invalid and not empty
+			if actions.ShowAllPackages {
+				filteredPsr = append(filteredPsr, psr)
+			}
+
 			continue
 		}
 
@@ -43,6 +52,8 @@ func filterUnscannablePackages(scanResults *results.ScanResults) {
 	}
 
 	scanResults.PackageScanResults = packageResults
+
+	return filteredPsr
 }
 
 // filterNonContainerRelevantPackages removes packages that are not relevant when doing container scanning
diff --git a/pkg/osvscanner/osvscanner.go b/pkg/osvscanner/osvscanner.go
index bcfe022a..be884f79 100644
--- a/pkg/osvscanner/osvscanner.go
+++ b/pkg/osvscanner/osvscanner.go
@@ -232,7 +232,7 @@ func DoScan(actions ScannerActions) (models.VulnerabilityResults, error) {
 	scanResult.GenericFindings = packagesAndFindings.GenericFindings
 
 	// ----- Filtering -----
-	filterUnscannablePackages(&scanResult)
+	unscannablePackages := filterUnscannablePackages(&scanResult, actions)
 	filterIgnoredPackages(&scanResult)
 
 	// ----- Custom Overrides -----
@@ -254,6 +254,10 @@ func DoScan(actions ScannerActions) (models.VulnerabilityResults, error) {
 		}
 	}
 
+	if len(unscannablePackages) > 0 {
+		scanResult.PackageScanResults = slices.Concat(scanResult.PackageScanResults, unscannablePackages)
+	}
+
 	return finalizeScanResult(scanResult, actions)
 }
 
@@ -371,7 +375,7 @@ func DoContainerScan(actions ScannerActions) (models.VulnerabilityResults, error
 	}
 
 	// ----- Filtering -----
-	filterUnscannablePackages(&scanResult)
+	unscannablePackages := filterUnscannablePackages(&scanResult, actions)
 	filterIgnoredPackages(&scanResult)
 
 	filterNonContainerRelevantPackages(&scanResult)
@@ -405,6 +409,10 @@ func DoContainerScan(actions ScannerActions) (models.VulnerabilityResults, error
 
 	scanResult.GenericFindings = scalibrSR.Inventory.GenericFindings
 
+	if len(unscannablePackages) > 0 {
+		scanResult.PackageScanResults = slices.Concat(scanResult.PackageScanResults, unscannablePackages)
+	}
+
 	return finalizeScanResult(scanResult, actions)
 }
 
diff --git a/pkg/osvscanner/vulnerability_result.go b/pkg/osvscanner/vulnerability_result.go
index 25d06223..af2f92a8 100644
--- a/pkg/osvscanner/vulnerability_result.go
+++ b/pkg/osvscanner/vulnerability_result.go
@@ -54,12 +54,10 @@ func buildVulnerabilityResults(
 			pkg.Package.Name = p.Name()
 		}
 
-		if p.Version() != "" && !p.Ecosystem().IsEmpty() {
-			pkg.Package.Name = p.Name()
-			pkg.Package.Version = p.Version()
-			pkg.Package.Ecosystem = p.Ecosystem().String()
-			pkg.Package.OSPackageName = p.OSPackageName()
-		}
+		pkg.Package.Name = p.Name()
+		pkg.Package.Version = p.Version()
+		pkg.Package.Ecosystem = p.Ecosystem().String()
+		pkg.Package.OSPackageName = p.OSPackageName()
 
 		if psr.PackageInfo.LayerMetadata != nil {
 			pkg.Package.ImageOrigin = &models.ImageOriginDetails{



Test patch:
diff --git a/cmd/osv-scanner/scan/source/command_test.go b/cmd/osv-scanner/scan/source/command_test.go
index 1453a982..d6091a77 100644
--- a/cmd/osv-scanner/scan/source/command_test.go
+++ b/cmd/osv-scanner/scan/source/command_test.go
@@ -1462,3 +1462,22 @@ func TestCommand_WithDetector_OffLinux(t *testing.T) {
 		})
 	}
 }
+
+func TestCommand_Filter(t *testing.T) {
+	t.Parallel()
+
+	tests := []testcmd.Case{
+		{
+			Name: "Show all Packages with empty config",
+			Args: []string{"", "source", "--format=json", "--all-packages", "--config=./testdata/osv-scanner-empty-config.toml", "--lockfile=osv-scanner:./testdata/locks-insecure/osv-scanner-with-unscannables.json"},
+			Exit: 0,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.Name, func(t *testing.T) {
+			t.Parallel()
+			testcmd.RunAndMatchSnapshots(t, tt)
+		})
+	}
+}
diff --git a/cmd/osv-scanner/scan/source/testdata/locks-insecure/osv-scanner-with-unscannables.json b/cmd/osv-scanner/scan/source/testdata/locks-insecure/osv-scanner-with-unscannables.json
new file mode 100644
index 00000000..01eaf457
--- /dev/null
+++ b/cmd/osv-scanner/scan/source/testdata/locks-insecure/osv-scanner-with-unscannables.json
@@ -0,0 +1,28 @@
+{
+  "results": [
+    {
+      "source": {},
+      "packages": [
+        {
+          "package": {
+            "name": "stdlib",
+            "version": "1.999.1",
+            "ecosystem": "Go"
+          }
+        }
+      ]
+    },
+    {
+      "source": {},
+      "packages": [
+        {
+          "package": {
+            "name": "toolchain",
+            "version": "1.24.4",
+            "ecosystem": ""
+          }
+        }
+      ]
+    }
+  ]
+}