Repository: google/osv-scanner

Issue:
Support osv-scanner-custom.json as a scannable file type.
Support `osv-scanner-custom.json` as a scannable file type. This should be as simple as adding that file name to the osv-scanner-custom extractor's FileRequired. 

Related #1938 

Discussion:

Solution patch:
diff --git a/Makefile b/Makefile
index 880cd82b..d03b604c 100644
--- a/Makefile
+++ b/Makefile
@@ -19,5 +19,5 @@ clean:
 update-snapshots:
 	UPDATE_SNAPS=true scripts/run_tests.sh
 
-docs:
+local-docs:
 	scripts/run_local_docs.sh
diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
index 9fef99eb..f6ce644c 100755
--- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
@@ -2010,7 +2010,7 @@ HTML output available at: <tempdir>/report.html
 
 ---
 
-[TestCommand_JavareachArchive/Test_java_reachability_enricher - 1]
+[TestCommand_JavareachArchive/jars_can_be_scanned_with_call_analysis - 1]
 Scanning dir ./fixtures/artifact/javareach_test.jar
 Java reachability enricher marked 14 packages as unreachable
 Scanned <rootdir>/fixtures/artifact/javareach_test.jar file and found 21 packages
@@ -2088,7 +2088,84 @@ Total 4 packages affected by 53 known vulnerabilities (18 Critical, 29 High, 5 M
 
 ---
 
-[TestCommand_JavareachArchive/Test_java_reachability_enricher - 2]
+[TestCommand_JavareachArchive/jars_can_be_scanned_with_call_analysis - 2]
+
+---
+
+[TestCommand_JavareachArchive/jars_can_be_scanned_without_call_analysis - 1]
+Scanning dir ./fixtures/artifact/javareach_test.jar
+Scanned <rootdir>/fixtures/artifact/javareach_test.jar file and found 21 packages
+Total 8 packages affected by 59 known vulnerabilities (18 Critical, 31 High, 8 Medium, 2 Low, 0 Unknown) from 1 ecosystem.
+58 vulnerabilities can be fixed.
+
+
++-------------------------------------+------+-----------+---------------------------------------------+------------------+---------------+--------------------------------------+
+| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE                                     | VERSION          | FIXED VERSION | SOURCE                               |
++-------------------------------------+------+-----------+---------------------------------------------+------------------+---------------+--------------------------------------+
+| https://osv.dev/GHSA-c28r-hw5m-5gv3 | 7.9  | Maven     | com.amazonaws:aws-java-sdk-s3               | 1.11.327         | 1.12.261      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-h46c-h94j-95f3 | 8.7  | Maven     | com.fasterxml.jackson.core:jackson-core     | 2.14.0           | 2.15.0        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-288c-cq4h-88gq | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.4       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-4gq5-ch57-c2mg | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-4w82-r329-3q67 | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.4       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-57j2-w4cx-62h2 | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.12.6.1      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-5949-rw7g-wx7w | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-5r5r-6hpj-8gg9 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-5ww9-j83m-q7qx | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-645p-88qh-w398 | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-6fpp-rgj9-8rwc | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.6       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-85cw-hj65-qqv9 | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-89qr-369f-5m5x | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-8c4j-34r4-xr8g | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-8w26-6f25-cm9x | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-9gph-22xh-8x98 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-9m6f-7xcq-8vf8 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-c8hm-7hpq-7jhg | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-cf6r-3wgc-h863 | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-cggj-fvv3-cqwv | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-cjjf-94ff-43w7 | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.4       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-cmfg-87vq-g5g4 | 5.9  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-cvm9-fjm9-3572 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-f3j5-rmmp-3fc5 | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.8.11.5      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-f9xh-2qgp-cq57 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-fmmc-742q-jg75 | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-fqwf-pjwf-7vqv | 8.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.4       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-gjmw-vf9h-g25v | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-gwp4-hfv6-p7hw | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-gww7-p5w4-wrfv | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.4       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-h3cw-g4mq-c5x2 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.6      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-h592-38cm-4ggp | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-h822-r4r5-v8jg | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-jjjh-jjxp-wpff | 7.5  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.12.7.1      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-m6x4-97wx-4q27 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-mph4-vhrx-mv67 | 5.9  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-mx7p-6679-8g3q | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.3       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-p43x-xfjf-5jhr | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.7       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-q93h-jc49-78gg | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.7       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-qjw2-hr98-qgfh | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-qr7j-h6gg-jmgc | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.4       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-r3gr-cxrf-hg25 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-r695-7vr9-jgc2 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-rfx6-vp9g-rh7v | 9.8  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.2       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-rgv9-q543-rqg4 | 8.2  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.12.7.1      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-rpr3-cw39-3pxh | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.4      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-v585-23hc-c647 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-vfqx-33qm-g869 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.6.7.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-w3f4-3q6j-rh82 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.7.9.5       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-wh8g-3j2c-rqj5 | 8.1  | Maven     | com.fasterxml.jackson.core:jackson-databind | 2.6.7.1          | 2.9.10.8      | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-j288-q9x7-2f5v | 6.5  | Maven     | org.apache.commons:commons-lang3            | 3.12.0           | 3.18.0        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-7r82-7xv7-xcpj | 5.3  | Maven     | org.apache.httpcomponents:httpclient        | 4.5.5            | 4.5.13        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-cj7v-27pg-wf7q | 2.7  | Maven     | org.eclipse.jetty:jetty-http                | 9.4.40.v20210413 | 9.4.47        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-hmr7-m48g-48f6 | 5.3  | Maven     | org.eclipse.jetty:jetty-http                | 9.4.40.v20210413 | 9.4.52        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-qh8g-58pp-2wxh | 6.3  | Maven     | org.eclipse.jetty:jetty-http                | 9.4.40.v20210413 | 12.0.12       | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-3gh6-v5v9-6v9j | 3.5  | Maven     | org.eclipse.jetty:jetty-servlets            | 9.4.40.v20210413 | 9.4.52        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-gwcr-j4wh-j3cq | 5.3  | Maven     | org.eclipse.jetty:jetty-servlets            | 9.4.40.v20210413 | 9.4.41        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-j26w-f9rq-mr2q | 5.3  | Maven     | org.eclipse.jetty:jetty-servlets            | 9.4.40.v20210413 | 9.4.54        | fixtures/artifact/javareach_test.jar |
+| https://osv.dev/GHSA-264p-99wq-f4j6 | 7.5  | Maven     | software.amazon.ion:ion-java                | 1.0.2            | --            | fixtures/artifact/javareach_test.jar |
++-------------------------------------+------+-----------+---------------------------------------------+------------------+---------------+--------------------------------------+
+
+---
+
+[TestCommand_JavareachArchive/jars_can_be_scanned_without_call_analysis - 2]
 
 ---
 
diff --git a/docs/manual-plugin-selection.md b/docs/manual-plugin-selection.md
index aa1c959e..83d0c1c6 100644
--- a/docs/manual-plugin-selection.md
+++ b/docs/manual-plugin-selection.md
@@ -21,7 +21,10 @@ Experimental
 {:toc}
 </details>
 
-By default, OSV-Scanner automatically enables the relevant plugins for each scanning situation (see [this page](./supported_languages_and_lockfiles.md) for more details). However, if the default selection is not suitable, or you require additional plugins from OSV-Scalibr (e.g., detectors), you can manually enable or disable them.
+By default, OSV-Scanner automatically enables the relevant plugins for each scanning situation
+(see [this page](./supported_languages_and_lockfiles.md) for more details).
+However, if the default selection is not suitable, or you require additional plugins from OSV-Scalibr (e.g., detectors),
+you can manually enable or disable them.
 
 ## Enabling and Disabling Plugins
 
@@ -30,13 +33,8 @@ You can control which plugins to run using the following flags:
 - `--experimental-plugins`: Enables a comma-separated list of specific plugins.
 - `--experimental-disable-plugins`: Disables a comma-separated list of specific plugins.
 
-For a full list of available plugin names, see OSV-Scalibr's `list.go` files:
-
-- [`enricher/enricherlist/list.go`](https://github.com/google/osv-scalibr/blob/main/enricher/enricherlist/list.go)
-- [`annotator/list/list.go`](https://github.com/google/osv-scalibr/blob/main/annotator/list/list.go)
-- [`detector/list/list.go`](https://github.com/google/osv-scalibr/blob/main/detector/list/list.go)
-- [`extractor/standalone/list/list.go`](https://github.com/google/osv-scalibr/blob/main/extractor/standalone/list/list.go)
-- [`extractor/filesystem/list/list.go`](https://github.com/google/osv-scalibr/blob/main/extractor/filesystem/list/list.go)
+For a full list of available plugin names, see OSV-Scalibr's documentation here:
+https://github.com/google/osv-scalibr/blob/main/docs/supported_inventory_types.md
 
 ### Presets
 
@@ -63,7 +61,9 @@ osv-scanner scan source --experimental-plugins lockfile --experimental-disable-p
 
 ### Detectors
 
-OSV-Scalibr provides detectors that can identify potential security issues beyond known vulnerabilities. We experimentally support these detectors. Currently, detector findings are only available in the JSON output under `experimental_generic_findings`.
+OSV-Scalibr provides detectors that can identify potential security issues beyond known vulnerabilities.
+We experimentally support these detectors. Currently, detector findings are only available in the JSON output under
+`experimental_generic_findings`.
 
 **Available Detector Presets:**
 
diff --git a/docs/migrating-from-scalibr.md b/docs/migrating-from-scalibr.md
new file mode 100644
index 00000000..7af324f1
--- /dev/null
+++ b/docs/migrating-from-scalibr.md
@@ -0,0 +1,121 @@
+---
+layout: default
+title: Migrating from osv-scalibr
+nav_order: 18
+---
+
+# Migrating from osv-scalibr to osv-scanner
+
+This guide is for users who are familiar with `osv-scalibr` and want to migrate to `osv-scanner`. It explains how to
+achieve similar results with `osv-scanner`.
+
+`osv-scanner` has integrated `osv-scalibr`'s inventory collection and vulnerability scanning capabilities.
+While most of `osv-scalibr`'s functionalities are available in `osv-scanner`, the command-line flags and output formats
+are different.
+
+## Command-line Equivalence
+
+The `osv-scanner` CLI is designed to be more intuitive and user-friendly. Here's a mapping of common `osv-scalibr`
+commands to their `osv-scanner` equivalents.
+
+### Scanning a directory
+
+**osv-scalibr:**
+
+```sh
+scalibr --root /path/to/your/project --result result.json
+```
+
+**osv-scanner:**
+
+```sh
+osv-scanner /path/to/your/project
+```
+
+### Selecting plugins
+
+OSV-Scanner has access to the full list of OSV-Scalibr plugins, though only a well tested subset of them are enabled by
+default in OSV-Scanner.
+
+In `osv-scalibr`, you can select which plugins to run using the `--extractors`, `--detectors` flags,
+or alternatively using the `--plugins` flag.
+
+For a full list of available plugin names, see OSV-Scalibr's documentation here:
+https://github.com/google/osv-scalibr/blob/main/docs/supported_inventory_types.md
+
+**osv-scalibr:**
+
+```sh
+scalibr --plugins python/pip,go/gomod --detectors go/govulncheck /path/to/your/project
+```
+
+In `osv-scanner`, you can achieve the same by using the `--experimental-plugins` flag. This is an experimental feature.
+
+**osv-scanner:**
+
+```sh
+osv-scanner --experimental-plugins python/pip,go/gomod,go/govulncheck /path/to/your/project
+```
+
+`osv-scanner` also allows you to disable default plugins with `--experimental-disable-plugins`.
+
+For more details on manual plugin selection in `osv-scanner`, see the [manual plugin selection documentation](manual-plugin-selection.md).
+
+### Generating SPDX output
+
+`osv-scalibr` uses the `-o` flag to specify the output format and file. For example, to generate an SPDX JSON report:
+
+**osv-scalibr:**
+
+```sh
+scalibr -o spdx23-json=result.spdx.json /path/to/your/project
+```
+
+`osv-scanner` uses the `--format` flag to specify the output format and the output is written to standard output,
+and a separate `--output` flag if you wish to save the output into a file.
+
+**osv-scanner:**
+
+```sh
+osv-scanner --format spdx-2.3-json /path/to/your/project > result.spdx.json
+```
+
+For more details on `osv-scanner` output formats, see the [output documentation](output.md).
+
+## Flag Translation Table
+
+| `osv-scalibr` Flag                | `osv-scanner` Flag        | Notes                                                                                                 |
+| --------------------------------- | ------------------------- | ----------------------------------------------------------------------------------------------------- |
+| `--version`                       | `--version`               | `osv-scanner version`                                                                                 |
+| `--root`                          | `[directory]` (argument)  | `osv-scanner scan source [directory]`                                                                 |
+| `--result`                        | `--output`                | `osv-scanner --output <file>`                                                                         |
+| `-o`                              | `--format` and `--output` | e.g. `osv-scalibr -o spdx23-json=r.json` becomes `osv-scanner --format spdx-2.3-json --output r.json` |
+| `--plugins`                       | `--experimental-plugins`  |                                                                                                       |
+| `--extractors`                    | `--experimental-plugins`  |                                                                                                       |
+| `--detectors`                     | `--experimental-plugins`  |                                                                                                       |
+| `--annotators`                    | `--experimental-plugins`  |                                                                                                       |
+| `--ignore-sub-dirs`               | (no direct equivalent)    | `osv-scanner` is not recursive by default. Use `--recursive` to enable.                               |
+| `--skip-dirs`                     | Not yet available         |                                                                                                       |
+| `--skip-dir-regex`                | Not yet available         |                                                                                                       |
+| `--skip-dir-glob`                 | Not yet available         |                                                                                                       |
+| `--max-file-size`                 | Not yet available         |                                                                                                       |
+| `--use-gitignore`                 | (default behavior)        | Use `--no-ignore` to disable.                                                                         |
+| `--remote-image`                  | `[image]` (argument)      | `osv-scanner scan image [image]`                                                                      |
+| `--image-tarball`                 | `--archive`               | `osv-scanner scan image --archive [tarball]`                                                          |
+| `--image-local-docker`            | `[image]` (argument)      | `osv-scanner scan image [image]` (it will look for local images first)                                |
+| `--image-platform`                | Not yet available         |                                                                                                       |
+| `--gobinary-version-from-content` | Not yet available         |                                                                                                       |
+| `--govulncheck-db`                | Not yet available         |                                                                                                       |
+| `--spdx-document-name`            | Not yet available         |                                                                                                       |
+| `--spdx-document-namespace`       | Not yet available         |                                                                                                       |
+| `--spdx-creators`                 | Not yet available         |                                                                                                       |
+| `--cdx-component-name`            | Not yet available         |                                                                                                       |
+| `--cdx-component-type`            | Not yet available         |                                                                                                       |
+| `--cdx-component-version`         | Not yet available         |                                                                                                       |
+| `--cdx-authors`                   | Not yet available         |                                                                                                       |
+| `--verbose`                       | `--verbosity`             | `osv-scanner --verbosity <level>`, e.g. `debug`.                                                      |
+| `--explicit-extractors`           | (default behavior)        |                                                                                                       |
+| `--filter-by-capabilities`        | (default behavior)        | `osv-scanner` automatically filters plugins.                                                          |
+| `--windows-all-drives`            | Not yet available         |                                                                                                       |
+| `--offline`                       | `--offline`               |                                                                                                       |
+| `--local-registry`                | `--maven-registry`        | Only for Maven.                                                                                       |
diff --git a/docs/supported_languages_and_lockfiles.md b/docs/supported_languages_and_lockfiles.md
index 0a32c2ce..8abfb4ed 100644
--- a/docs/supported_languages_and_lockfiles.md
+++ b/docs/supported_languages_and_lockfiles.md
@@ -142,3 +142,9 @@ Run the command below for detection:
 ```
 ./osv-scanner scan source -r /path/to/folder/you/want/to/scan
 ```
+
+### Known limitations
+
+When scanning a file in the `osv-scanner.json` format, using the `--format=spdx` flag produces incorrect output.
+
+For more details, see issue [#2192](https://github.com/google/osv-scanner/issues/2192).
diff --git a/docs/usage.md b/docs/usage.md
index 11d6dcef..1f0d0ddf 100644
--- a/docs/usage.md
+++ b/docs/usage.md
@@ -163,11 +163,11 @@ docker pull ghcr.io/google/osv-scanner:latest
 Once you have the image, you can test that it works by running:
 
 ```bash
-docker run -it ghcr.io/google/osv-scanner -h
+docker run ghcr.io/google/osv-scanner -h
 ```
 
 To run a scan, mount the directory to scan to `/src` and pass the necessary flags:
 
 ```bash
-docker run -it -v ${PWD}:/src ghcr.io/google/osv-scanner -L /src/go.mod
+docker run -v ${PWD}:/src ghcr.io/google/osv-scanner -L /src/go.mod
 ```



Test patch:
diff --git a/cmd/osv-scanner/scan/source/command_test.go b/cmd/osv-scanner/scan/source/command_test.go
index 388699a8..1bd1ead6 100644
--- a/cmd/osv-scanner/scan/source/command_test.go
+++ b/cmd/osv-scanner/scan/source/command_test.go
@@ -320,12 +320,16 @@ func TestCommand_JavareachArchive(t *testing.T) {
 
 	tests := []testcmd.Case{
 		{
-			Name: "Test java reachability enricher",
+			Name: "jars_can_be_scanned_without_call_analysis",
+			Args: []string{"", "source", "--all-vulns", "--experimental-plugins=artifact", "./fixtures/artifact/javareach_test.jar"},
+			Exit: 1,
+		},
+		{
+			Name: "jars_can_be_scanned_with_call_analysis",
 			Args: []string{"", "source", "--call-analysis=jar", "--all-vulns", "--experimental-plugins=artifact", "./fixtures/artifact/javareach_test.jar"},
 			Exit: 1,
 		},
 	}
-
 	for _, tt := range tests {
 		t.Run(tt.Name, func(t *testing.T) {
 			t.Parallel()