Repository: google/osv-scanner
Pull request #1695: chore: Changelog for v2.0.0-rc1
Author: login: another-rex
Created: 2025-03-05T03:03:13Z | Merged: 2025-03-06T05:42:55Z



Diff:
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d676787fdcb..6a2c97a504c 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,36 @@
+# v2.0.0-rc1
+
+Our first release candidate for OSV-Scanner V2, which includes various breaking changes osv-scanner to help future proof osv-scanner in V2! See the changelog for beta1 and beta2 for the full list of changes.
+
+We've also added a migration guide here: https://google.github.io/osv-scanner/migration-guide.html
+
+### Changes:
+
+- [Feature #1670](https://github.com/google/osv-scanner/pull/1670) Guided remediation now makes non-interactive the default mode, and adds the `--interactive` flag.
+- [Feature #1670](https://github.com/google/osv-scanner/pull/1686) Removes the `--verbosity=verbose` verbosity level.
+- [Feature #1673](https://github.com/google/osv-scanner/pull/1673) & [Feature #1664](https://github.com/google/osv-scanner/pull/1664) Moves all our experimental flags out of experimental, and removes the experimental flags.
+- [Feature #1651](https://github.com/google/osv-scanner/pull/1651) License flags have been merged into a single license flag. See `--help` or migration guide for more details.
+
+### Features:
+
+- [Feature #1636](https://github.com/google/osv-scanner/pull/1636) `osv-scanner update` command has been released as an experimental feature.
+- [Feature #1582](https://github.com/google/osv-scanner/pull/1582) Add container scanning related information to vertical output format.
+- [Feature #1587](https://github.com/google/osv-scanner/pull/1587) Add support for severity in SARIF report format.
+
+### Fixes
+
+- [Fix #1677](https://github.com/google/osv-scanner/pull/1677) Fix OS filter for HTML report.
+- [Fix #1598](https://github.com/google/osv-scanner/pull/1598) Fix table output vulnerability ordering.
+- [Fix #1661](https://github.com/google/osv-scanner/pull/1661) Add spinner to iframs in the HTML report.
+- [Fix #1648](https://github.com/google/osv-scanner/pull/1648) Updated HTML report styling to improve contrast.
+- [Fix #1616](https://github.com/google/osv-scanner/pull/1616) Display git scanning results in HTML report.
+- [Fix #1616](https://github.com/google/osv-scanner/pull/1616) Filter out Ubuntu unimportant vulnerabilities.
+
+### API changes
+
+- [Feature #1666](https://github.com/google/osv-scanner/pull/1666) Removes `reporter`, all logging now goes through slog, which you can override to change the output.
+- [Feature #1638](https://github.com/google/osv-scanner/pull/1638) All deprecated packages have been removed from the osv-scanner module, this includes the `lockfile` package, which has been migrated to the `OSV-Scalibr` library.
+
 # v2.0.0-beta2
 
 This second beta release brings a series of fixes and improvements to the previous release.
diff --git a/cmd/osv-scanner/__snapshots__/main_test.snap b/cmd/osv-scanner/__snapshots__/main_test.snap
index 48c1690033c..5aff679e65d 100755
--- a/cmd/osv-scanner/__snapshots__/main_test.snap
+++ b/cmd/osv-scanner/__snapshots__/main_test.snap
@@ -160,7 +160,7 @@ Loaded filter from: <rootdir>/fixtures/locks-many/osv-scanner.toml
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -330,7 +330,7 @@ Loaded Alpine local db from <tempdir>/osv-scanner/Alpine/all.zip
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1164,7 +1164,7 @@ No issues found
 ---
 
 [Test_run/version - 1]
-osv-scanner version: 2.0.0-beta2
+osv-scanner version: 2.0.0-rc1
 commit: n/a
 built at: n/a
 
@@ -1381,7 +1381,7 @@ Scanned <rootdir>/fixtures/locks-insecure/osv-scanner-flutter-deps.json file as
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
diff --git a/internal/output/__snapshots__/sarif_test.snap b/internal/output/__snapshots__/sarif_test.snap
index cb66a92a313..5bd3bd69939 100755
--- a/internal/output/__snapshots__/sarif_test.snap
+++ b/internal/output/__snapshots__/sarif_test.snap
@@ -65,7 +65,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -152,7 +152,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -173,7 +173,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -194,7 +194,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -215,7 +215,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -236,7 +236,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -257,7 +257,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -278,7 +278,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -299,7 +299,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -320,7 +320,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -341,7 +341,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -362,7 +362,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -383,7 +383,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -404,7 +404,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -425,7 +425,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -446,7 +446,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -504,7 +504,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -634,7 +634,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -746,7 +746,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -812,7 +812,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -878,7 +878,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -944,7 +944,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1064,7 +1064,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1275,7 +1275,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1413,7 +1413,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -1471,7 +1471,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1637,7 +1637,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1848,7 +1848,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -1986,7 +1986,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -2007,7 +2007,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -2028,7 +2028,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -2049,7 +2049,7 @@
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "results": []
@@ -2107,7 +2107,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2190,7 +2190,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2256,7 +2256,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2322,7 +2322,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2388,7 +2388,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2455,7 +2455,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2539,7 +2539,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2640,7 +2640,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2723,7 +2723,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
@@ -2789,7 +2789,7 @@
               }
             }
           ],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-rc1"
         }
       },
       "artifacts": [
diff --git a/internal/version/version.go b/internal/version/version.go
index a26cf2c7bfe..32d5dffd9be 100644
--- a/internal/version/version.go
+++ b/internal/version/version.go
@@ -1,4 +1,4 @@
 package version
 
 // OSVVersion is the current release version, you should update this variable when doing a release
-const OSVVersion = "2.0.0-beta2"
+const OSVVersion = "2.0.0-rc1"


Reviews:
user: login: cuixq
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-03-05T03:25:56Z
user: login: another-rex
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-05T05:15:30Z
user: login: cuixq
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-05T05:18:48Z
user: login: hogo6002
state: APPROVED
author_association: CONTRIBUTOR
submitted_at: 2025-03-05T05:26:49Z
user: login: oliverchang
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-05T05:34:12Z
user: login: another-rex
state: COMMENTED
author_association: COLLABORATOR
submitted_at: 2025-03-06T03:26:08Z
user: login: oliverchang
state: APPROVED
author_association: COLLABORATOR
submitted_at: 2025-03-06T03:38:01Z

Review comments:
diff_hunk: @@ -1,3 +1,36 @@
+# v2.0.0-beta3
+
+This third and final beta makes various breaking changes osv-scanner to help future proof osv-scanner in V2!
+
+We've also added a migration guide here: https://google.github.io/osv-scanner/migration-guide.html
+
+### Changes:
path: CHANGELOG.md
user: login: cuixq
body: can you also mention that `update` is now available as experimental feature? https://github.com/google/osv-scanner/pull/1636 and https://github.com/google/osv-scanner/pull/1647
created_at: 2025-03-05T03:24:44Z
author_association: CONTRIBUTOR
diff_hunk: @@ -1,3 +1,36 @@
+# v2.0.0-beta3
+
+This third and final beta makes various breaking changes osv-scanner to help future proof osv-scanner in V2!
+
+We've also added a migration guide here: https://google.github.io/osv-scanner/migration-guide.html
+
+### Changes:
path: CHANGELOG.md
user: login: another-rex
body: Done.
created_at: 2025-03-05T05:15:30Z
author_association: COLLABORATOR
diff_hunk: @@ -160,7 +160,7 @@ Loaded filter from: <rootdir>/fixtures/locks-many/osv-scanner.toml
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-beta3"
path: cmd/osv-scanner/__snapshots__/main_test.snap
user: login: oliverchang
body: nit: the CHANGELOG mentions rc1, but these tests still say beta3? 
created_at: 2025-03-05T05:34:09Z
author_association: COLLABORATOR
diff_hunk: @@ -160,7 +160,7 @@ Loaded filter from: <rootdir>/fixtures/locks-many/osv-scanner.toml
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "2.0.0-beta2"
+          "version": "2.0.0-beta3"
path: cmd/osv-scanner/__snapshots__/main_test.snap
user: login: another-rex
body: Good catch updated now!
created_at: 2025-03-06T03:26:08Z
author_association: COLLABORATOR

PR comments:
user: login: codecov-commenter
created_at: 2025-03-05T03:10:18Z
body: ## [Codecov](https://app.codecov.io/gh/google/osv-scanner/pull/1695?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=google) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 64.58%. Comparing base [(`bb40b20`)](https://app.codecov.io/gh/google/osv-scanner/commit/bb40b20d74b5798d980035560755dc4ffcc49bf5?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=google) to head [(`2556da4`)](https://app.codecov.io/gh/google/osv-scanner/commit/2556da4ddef258757bf420a5023704c3e03a34b7?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=google).
> Report is 1 commits behind head on main.

<details><summary>Additional details and impacted files</summary>


```diff
@@            Coverage Diff             @@
##             main    #1695      +/-   ##
==========================================
+ Coverage   64.56%   64.58%   +0.01%     
==========================================
  Files         157      157              
  Lines       15840    15839       -1     
==========================================
+ Hits        10227    10229       +2     
+ Misses       4934     4932       -2     
+ Partials      679      678       -1     
```

</details>

[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/google/osv-scanner/pull/1695?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=google).   
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=google).

<details><summary>🚀 New features to boost your workflow: </summary>

- ❄ [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- 📦 [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
author_association: NONE
user: login: another-rex
created_at: 2025-03-06T03:47:55Z
body: Hmm I seem to be getting different results locally vs in the PR tests for container scanning which is really weird, I also rebuilt the images locally just now and got slightly different results... odd.
author_association: COLLABORATOR