Repository: google/osv-scanner

Issue:
Regression in requirements.txt since 2.1.0
[requirements.txt](https://github.com/user-attachments/files/21669489/requirements.txt)

2.0.3
```
>"\Users\egon\Downloads\osv-scanner_windows_amd64 (2).exe" scan source -L requirements.txt
Scanned C:\m\1\tests\requirements.txt file and found 17 packages
╭─────────────────────────────────────┬──────┬───────────┬──────────────┬─────────┬──────────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE      │ VERSION │ SOURCE           │
├─────────────────────────────────────┼──────┼───────────┼──────────────┼─────────┼──────────────────┤
│ https://osv.dev/PYSEC-2023-254      │ 7.5  │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-jfhm-5ghh-2f97 │      │           │              │         │                  │
│ https://osv.dev/GHSA-3ww4-gg4f-jr7f │ 8.7  │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-5cpq-8wj7-hf2v │      │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-9v9h-cgj8-h64p │ 5.5  │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-jm77-qphf-c4w8 │      │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-v8gr-m533-ghj9 │      │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-w7pp-m8wf-vj6r │ 6.9  │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-x4qr-2fvf-3mr5 │ 7.4  │ PyPI      │ cryptography │ 3.3.2   │ requirements.txt │
│ https://osv.dev/GHSA-3rq5-2g8h-59hc │ 5.9  │ PyPI      │ dnspython    │ 1.14.0  │ requirements.txt │
│ https://osv.dev/PYSEC-2018-12       │ 6.1  │ PyPI      │ lxml         │ 3.6.0   │ requirements.txt │
│ https://osv.dev/GHSA-xp26-p53h-6h2p │      │           │              │         │                  │
│ https://osv.dev/PYSEC-2020-62       │ 6.1  │ PyPI      │ lxml         │ 3.6.0   │ requirements.txt │
│ https://osv.dev/GHSA-pgww-xf46-h92r │      │           │              │         │                  │
│ https://osv.dev/PYSEC-2021-19       │ 6.1  │ PyPI      │ lxml         │ 3.6.0   │ requirements.txt │
│ https://osv.dev/GHSA-jq4v-f5q6-mjqq │      │           │              │         │                  │
│ https://osv.dev/PYSEC-2022-230      │ 6.9  │ PyPI      │ lxml         │ 3.6.0   │ requirements.txt │
│ https://osv.dev/GHSA-wrxv-2j5q-m38w │      │           │              │         │                  │
│ https://osv.dev/GHSA-55x5-fj6c-h6m8 │ 8.2  │ PyPI      │ lxml         │ 3.6.0   │ requirements.txt │
│ https://osv.dev/PYSEC-2022-166      │      │ PyPI      │ paramiko     │ 2.7.1   │ requirements.txt │
│ https://osv.dev/GHSA-45x7-px36-x8w8 │ 5.9  │ PyPI      │ paramiko     │ 2.7.1   │ requirements.txt │
│ https://osv.dev/PYSEC-2018-28       │ 7.5  │ PyPI      │ requests     │ 2.9.1   │ requirements.txt │
│ https://osv.dev/GHSA-x84v-xcm2-53pg │      │           │              │         │                  │
│ https://osv.dev/PYSEC-2023-74       │ 6.1  │ PyPI      │ requests     │ 2.9.1   │ requirements.txt │
│ https://osv.dev/GHSA-j8r2-6x86-q33q │      │           │              │         │                  │
│ https://osv.dev/GHSA-9hjg-9r4m-mvj7 │ 5.3  │ PyPI      │ requests     │ 2.9.1   │ requirements.txt │
│ https://osv.dev/GHSA-9wx4-h78v-vm56 │ 5.6  │ PyPI      │ requests     │ 2.9.1   │ requirements.txt │
╰─────────────────────────────────────┴──────┴───────────┴──────────────┴─────────┴──────────────────╯
```

2.2.0 (and similar 2.1.0)
```
>"\Users\egon\Downloads\osv-scanner_windows_amd64.exe" scan source -L requirements.txt
unsupported file extension for requirements: .zip
(extracting as python/requirementsenhanceable) open m\1\tests\requirements.txt: invalid argument
```

Note the broken path with missing `C:\`. `-L` on Windows can be also a bit tricky, `C:\path\path` might be confused with `extractor:path`, the last time I checked I had to always pass extractor name on Windows with absolute paths.


Hints from issue comments:
@another-rex: Quick question, what shell are you using? Currently running in powershell I cannot seem to replicate this issue. I suspect maybe your shell is expanding requirements.txt path to an absolute path?

Passing absolute paths and having it intepreted as a extractor is something we should fix either way though. 

For now, can you try running it like this:

```
osv-scanner.exe scan source -L :requirements.txt 
# OR
osv-scanner.exe scan source -L :.\requirements.txt 
```

note the prepended `:`@egonk: @another-rex 2.2.2 works for me with absolute paths:
```
C:\Users\ekocj>downloads\osv-scanner_windows_amd64.exe -L c:\Users\ekocj\Downloads\go.mod
Scanned c:\Users\ekocj\Downloads\go.mod file and found 186 packages
No issues found
```

2.2.1 did not work
```
C:\Users\ekocj>"downloads\osv-scanner_windows_amd64 (1).exe" -L c:\Users\ekocj\Downloads\go.mod
could not determine extractor, requested c
```

That was fix #2188@egonk: @another-rex The problem with this specific requirements.txt is still there in 2.2.2 however, I used cmd.exe but the output is the same in powershell.
```
C:\Users\ekocj\Downloads>osv-scanner_windows_amd64.exe -L requirements.txt
unsupported file extension for requirements: .zip
(extracting as python/requirementsenhanceable) open Users\ekocj\Downloads\requirements.txt: invalid argument

C:\Users\ekocj\Downloads>osv-scanner_windows_amd64.exe -L :requirements.txt
unsupported file extension for requirements: .zip
(extracting as python/requirementsenhanceable) open Users\ekocj\Downloads\requirements.txt: invalid argument

C:\Users\ekocj\Downloads>osv-scanner_windows_amd64.exe -L :.\requirements.txt
unsupported file extension for requirements: .zip
(extracting as python/requirementsenhanceable) open Users\ekocj\Downloads\requirements.txt: invalid argument

C:\Users\ekocj\Downloads>osv-scanner_windows_amd64.exe -L c:\Users\ekocj\Downloads\requirements.txt
unsupported file extension for requirements: .zip
(extracting as python/requirementsenhanceable) open Users\ekocj\Downloads\requirements.txt: invalid argument
```@another-rex: Ah I see, I think it's something to do with transitive dependencies. I'll look into this further.@another-rex: Made the fix PR, in the mean time before the next fix is released, you can fix this by passing `--no-resolve` flag. 

The `.zip` error is it trying to resolve a transitive dependency and failing (dnspython@1.14.0), and it is falling back to the non resolving extractor, but that fallback logic is failing.

Solution patch:
diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap
index e7d139b2..4f9c95d8 100755
--- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap
@@ -273,7 +273,7 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne
 Scanning local image tarball "./testdata/test-ubuntu.tar"
 
 Container Scanning Result (Ubuntu 22.04.5 LTS):
-Total 19 packages affected by 37 known vulnerabilities (2 Critical, 11 High, 19 Medium, 4 Low, 1 Unknown) from 1 ecosystem.
+Total 19 packages affected by 38 known vulnerabilities (2 Critical, 11 High, 20 Medium, 4 Low, 1 Unknown) from 1 ecosystem.
 16 vulnerabilities can be fixed.
 
 
@@ -297,7 +297,7 @@ Ubuntu:22.04
 | ncurses        | 6.3-2ubuntu0.1               | No fix available        |          2 | libncurses6... (5)      | # 4 Layer        | ubuntu        |
 | openssl        | 3.0.2-0ubuntu1.18            | Partial fixes Available |          3 | libssl3                 | # 4 Layer        | ubuntu        |
 | pam            | 1.4.0-11ubuntu2.5            | Partial fixes Available |          3 | libpam-modules... (4)   | # 4 Layer        | ubuntu        |
-| pcre2          | 10.39-3ubuntu0.1             | No fix available        |          1 | libpcre2-8-0            | # 4 Layer        | ubuntu        |
+| pcre2          | 10.39-3ubuntu0.1             | No fix available        |          2 | libpcre2-8-0            | # 4 Layer        | ubuntu        |
 | perl           | 5.34.0-3ubuntu1.3            | Partial fixes Available |          3 | perl-base               | # 4 Layer        | ubuntu        |
 | shadow         | 1:4.8.1-2ubuntu2.2           | No fix available        |          2 | login, passwd           | # 4 Layer        | ubuntu        |
 | systemd        | 249.11-0ubuntu3.12           | Partial fixes Available |          2 | libsystemd0... (2)      | # 4 Layer        | ubuntu        |
@@ -318,7 +318,7 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne
 Scanning local image tarball "./testdata/test-ubuntu.tar"
 
 Container Scanning Result (Ubuntu 22.04.5 LTS):
-Total 19 packages affected by 37 known vulnerabilities (2 Critical, 11 High, 19 Medium, 4 Low, 1 Unknown) from 1 ecosystem.
+Total 19 packages affected by 38 known vulnerabilities (2 Critical, 11 High, 20 Medium, 4 Low, 1 Unknown) from 1 ecosystem.
 16 vulnerabilities can be fixed.
 
 
@@ -342,7 +342,7 @@ Ubuntu:22.04
 | ncurses        | 6.3-2ubuntu0.1               | No fix available        |          2 | libncurses6... (5)      | # 4 Layer        | ubuntu        |
 | openssl        | 3.0.2-0ubuntu1.18            | Partial fixes Available |          3 | libssl3                 | # 4 Layer        | ubuntu        |
 | pam            | 1.4.0-11ubuntu2.5            | Partial fixes Available |          3 | libpam-modules... (4)   | # 4 Layer        | ubuntu        |
-| pcre2          | 10.39-3ubuntu0.1             | No fix available        |          1 | libpcre2-8-0            | # 4 Layer        | ubuntu        |
+| pcre2          | 10.39-3ubuntu0.1             | No fix available        |          2 | libpcre2-8-0            | # 4 Layer        | ubuntu        |
 | perl           | 5.34.0-3ubuntu1.3            | Partial fixes Available |          3 | perl-base               | # 4 Layer        | ubuntu        |
 | shadow         | 1:4.8.1-2ubuntu2.2           | No fix available        |          2 | login, passwd           | # 4 Layer        | ubuntu        |
 | systemd        | 249.11-0ubuntu3.12           | Partial fixes Available |          2 | libsystemd0... (2)      | # 4 Layer        | ubuntu        |
@@ -2883,9 +2883,10 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar"
             }
           },
           "vulnerabilities": [
-            "UBUNTU-CVE-2022-41409"
+            "UBUNTU-CVE-2022-41409",
+            "UBUNTU-CVE-2025-58050"
           ],
-          "groups": 1
+          "groups": 2
         },
         {
           "package": {
diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
index 08bc5d79..2288fd83 100755
--- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
@@ -752,7 +752,7 @@ Scanned <rootdir>/testdata/sbom-insecure/only-unimportant.spdx.json file and fou
 Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found 136 packages
 Scanned <rootdir>/testdata/sbom-insecure/with-duplicates.cdx.xml file and found 17 packages
 Filtered 9 local/unscannable package/s from the scan.
-Total 26 packages affected by 154 known vulnerabilities (20 Critical, 61 High, 37 Medium, 1 Low, 35 Unknown) from 4 ecosystems.
+Total 26 packages affected by 155 known vulnerabilities (20 Critical, 61 High, 37 Medium, 1 Low, 36 Unknown) from 4 ecosystems.
 8 vulnerabilities can be fixed.
 
 
@@ -811,6 +811,7 @@ Total 26 packages affected by 154 known vulnerabilities (20 Critical, 61 High, 3
 | https://osv.dev/DSA-5142-1          | 6.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml                     |
 | https://osv.dev/DSA-5271-1          | 7.8  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml                     |
 | https://osv.dev/DSA-5391-1          | 6.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml                     |
+| https://osv.dev/DSA-5990-1          |      | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml                     |
 | https://osv.dev/CVE-2016-3709       | 7.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml                     |
 | https://osv.dev/CVE-2022-2309       |      |           |                                |                                    |                                   |                                                                     |
 | https://osv.dev/DLA-3878-1          |      |           |                                |                                    |                                   |                                                                     |
@@ -1323,13 +1324,15 @@ unsupported output format "unknown" - must be one of: table, html, vertical, jso
 Scanning dir ./testdata/locks-requirements
 Scanned <rootdir>/testdata/locks-requirements/my-requirements.txt file and found 6 packages
 Scanned <rootdir>/testdata/locks-requirements/requirements-dev.txt file and found 8 packages
+Scanned <rootdir>/testdata/locks-requirements/requirements-transitive.txt file and found 14 packages
 Scanned <rootdir>/testdata/locks-requirements/requirements.prod.txt file and found 3 packages
 Scanned <rootdir>/testdata/locks-requirements/requirements.txt file and found 13 packages
 Scanned <rootdir>/testdata/locks-requirements/the_requirements_for_test.txt file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/unresolvable-requirements.txt file and found 3 packages
 failed to parse metadata for file Flask-Cors-1.0.tar.gz: sdist: dependencies in setup.py, not in PKG-INFO
-Total 10 packages affected by 35 known vulnerabilities (2 Critical, 13 High, 18 Medium, 0 Low, 2 Unknown) from 1 ecosystem.
-35 vulnerabilities can be fixed.
+failed to resolve transitive dependencies for "<rootdir>/testdata/locks-requirements/unresolvable-requirements.txt", falling back to offline extraction: failed resolving: no file can be used for parsing requirements for package flask-cors version 1.0
+Total 15 packages affected by 50 known vulnerabilities (2 Critical, 17 High, 28 Medium, 0 Low, 3 Unknown) from 1 ecosystem.
+50 vulnerabilities can be fixed.
 
 
 +-------------------------------------+------+-----------+------------+---------+---------------+-----------------------------------------------------------+
@@ -1337,6 +1340,28 @@ Total 10 packages affected by 35 known vulnerabilities (2 Critical, 13 High, 18
 +-------------------------------------+------+-----------+------------+---------+---------------+-----------------------------------------------------------+
 | https://osv.dev/PYSEC-2023-62       | 8.7  | PyPI      | flask      | 1.0     | 2.2.5         | testdata/locks-requirements/my-requirements.txt           |
 | https://osv.dev/GHSA-m2qf-hxjv-5gpq |      |           |            |         |               |                                                           |
+| https://osv.dev/PYSEC-2021-98       | 6.9  | PyPI      | django     | 1.11.29 | 2.2.24        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-68w8-qjq3-2gfm |      |           |            |         |               |                                                           |
+| https://osv.dev/GHSA-7xr5-9hcq-chf9 | 4.0  | PyPI      | django     | 1.11.29 | 4.2.22        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-8x94-hmjh-97hq | 8.8  | PyPI      | django     | 1.11.29 | 3.2.15        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-rrqc-c2jx-6jgv | 6.3  | PyPI      | django     | 1.11.29 | 4.2.16        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/PYSEC-2023-62       | 8.7  | PyPI      | flask      | 1.0     | 2.2.5         | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-m2qf-hxjv-5gpq |      |           |            |         |               |                                                           |
+| https://osv.dev/PYSEC-2024-60       | 7.5  | PyPI      | idna       | 2.7     | 3.7           | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-jjg7-2v4v-x38h |      |           |            |         |               |                                                           |
+| https://osv.dev/PYSEC-2023-74       | 6.1  | PyPI      | requests   | 2.20.0  | 2.31.0        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-j8r2-6x86-q33q |      |           |            |         |               |                                                           |
+| https://osv.dev/GHSA-9hjg-9r4m-mvj7 | 5.3  | PyPI      | requests   | 2.20.0  | 2.32.4        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-9wx4-h78v-vm56 | 5.6  | PyPI      | requests   | 2.20.0  | 2.32.0        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/PYSEC-2020-148      | 6.9  | PyPI      | urllib3    | 1.24.3  | 1.25.9        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-wqvq-5m8c-6g24 |      |           |            |         |               |                                                           |
+| https://osv.dev/PYSEC-2021-108      |      | PyPI      | urllib3    | 1.24.3  | 1.26.5        | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/PYSEC-2023-192      | 8.1  | PyPI      | urllib3    | 1.24.3  | 1.26.17       | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-v845-jxx5-vc9f |      |           |            |         |               |                                                           |
+| https://osv.dev/PYSEC-2023-212      | 5.7  | PyPI      | urllib3    | 1.24.3  | 1.26.18       | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-g4mx-q9vg-27p4 |      |           |            |         |               |                                                           |
+| https://osv.dev/GHSA-34jh-p97f-mpxf | 4.4  | PyPI      | urllib3    | 1.24.3  | 1.26.19       | testdata/locks-requirements/requirements-transitive.txt   |
+| https://osv.dev/GHSA-pq67-6m6q-mj2v | 5.3  | PyPI      | urllib3    | 1.24.3  | 2.5.0         | testdata/locks-requirements/requirements-transitive.txt   |
 | https://osv.dev/PYSEC-2021-439      | 7.3  | PyPI      | django     | 2.2.24  | 2.2.25        | testdata/locks-requirements/requirements.prod.txt         |
 | https://osv.dev/GHSA-v6rh-hp5x-86rv |      |           |            |         |               |                                                           |
 | https://osv.dev/PYSEC-2022-1        | 8.7  | PyPI      | django     | 2.2.24  | 2.2.26        | testdata/locks-requirements/requirements.prod.txt         |
@@ -3084,7 +3109,7 @@ Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found
 Loaded Debian local db from <tempdir>/osv-scanner/Debian/all.zip
 Loaded Go local db from <tempdir>/osv-scanner/Go/all.zip
 Loaded OSS-Fuzz local db from <tempdir>/osv-scanner/OSS-Fuzz/all.zip
-Total 21 packages affected by 147 known vulnerabilities (17 Critical, 59 High, 37 Medium, 1 Low, 33 Unknown) from 2 ecosystems.
+Total 21 packages affected by 148 known vulnerabilities (17 Critical, 59 High, 37 Medium, 1 Low, 34 Unknown) from 2 ecosystems.
 8 vulnerabilities can be fixed.
 
 
@@ -3136,6 +3161,7 @@ Total 21 packages affected by 147 known vulnerabilities (17 Critical, 59 High, 3
 | https://osv.dev/DSA-5142-1          | 6.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/DSA-5271-1          | 7.8  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/DSA-5391-1          | 6.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
+| https://osv.dev/DSA-5990-1          |      | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/CVE-2016-3709       | 7.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/CVE-2022-2309       |      |           |                                |                                    |                                   |                                                 |
 | https://osv.dev/DLA-3878-1          |      |           |                                |                                    |                                   |                                                 |
@@ -3277,7 +3303,7 @@ Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found
 Loaded Debian local db from <tempdir>/osv-scanner/Debian/all.zip
 Loaded Go local db from <tempdir>/osv-scanner/Go/all.zip
 Loaded OSS-Fuzz local db from <tempdir>/osv-scanner/OSS-Fuzz/all.zip
-Total 21 packages affected by 147 known vulnerabilities (17 Critical, 59 High, 37 Medium, 1 Low, 33 Unknown) from 2 ecosystems.
+Total 21 packages affected by 148 known vulnerabilities (17 Critical, 59 High, 37 Medium, 1 Low, 34 Unknown) from 2 ecosystems.
 8 vulnerabilities can be fixed.
 
 
@@ -3329,6 +3355,7 @@ Total 21 packages affected by 147 known vulnerabilities (17 Critical, 59 High, 3
 | https://osv.dev/DSA-5142-1          | 6.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/DSA-5271-1          | 7.8  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/DSA-5391-1          | 6.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
+| https://osv.dev/DSA-5990-1          |      | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/CVE-2016-3709       | 7.5  | Debian    | libxml2                        | 2.9.4+dfsg1-2.2+deb9u6             | --                                | testdata/sbom-insecure/postgres-stretch.cdx.xml |
 | https://osv.dev/CVE-2022-2309       |      |           |                                |                                    |                                   |                                                 |
 | https://osv.dev/DLA-3878-1          |      |           |                                |                                    |                                   |                                                 |
@@ -3586,6 +3613,7 @@ Scanned <rootdir>/testdata/locks-many/package-lock.json file and found 1 package
 Scanned <rootdir>/testdata/locks-many/yarn.lock file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/my-requirements.txt file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/requirements-dev.txt file and found 1 package
+Scanned <rootdir>/testdata/locks-requirements/requirements-transitive.txt file and found 4 packages
 Scanned <rootdir>/testdata/locks-requirements/requirements.prod.txt file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/requirements.txt file and found 3 packages
 Scanned <rootdir>/testdata/locks-requirements/the_requirements_for_test.txt file and found 1 package
@@ -3617,6 +3645,7 @@ Scanned <rootdir>/testdata/locks-many/package-lock.json file and found 1 package
 Scanned <rootdir>/testdata/locks-many/yarn.lock file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/my-requirements.txt file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/requirements-dev.txt file and found 1 package
+Scanned <rootdir>/testdata/locks-requirements/requirements-transitive.txt file and found 4 packages
 Scanned <rootdir>/testdata/locks-requirements/requirements.prod.txt file and found 1 package
 Scanned <rootdir>/testdata/locks-requirements/requirements.txt file and found 3 packages
 Scanned <rootdir>/testdata/locks-requirements/the_requirements_for_test.txt file and found 1 package
@@ -4049,6 +4078,7 @@ unsupported data-source "github" - must be one of: deps.dev, native
 Scanning dir ./testdata/locks-requirements/unresolvable-requirements.txt
 Scanned <rootdir>/testdata/locks-requirements/unresolvable-requirements.txt file and found 3 packages
 failed to parse metadata for file Flask-Cors-1.0.tar.gz: sdist: dependencies in setup.py, not in PKG-INFO
+failed to resolve transitive dependencies for "<rootdir>/testdata/locks-requirements/unresolvable-requirements.txt", falling back to offline extraction: failed resolving: no file can be used for parsing requirements for package flask-cors version 1.0
 Total 3 packages affected by 8 known vulnerabilities (0 Critical, 3 High, 4 Medium, 0 Low, 1 Unknown) from 1 ecosystem.
 8 vulnerabilities can be fixed.
 
@@ -4097,6 +4127,35 @@ Total 2 packages affected by 5 known vulnerabilities (2 Critical, 1 High, 2 Medi
 
 ---
 
+[TestCommand_Transitive/scan_local_disk_transitive_dependencies - 1]
+Scanning dir ./testdata/locks-requirements/requirements-transitive.txt
+Scanned <rootdir>/testdata/locks-requirements/requirements-transitive.txt file and found 4 packages
+Total 3 packages affected by 8 known vulnerabilities (0 Critical, 2 High, 6 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
+8 vulnerabilities can be fixed.
+
+
++-------------------------------------+------+-----------+----------+---------+---------------+---------------------------------------------------------+
+| OSV URL                             | CVSS | ECOSYSTEM | PACKAGE  | VERSION | FIXED VERSION | SOURCE                                                  |
++-------------------------------------+------+-----------+----------+---------+---------------+---------------------------------------------------------+
+| https://osv.dev/PYSEC-2021-98       | 6.9  | PyPI      | django   | 1.11.29 | 2.2.24        | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/GHSA-68w8-qjq3-2gfm |      |           |          |         |               |                                                         |
+| https://osv.dev/GHSA-7xr5-9hcq-chf9 | 4.0  | PyPI      | django   | 1.11.29 | 4.2.22        | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/GHSA-8x94-hmjh-97hq | 8.8  | PyPI      | django   | 1.11.29 | 3.2.15        | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/GHSA-rrqc-c2jx-6jgv | 6.3  | PyPI      | django   | 1.11.29 | 4.2.16        | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/PYSEC-2023-62       | 8.7  | PyPI      | flask    | 1.0.0   | 2.2.5         | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/GHSA-m2qf-hxjv-5gpq |      |           |          |         |               |                                                         |
+| https://osv.dev/PYSEC-2023-74       | 6.1  | PyPI      | requests | 2.20.0  | 2.31.0        | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/GHSA-j8r2-6x86-q33q |      |           |          |         |               |                                                         |
+| https://osv.dev/GHSA-9hjg-9r4m-mvj7 | 5.3  | PyPI      | requests | 2.20.0  | 2.32.4        | testdata/locks-requirements/requirements-transitive.txt |
+| https://osv.dev/GHSA-9wx4-h78v-vm56 | 5.6  | PyPI      | requests | 2.20.0  | 2.32.0        | testdata/locks-requirements/requirements-transitive.txt |
++-------------------------------------+------+-----------+----------+---------+---------------+---------------------------------------------------------+
+
+---
+
+[TestCommand_Transitive/scan_local_disk_transitive_dependencies - 2]
+
+---
+
 [TestCommand_Transitive/scans_dependencies_from_multiple_registries - 1]
 Scanned <rootdir>/testdata/maven-transitive/registry.xml file as a pom.xml and found 59 packages
 Total 2 packages affected by 5 known vulnerabilities (2 Critical, 1 High, 2 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
diff --git a/cmd/osv-scanner/update/__snapshots__/command_test.snap b/cmd/osv-scanner/update/__snapshots__/command_test.snap
index 05221c22..7bfc2b3d 100755
--- a/cmd/osv-scanner/update/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/update/__snapshots__/command_test.snap
@@ -114,7 +114,7 @@ file not found: ./testdata/does_not_exist.xml
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.20.0-rc1</version>
+      <version>2.20.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
@@ -185,7 +185,7 @@ file not found: ./testdata/does_not_exist.xml
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.20.0-rc1</version>
+      <version>2.20.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
@@ -256,7 +256,7 @@ file not found: ./testdata/does_not_exist.xml
     <dependency>
       <groupId>com.fasterxml.jackson.core</groupId>
       <artifactId>jackson-core</artifactId>
-      <version>2.20.0-rc1</version>
+      <version>2.20.0</version>
     </dependency>
     <dependency>
       <groupId>junit</groupId>
diff --git a/internal/scalibrextract/extract.go b/internal/scalibrextract/extract.go
index d24afb96..57d64839 100644
--- a/internal/scalibrextract/extract.go
+++ b/internal/scalibrextract/extract.go
@@ -131,6 +131,9 @@ func createScanInput(path string, root string, fileInfo fs.FileInfo) (*filesyste
 		return nil, err
 	}
 
+	// Convert path to slashes, as go FS expects unix like paths
+	path = filepath.ToSlash(path)
+
 	si := filesystem.ScanInput{
 		FS:     os.DirFS(root).(scalibrfs.FS),
 		Path:   path,
diff --git a/internal/scalibrextract/language/java/pomxmlenhanceable/pomxmlenhanceable.go b/internal/scalibrextract/language/java/pomxmlenhanceable/pomxmlenhanceable.go
index 8331f052..e1921918 100644
--- a/internal/scalibrextract/language/java/pomxmlenhanceable/pomxmlenhanceable.go
+++ b/internal/scalibrextract/language/java/pomxmlenhanceable/pomxmlenhanceable.go
@@ -9,6 +9,7 @@ import (
 	"github.com/google/osv-scalibr/extractor/filesystem/language/java/pomxmlnet"
 	"github.com/google/osv-scalibr/inventory"
 	"github.com/google/osv-scalibr/plugin"
+	"github.com/google/osv-scanner/v2/internal/cmdlogger"
 )
 
 const (
@@ -59,6 +60,9 @@ func (e *Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (i
 		return inv, err
 	}
 
+	cmdlogger.Warnf(
+		"failed to resolve transitive dependencies for %q, falling back to offline extraction: %s", input.Path, err.Error())
+
 	// Fallback to the base extractor if the enhanced extraction failed.
 	f, err := input.FS.Open(input.Path)
 	if err != nil {
diff --git a/internal/scalibrextract/language/python/requirementsenhancable/requirementsenhanceable.go b/internal/scalibrextract/language/python/requirementsenhancable/requirementsenhanceable.go
index 5cd3d3ca..6c69664c 100644
--- a/internal/scalibrextract/language/python/requirementsenhancable/requirementsenhanceable.go
+++ b/internal/scalibrextract/language/python/requirementsenhancable/requirementsenhanceable.go
@@ -10,6 +10,7 @@ import (
 	"github.com/google/osv-scalibr/extractor/filesystem/language/python/requirementsnet"
 	"github.com/google/osv-scalibr/inventory"
 	"github.com/google/osv-scalibr/plugin"
+	"github.com/google/osv-scanner/v2/internal/cmdlogger"
 )
 
 const (
@@ -60,6 +61,9 @@ func (e *Extractor) Extract(ctx context.Context, input *filesystem.ScanInput) (i
 		return inv, err
 	}
 
+	cmdlogger.Warnf(
+		"failed to resolve transitive dependencies for %q, falling back to offline extraction: %s", input.Path, err.Error())
+
 	// Fallback to the base extractor if the enhanced extraction failed.
 	f, err := input.FS.Open(input.Path)
 	if err != nil {



Test patch:
diff --git a/cmd/osv-scanner/scan/source/command_test.go b/cmd/osv-scanner/scan/source/command_test.go
index f665a486..a00c0124 100644
--- a/cmd/osv-scanner/scan/source/command_test.go
+++ b/cmd/osv-scanner/scan/source/command_test.go
@@ -997,6 +997,11 @@ func TestCommand_Transitive(t *testing.T) {
 			Args: []string{"", "source", "--config=./testdata/osv-scanner-empty-config.toml", "--data-source=github", "-L", "pom.xml:./testdata/maven-transitive/registry.xml"},
 			Exit: 127,
 		},
+		{
+			Name: "scan local disk transitive dependencies",
+			Args: []string{"", "source", "--config=./testdata/osv-scanner-empty-config.toml", "--no-resolve", "./testdata/locks-requirements/requirements-transitive.txt"},
+			Exit: 1,
+		},
 	}
 
 	for _, tt := range tests {
diff --git a/cmd/osv-scanner/scan/source/testdata/locks-requirements/requirements-transitive.txt b/cmd/osv-scanner/scan/source/testdata/locks-requirements/requirements-transitive.txt
new file mode 100644
index 00000000..ac963e0c
--- /dev/null
+++ b/cmd/osv-scanner/scan/source/testdata/locks-requirements/requirements-transitive.txt
@@ -0,0 +1,2 @@
+numpy==2.3.1
+-r requirements.txt