Repository: google/osv-scanner

Issue:
OSV-Scanner 2.x is not able to scan Pub packages used in flutter application from SBOM
### Description
After upgrading from OSV Scanner version 1.9.2 to 2.3.1, SBOMs created by syft for flutter applications can not be scanned anymore (Pub ecosystem).

### Steps to reproduce
Scan SBOM containing Pub packages with OSV Scanner 2.3.1

`osv-scanner_windows_amd64_2_3_1.exe scan source -L minimalSbom.cdx.xml`
`Starting filesystem walk for root: C:\
Scanned C:\osv-scanner\minimalSbom.cdx.xml file and found 1 package
End status: 0 dirs visited, 1 inodes visited, 1 Extract calls, 560.8µs elapsed, 560.8µs wall time
Filtered 1 local/unscannable package/s from the scan.
No issues found`

Scanner reports one unscannable package, no scan result.

### Expected behaviour 
Behaviour similar to OSV Scanner 1.9.2. Pub packages from SBOM should get scanned and results should be reported.

`osv-scanner_windows_amd64_1_9_2.exe --sbom=minimalSbom.cdx.xml`
`Scanned C:\osv-scanner\minimalSbom.cdx.xml as CycloneDX SBOM and found 1 package
╭─────────────────────────────────────┬──────┬───────────┬────────────────────────────┬─────────┬─────────────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE                    │ VERSION │ SOURCE              │
├─────────────────────────────────────┼──────┼───────────┼────────────────────────────┼─────────┼─────────────────────┤
│ https://osv.dev/GHSA-3hpf-ff72-j67p │ 3.0  │ pub:      │ shared_preferences_android │ 2.3.3   │ minimalSbom.cdx.xml │
╰─────────────────────────────────────┴──────┴───────────┴────────────────────────────┴─────────┴─────────────────────╯`

OSV Scanner 1.9.2 is able to identify package and reports result from identical SBOM.

### Files

[minimalSbom.cdx.xml](https://github.com/user-attachments/files/24099094/minimalSbom.cdx.xml)

`<?xml version="1.0" encoding="UTF-8"?>
<bom xmlns="http://cyclonedx.org/schema/bom/1.6" serialNumber="urn:uuid:d6a734a4-605d-4924-ad01-811604f6538c" version="1">
  <metadata>
    <timestamp>2024-10-15T11:58:56+02:00</timestamp>
    <tools>
      <components>
        <component type="application">
          <author>anchore</author>
          <name>syft</name>
          <version>1.13.0</version>
        </component>
      </components>
    </tools>
    <component bom-ref="b581b4095678a456" type="file">
      <name>./sbom/</name>
    </component>
  </metadata>
  <components>
    <component bom-ref="pkg:pub/shared_preferences_android@2.3.3?hosted_url=pub.dev&amp;package-id=d2ac0070a633d1e7" type="library">
      <name>shared_preferences_android</name>
      <version>2.3.3</version>
      <cpe>cpe:2.3:a:shared-preferences-android:shared-preferences-android:2.3.3:*:*:*:*:*:*:*</cpe>
      <purl>pkg:pub/shared_preferences_android@2.3.3?hosted_url=pub.dev</purl>
      <properties>
        <property name="syft:package:foundBy">dart-pubspec-lock-cataloger</property>
        <property name="syft:package:language">dart</property>
        <property name="syft:package:type">dart-pub</property>
        <property name="syft:package:metadataType">dart-pubspec-lock-entry</property>
        <property name="syft:cpe23">cpe:2.3:a:shared-preferences-android:shared_preferences_android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared_preferences_android:shared-preferences-android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared_preferences_android:shared_preferences_android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared-preferences:shared-preferences-android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared-preferences:shared_preferences_android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared_preferences:shared-preferences-android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared_preferences:shared_preferences_android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared:shared-preferences-android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:cpe23">cpe:2.3:a:shared:shared_preferences_android:2.3.3:*:*:*:*:*:*:*</property>
        <property name="syft:location:0:path">\pubspec.lock</property>
      </properties>
      <licenses>
        <license>
          <id>BSD-3-Clause</id>
        </license>
      </licenses>
    </component>
 </components>
</bom>`

### Summary
OSV 2.x is not usable for this use case. Is there a way to get OSV Scanner 2.x scanning Pub packages like Version 1.x did? Thank you very much for your effort an your great software.

Hints from issue comments:
@another-rex: Thanks for the detailed bug report!, we'll look into it. @cuixq: The package seems filtered in [filterUnscannablePackages](https://github.com/google/osv-scanner/blob/main/pkg/osvscanner/filter.go#L27) due to the ecosystem being empty and the reason for this is that we fail to convert the ecosystem in [getPURLEcosystem](https://github.com/google/osv-scanner/blob/main/internal/utility/purl/purl_to_package.go#L29).

I tried to add `Pub` ecosystem to the [map](https://github.com/google/osv-scanner/blob/main/internal/utility/purl/purl_to_package.go#L11) and I am able to see the vulnerability reported again:

```
╭─────────────────────────────────────┬──────┬───────────┬────────────────────────────┬─────────┬───────────────┬───────────────────────────────────────────╮
│ OSV URL                             │ CVSS │ ECOSYSTEM │ PACKAGE                    │ VERSION │ FIXED VERSION │ SOURCE                                    │
├─────────────────────────────────────┼──────┼───────────┼────────────────────────────┼─────────┼───────────────┼───────────────────────────────────────────┤
│ https://osv.dev/GHSA-3hpf-ff72-j67p │ 3.0  │ Pub       │ shared_preferences_android │ 2.3.3   │ 2.3.4         │ minimalSbom.cdx.xml                       │
╰─────────────────────────────────────┴──────┴───────────┴────────────────────────────┴─────────┴───────────────┴───────────────────────────────────────────╯
```

Solution patch:
diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
index 801ebf52..29df22a5 100755
--- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
+++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap
@@ -461,21 +461,26 @@ overriding license for package Packagist/drupal/tfa/2.0.0-alpha4 with 0BSD
 overriding license for package Packagist/league/flysystem/1.0.8 with 0BSD
 overriding license for package Packagist/sentry/sdk/2.0.4 with 0BSD
 overriding license for package Packagist/theseer/tokenizer/1.1.3 with 0BSD
-Total 4 packages affected by 7 known vulnerabilities (2 Critical, 1 High, 1 Medium, 3 Low, 0 Unknown) from 4 ecosystems.
+Total 5 packages affected by 8 known vulnerabilities (2 Critical, 1 High, 1 Medium, 3 Low, 1 Unknown) from 4 ecosystems.
 6 vulnerabilities can be fixed.
 
 
-+---------------------------------------+------+-----------+------------------+----------+---------------+--------------------------------------------------+
-| OSV URL                               | CVSS | ECOSYSTEM | PACKAGE          | VERSION  | FIXED VERSION | SOURCE                                           |
-+---------------------------------------+------+-----------+------------------+----------+---------------+--------------------------------------------------+
-| https://osv.dev/GHSA-9f46-5r25-5wfm   | 9.8  | Packagist | league/flysystem | 1.0.8    | 1.1.4         | testdata/locks-insecure/composer.lock            |
-| https://osv.dev/GHSA-83v7-c2cf-p9c2   | 2.7  | Packagist | drupal/core      | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
-| https://osv.dev/GHSA-h89p-5896-f4q8   | 2.1  | Packagist | drupal/core      | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
-| https://osv.dev/GHSA-m6vv-vcj8-w8m7   | 5.9  | Packagist | drupal/core      | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
-| https://osv.dev/GHSA-mhpg-hpj5-73r2   | 3.7  | Packagist | drupal/core      | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
-| https://osv.dev/GHSA-9f46-5r25-5wfm   | 9.8  | Packagist | league/flysystem | 1.0.8    | 1.1.4         | testdata/locks-many-with-insecure/composer.lock  |
-| https://osv.dev/ALPINE-CVE-2025-26519 | 7.0  | Alpine    | musl             | 1.2.3-r4 | --            | testdata/locks-many-with-insecure/alpine.cdx.xml |
-+---------------------------------------+------+-----------+------------------+----------+---------------+--------------------------------------------------+
++-----------------------------------------+------+-----------+-----------------------+----------+---------------+--------------------------------------------------+
+| OSV URL                                 | CVSS | ECOSYSTEM | PACKAGE               | VERSION  | FIXED VERSION | SOURCE                                           |
++-----------------------------------------+------+-----------+-----------------------+----------+---------------+--------------------------------------------------+
+| https://osv.dev/GHSA-9f46-5r25-5wfm     | 9.8  | Packagist | league/flysystem      | 1.0.8    | 1.1.4         | testdata/locks-insecure/composer.lock            |
+| https://osv.dev/DRUPAL-CORE-2025-005    | 2.7  | Packagist | drupal/core           | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
+| https://osv.dev/GHSA-83v7-c2cf-p9c2     |      |           |                       |          |               |                                                  |
+| https://osv.dev/DRUPAL-CORE-2025-006    | 5.9  | Packagist | drupal/core           | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
+| https://osv.dev/GHSA-m6vv-vcj8-w8m7     |      |           |                       |          |               |                                                  |
+| https://osv.dev/DRUPAL-CORE-2025-007    | 2.1  | Packagist | drupal/core           | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
+| https://osv.dev/GHSA-h89p-5896-f4q8     |      |           |                       |          |               |                                                  |
+| https://osv.dev/DRUPAL-CORE-2025-008    | 3.7  | Packagist | drupal/core           | 10.4.5   | 10.4.9        | testdata/locks-many-with-insecure/composer.lock  |
+| https://osv.dev/GHSA-mhpg-hpj5-73r2     |      |           |                       |          |               |                                                  |
+| https://osv.dev/DRUPAL-CONTRIB-2025-083 |      | Packagist | drupal/simple_sitemap | 4.2.1    | --            | testdata/locks-many-with-insecure/composer.lock  |
+| https://osv.dev/GHSA-9f46-5r25-5wfm     | 9.8  | Packagist | league/flysystem      | 1.0.8    | 1.1.4         | testdata/locks-many-with-insecure/composer.lock  |
+| https://osv.dev/ALPINE-CVE-2025-26519   | 7.0  | Alpine    | musl                  | 1.2.3-r4 | --            | testdata/locks-many-with-insecure/alpine.cdx.xml |
++-----------------------------------------+------+-----------+-----------------------+----------+---------------+--------------------------------------------------+
 +---------+-------------------------+
 | LICENSE | NO. OF PACKAGE VERSIONS |
 +---------+-------------------------+
@@ -782,7 +787,7 @@ Scanned <rootdir>/testdata/sbom-insecure/bad-purls.cdx.xml file and found 15 pac
 Scanned <rootdir>/testdata/sbom-insecure/only-unimportant.spdx.json file and found 1 package
 Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found 136 packages
 Scanned <rootdir>/testdata/sbom-insecure/with-duplicates.cdx.xml file and found 17 packages
-Filtered 9 local/unscannable package/s from the scan.
+Filtered 10 local/unscannable package/s from the scan.
 Total 26 packages affected by 163 known vulnerabilities (20 Critical, 71 High, 49 Medium, 1 Low, 22 Unknown) from 4 ecosystems.
 11 vulnerabilities can be fixed.
 
@@ -1904,7 +1909,7 @@ Scanned <rootdir>/testdata/sbom-insecure/bad-purls.cdx.xml file and found 15 pac
 Scanned <rootdir>/testdata/sbom-insecure/only-unimportant.spdx.json file and found 1 package
 Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found 136 packages
 Scanned <rootdir>/testdata/sbom-insecure/with-duplicates.cdx.xml file and found 17 packages
-Filtered 9 local/unscannable package/s from the scan.
+Filtered 10 local/unscannable package/s from the scan.
 CVE-2025-26519 and 1 alias have been filtered out because: (no reason given)
 CVE-2018-25032 and 1 alias have been filtered out because: (no reason given)
 CVE-2022-1304 and 2 aliases have been filtered out because: (no reason given)
@@ -2122,7 +2127,7 @@ Scanning dir testdata/sbom-insecure/alpine.cdx.xml
 Scanning dir testdata/sbom-insecure/postgres-stretch.cdx.xml
 Scanned <rootdir>/testdata/sbom-insecure/alpine.cdx.xml file and found 15 packages
 Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found 136 packages
-Filtered 1 local/unscannable package/s from the scan.
+Filtered 2 local/unscannable package/s from the scan.
 CVE-2025-26519 and 1 alias have been filtered out because: (no reason given)
 CVE-2018-25032 and 1 alias have been filtered out because: (no reason given)
 CVE-2022-1304 and 2 aliases have been filtered out because: (no reason given)
@@ -4121,9 +4126,9 @@ No issues found
 [TestCommand_LocalDatabases/one_specific_supported_sbom_with_vulns - 1]
 Scanning dir ./testdata/sbom-insecure/postgres-stretch.cdx.xml
 Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found 136 packages
+Filtered 1 local/unscannable package/s from the scan.
 Loaded Debian local db from <tempdir>/osv-scanner/Debian/all.zip
 Loaded Go local db from <tempdir>/osv-scanner/Go/all.zip
-Loaded OSS-Fuzz local db from <tempdir>/osv-scanner/OSS-Fuzz/all.zip
 Total 21 packages affected by 156 known vulnerabilities (17 Critical, 67 High, 49 Medium, 1 Low, 22 Unknown) from 2 ecosystems.
 11 vulnerabilities can be fixed.
 
@@ -4327,9 +4332,9 @@ Total 21 packages affected by 156 known vulnerabilities (17 Critical, 67 High, 4
 [TestCommand_LocalDatabases/one_specific_supported_sbom_with_vulns - 3]
 Scanning dir ./testdata/sbom-insecure/postgres-stretch.cdx.xml
 Scanned <rootdir>/testdata/sbom-insecure/postgres-stretch.cdx.xml file and found 136 packages
+Filtered 1 local/unscannable package/s from the scan.
 Loaded Debian local db from <tempdir>/osv-scanner/Debian/all.zip
 Loaded Go local db from <tempdir>/osv-scanner/Go/all.zip
-Loaded OSS-Fuzz local db from <tempdir>/osv-scanner/OSS-Fuzz/all.zip
 Total 21 packages affected by 156 known vulnerabilities (17 Critical, 67 High, 49 Medium, 1 Low, 22 Unknown) from 2 ecosystems.
 11 vulnerabilities can be fixed.
 
diff --git a/internal/utility/purl/purl_to_package.go b/internal/utility/purl/purl_to_package.go
index 737345f8..61bb9b5c 100644
--- a/internal/utility/purl/purl_to_package.go
+++ b/internal/utility/purl/purl_to_package.go
@@ -9,21 +9,29 @@ import (
 // used like so: purlEcosystems[PkgURL.Type][PkgURL.Namespace]
 // * means it should match any namespace string
 var purlEcosystems = map[string]map[string]osvconstants.Ecosystem{
-	"apk":   {"alpine": osvconstants.EcosystemAlpine},
-	"cargo": {"*": osvconstants.EcosystemCratesIO},
+	"apk":      {"alpine": osvconstants.EcosystemAlpine},
+	"cargo":    {"*": osvconstants.EcosystemCratesIO},
+	"composer": {"*": osvconstants.EcosystemPackagist},
+	"conan":    {"*": osvconstants.EcosystemConanCenter},
+	"cran":     {"*": osvconstants.EcosystemCRAN},
 	"deb": {
 		"debian": osvconstants.EcosystemDebian,
 		"ubuntu": osvconstants.EcosystemUbuntu,
 	},
-	"hex":      {"*": osvconstants.EcosystemHex},
-	"golang":   {"*": osvconstants.EcosystemGo},
-	"maven":    {"*": osvconstants.EcosystemMaven},
-	"nuget":    {"*": osvconstants.EcosystemNuGet},
-	"npm":      {"*": osvconstants.EcosystemNPM},
-	"composer": {"*": osvconstants.EcosystemPackagist},
-	"generic":  {"*": osvconstants.EcosystemOSSFuzz},
-	"pypi":     {"*": osvconstants.EcosystemPyPI},
-	"gem":      {"*": osvconstants.EcosystemRubyGems},
+	"gem": {"*": osvconstants.EcosystemRubyGems},
+	// We don't yet have a GIT ecosystem which aligns with the generic type better.
+	// "generic": {"*": osvconstants.EcosystemOSSFuzz},
+	"github":  {"*": osvconstants.EcosystemGitHubActions},
+	"golang":  {"*": osvconstants.EcosystemGo},
+	"hackage": {"*": osvconstants.EcosystemHackage},
+	"hex":     {"*": osvconstants.EcosystemHex},
+	"k8s":     {"*": osvconstants.EcosystemKubernetes},
+	"maven":   {"*": osvconstants.EcosystemMaven},
+	"npm":     {"*": osvconstants.EcosystemNPM},
+	"nuget":   {"*": osvconstants.EcosystemNuGet},
+	"pub":     {"*": osvconstants.EcosystemPub},
+	"pypi":    {"*": osvconstants.EcosystemPyPI},
+	"swift":   {"*": osvconstants.EcosystemSwiftURL},
 }
 
 func getPURLEcosystem(pkgURL packageurl.PackageURL) osvconstants.Ecosystem {



Test patch:
diff --git a/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand.yaml b/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand.yaml
index 51dcb88d..2f7ded52 100644
--- a/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand.yaml
+++ b/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand.yaml
@@ -1084,7 +1084,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -1487,7 +1487,7 @@ interactions:
       proto: HTTP/2.0
       proto_major: 2
       proto_minor: 0
-      content_length: 761
+      content_length: 1128
       body: |
         {
           "results": [
@@ -1529,7 +1529,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -1539,25 +1539,48 @@ interactions:
             {},
             {
               "vulns": [
+                {
+                  "id": "DRUPAL-CORE-2025-005",
+                  "modified": "2025-12-10T23:41:07.744028Z"
+                },
+                {
+                  "id": "DRUPAL-CORE-2025-006",
+                  "modified": "2025-12-10T23:41:16.689525Z"
+                },
+                {
+                  "id": "DRUPAL-CORE-2025-007",
+                  "modified": "2025-12-10T23:41:19.050806Z"
+                },
+                {
+                  "id": "DRUPAL-CORE-2025-008",
+                  "modified": "2025-12-10T23:41:00.167393Z"
+                },
                 {
                   "id": "GHSA-83v7-c2cf-p9c2",
-                  "modified": "2025-11-25T18:42:33.163940Z"
+                  "modified": "2025-12-10T23:41:07.744028Z"
                 },
                 {
                   "id": "GHSA-h89p-5896-f4q8",
-                  "modified": "2025-11-25T18:42:45.454425Z"
+                  "modified": "2025-12-10T23:41:19.050806Z"
                 },
                 {
                   "id": "GHSA-m6vv-vcj8-w8m7",
-                  "modified": "2025-11-25T18:42:42.709841Z"
+                  "modified": "2025-12-10T23:41:16.689525Z"
                 },
                 {
                   "id": "GHSA-mhpg-hpj5-73r2",
-                  "modified": "2025-11-25T18:42:24.545801Z"
+                  "modified": "2025-12-10T23:41:00.167393Z"
+                }
+              ]
+            },
+            {
+              "vulns": [
+                {
+                  "id": "DRUPAL-CONTRIB-2025-083",
+                  "modified": "2025-12-10T23:41:32.857305Z"
                 }
               ]
             },
-            {},
             {},
             {
               "vulns": [
@@ -1573,7 +1596,7 @@ interactions:
         }
       headers:
         Content-Length:
-          - "761"
+          - "1128"
         Content-Type:
           - application/json
       status: 200 OK
@@ -1970,7 +1993,7 @@ interactions:
       proto: HTTP/1.1
       proto_major: 1
       proto_minor: 1
-      content_length: 23151
+      content_length: 23023
       host: api.osv.dev
       body: |
         {
@@ -2976,13 +2999,6 @@ interactions:
               },
               "version": "1.0.0-2"
             },
-            {
-              "package": {
-                "ecosystem": "OSS-Fuzz",
-                "name": "postgresql"
-              },
-              "version": "11.15"
-            },
             {
               "package": {
                 "ecosystem": "Debian",
@@ -3206,7 +3222,7 @@ interactions:
       proto: HTTP/2.0
       proto_major: 2
       proto_minor: 0
-      content_length: 20199
+      content_length: 20196
       body: |
         {
           "results": [
@@ -3231,7 +3247,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -4367,7 +4383,6 @@ interactions:
             {},
             {},
             {},
-            {},
             {
               "vulns": [
                 {
@@ -4590,7 +4605,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -4613,7 +4628,7 @@ interactions:
         }
       headers:
         Content-Length:
-          - "20199"
+          - "20196"
         Content-Type:
           - application/json
       status: 200 OK
@@ -5411,7 +5426,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -5578,7 +5593,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -5947,7 +5962,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -6114,7 +6129,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
diff --git a/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_Config_UnusedIgnores.yaml b/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_Config_UnusedIgnores.yaml
index 474c4c5d..5c348574 100644
--- a/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_Config_UnusedIgnores.yaml
+++ b/cmd/osv-scanner/scan/source/testdata/cassettes/TestCommand_Config_UnusedIgnores.yaml
@@ -139,7 +139,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -173,7 +173,7 @@ interactions:
       proto: HTTP/1.1
       proto_major: 1
       proto_minor: 1
-      content_length: 23151
+      content_length: 23023
       host: api.osv.dev
       body: |
         {
@@ -1179,13 +1179,6 @@ interactions:
               },
               "version": "1.0.0-2"
             },
-            {
-              "package": {
-                "ecosystem": "OSS-Fuzz",
-                "name": "postgresql"
-              },
-              "version": "11.15"
-            },
             {
               "package": {
                 "ecosystem": "Debian",
@@ -1409,7 +1402,7 @@ interactions:
       proto: HTTP/2.0
       proto_major: 2
       proto_minor: 0
-      content_length: 20199
+      content_length: 20196
       body: |
         {
           "results": [
@@ -1434,7 +1427,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -2570,7 +2563,6 @@ interactions:
             {},
             {},
             {},
-            {},
             {
               "vulns": [
                 {
@@ -2793,7 +2785,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -2816,7 +2808,7 @@ interactions:
         }
       headers:
         Content-Length:
-          - "20199"
+          - "20196"
         Content-Type:
           - application/json
       status: 200 OK
@@ -2827,7 +2819,7 @@ interactions:
       proto: HTTP/1.1
       proto_major: 1
       proto_minor: 1
-      content_length: 20012
+      content_length: 19884
       host: api.osv.dev
       body: |
         {
@@ -3763,13 +3755,6 @@ interactions:
               },
               "version": "1.0.0-2"
             },
-            {
-              "package": {
-                "ecosystem": "OSS-Fuzz",
-                "name": "postgresql"
-              },
-              "version": "11.15"
-            },
             {
               "package": {
                 "ecosystem": "Debian",
@@ -3895,7 +3880,7 @@ interactions:
       proto: HTTP/2.0
       proto_major: 2
       proto_minor: 0
-      content_length: 19738
+      content_length: 19735
       body: |
         {
           "results": [
@@ -3912,7 +3897,7 @@ interactions:
               "vulns": [
                 {
                   "id": "ALPINE-CVE-2025-26519",
-                  "modified": "2025-12-03T22:58:36.705692Z"
+                  "modified": "2025-12-11T11:16:21.978419Z"
                 }
               ]
             },
@@ -5032,7 +5017,6 @@ interactions:
             {},
             {},
             {},
-            {},
             {
               "vulns": [
                 {
@@ -5246,7 +5230,7 @@ interactions:
         }
       headers:
         Content-Length:
-          - "19738"
+          - "19735"
         Content-Type:
           - application/json
       status: 200 OK