google/osv-scalibr

View on GitHub

OSV-SCALIBR: A library for Software Composition Analysis

Stars: 643
Forks: 198
Open beginner issues: 2
Indexed issues: 142
Avg merge: 2d 17h
Merged PRs (30d): 28

Dominant language: Go
License: Apache-2.0
Last GitHub push: Sep 15, 2026
Latest indexed: Sep 16, 2026
Contributing guide: Contributing guide
Code of conduct: Code of conduct
Beginner labels: No beginner labels indexed

Open All

140 open issues indexed

Bazel support Open

enhancement

google/osv-scalibr#903 · 3 comments · 4 reactions · 0 assignees · Indexed Sep 16, 2026
Gitignore parsing does not respect repository boundaries Open

bug

google/osv-scalibr#902 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
[FR] File Locations in SPDX SBOM for language packages Open

google/osv-scalibr#45 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Detection of containers running in Docker and Podman runtime Open

google/osv-scalibr#144 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Add workflows to improve the ease of open source contributions. Open

google/osv-scalibr#158 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Centralise logic of package URL transformations for each ecosystem Open

google/osv-scalibr#173 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Better support for profiles in transitive Maven pom.xmls Open

enhancement

google/osv-scalibr#463 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
feat: Extract all fields of Alpine apk installed file Open

enhancement

google/osv-scalibr#245 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Setup `golangci-lint` in full Open

google/osv-scalibr#274 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Support for non-versioned dependencies? Open

enhancement

google/osv-scalibr#307 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
SBOM extractors should convert PURLs to the correct ecosystem Open

bug enhancement

google/osv-scalibr#335 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Provide default sets of extractors for scanning in container vs source context Open

enhancement

google/osv-scalibr#352 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 16, 2026
npm results returning a lot of false positives or are other tools missing stuff? Open

google/osv-scalibr#400 · 12 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Add local parent paths when performing transitive Maven dependency extraction Open

google/osv-scalibr#408 · 0 comments · 1 reaction · 0 assignees · Indexed Sep 16, 2026
Make sure Maven `settings.xml` are read correctly Open

google/osv-scalibr#409 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Review how to separate Location paths that's within an archive. Open

google/osv-scalibr#411 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Ignore vendored Go module files by default Open

google/osv-scalibr#423 · 2 comments · 2 reactions · 0 assignees · Indexed Sep 16, 2026
Add `classifier` and `type` to Maven PURL Open

google/osv-scalibr#426 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Support extracting Gradle `libs.versions.toml` Open

google/osv-scalibr#428 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Make FileRequired faster by using HasSuffix instead of filepath.Base Open

google/osv-scalibr#440 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Implement lints to match internal linting behavior Open

google/osv-scalibr#455 · 3 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Feature Request: Recursively open archives Open

google/osv-scalibr#513 · 6 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Can scalibr determine the dependency replationships? Open

google/osv-scalibr#532 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Support multiple regsitries and authentication in PyPI clients Open

google/osv-scalibr#541 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Feature Request: Report files installed per package in OS extractors Open

google/osv-scalibr#584 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Support scanning Rust binaries that weren't built with `cargo auditable` Open

google/osv-scalibr#637 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Support npm bundleDependencies in guided remediation clients Open

google/osv-scalibr#678 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Dependency Dashboard Open

google/osv-scalibr#772 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Fully implement Java reachability, addressing all TODOs Open

google/osv-scalibr#787 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
javascript extractors' handling of workspaces (and local dependencies?) Open

google/osv-scalibr#808 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 16, 2026
Increase mapping of Java / Maven artifact and group IDs Open

google/osv-scalibr#840 · 1 comment · 1 reaction · 0 assignees · Indexed Sep 16, 2026
Handle nested JARs in Java reachable Open

google/osv-scalibr#841 · 0 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
Should detector name(space)s be aligned with their finding reference and list Open

google/osv-scalibr#879 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
[EoL detector] Add detection for Ubuntu Legacy Open

google/osv-scalibr#889 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Parse javascript dependencies Open

google/osv-scalibr#907 · 0 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
Support scanning Windows OCI container images Open

google/osv-scalibr#953 · 0 comments · 2 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Extractor for Bazel WORKSPACE Open

PRP PRP:Accepted

google/osv-scalibr#980 · 10 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
PRP: Extractor for PDM, Poetry, and uv Open

PRP PRP: Contributor queue

google/osv-scalibr#984 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Extractor for Terraform Open

PRP PRP:Accepted

google/osv-scalibr#993 · 4 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
PRP: Extractor for Helm Open

PRP PRP: Contributor queue

google/osv-scalibr#994 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Extractor for vcpkg Open

PRP PRP: Contributor queue

google/osv-scalibr#1003 · 4 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Extractor for conan Open

PRP PRP: Contributor queue

google/osv-scalibr#1005 · 1 comment · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Secret extractor for JDBC Open

PRP PRP:Accepted

google/osv-scalibr#1008 · 7 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Secret extractor for MongoDB Open

PRP PRP:Accepted

google/osv-scalibr#1016 · 2 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Secret extractor for Rabbitmq Open

PRP PRP:Accepted

google/osv-scalibr#1019 · 3 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Extractor for Scala sbt Open

PRP PRP:Accepted

google/osv-scalibr#1022 · 5 comments · 0 reactions · 0 assignees · Indexed Sep 16, 2026
PRP: Secret extractor for Alibaba Cloud Open

PRP PRP:Accepted

google/osv-scalibr#1024 · 16 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
PRP: Secret extractor for IBM Cloud Open

PRP PRP:Accepted

google/osv-scalibr#1025 · 11 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
PRP: Secret extractor for PayPal Open

PRP PRP:Accepted

google/osv-scalibr#1027 · 10 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026
PRP: Secret extractor for Dropbox Open

PRP PRP:Accepted

google/osv-scalibr#1030 · 6 comments · 0 reactions · 1 assignee · Indexed Sep 16, 2026

google/osv-scalibr

Get new issues in your inbox