OSV-SCALIBR: A library for Software Composition Analysis

Google announces OSV-SCALIBR, an extensible open-source Go library that consolidates software composition analysis and filesystem/container scanning, enabling multi-OS package discovery, SBOM generation (SPDX/CycloneDX), and weak credential detection; it serves as Google’s primary SCA engine and will be integrated into OSV-Scanner for a richer CLI experience, with a roadmap including broader ecosystem support, container layer attribution, reachability analysis, and more detectors.