Release Notes

Two integrations that carry your review work outward: cleared CVE verdicts into GitHub, and permissive-license attribution obligations into a report you can act on. Plus direct control over what a scan counts, and faster ways to work through a long review queue.

• Dependabot integration: push cleared CVE verdicts to GitHub. An Update Dependabot action dismisses the Dependabot alerts matching CVE findings your team has already cleared in OSSScan, so investigated alerts stop reappearing. Each dismissal carries the reviewer’s name and reason into the alert’s activity timeline. The repository is detected from your git remote, every run starts with a dry-run preview, and the token you paste is never stored. The integration is one-way by design: OSSScan writes dismissals and never reads Dependabot state back. It also fails closed, holding a package’s alerts whenever copies of it carry conflicting verdicts, never treating a disputed finding as cleared, and reopening its own dismissal if a later scan re-flags something it cleared earlier. Read: Dependabot and OSSScan, Better Together
• Attribution Report for permissive licenses. Permissive licenses are not obligation-free. Most require you to carry the license text and copyright notice into whatever you ship. Tick “Also check permissive-license attribution” in the bulk license export, or pass --check-attribution, and OSSScan lists every permissive package with its obligation category and exactly what that category requires, then your review agent reads the real project files and writes the report. The categories come from a published catalog of 183 permissive licenses: A requires no attribution, B requires the license text and copyright notice, C is Apache-style and involves a NOTICE file, and D is a special non-copyleft case, with compound expressions resolving to the strictest category present. OSSScan states the category as a fact and leaves the judgement to your reviewer. Read: Do I Need to Care About Permissive Licenses?
• Scan scope control. Tell OSSScan whether you are auditing dependencies or examining a shippable artifact, and it scopes the scan to match. Nested repositories, working copies and VCS directories are left out of a dependency audit; installed-environment folders such as node_modules and venv are set aside only when a manifest provably accounts for the same packages, and kept whenever it cannot. Per-project setting in the UI, --scope-intent on the CLI.
• Bulk edit for License and CVE evaluations. Every review row has a checkbox, and the header checkbox selects everything currently visible, so selection composes with the new search bar in both review tables: search for MIT, select all, uncheck the two you want to handle separately, then act on the rest. Bulk Edit opens one modal where you choose a single determination and write one shared comment, and both are applied to every selected row. Licenses offer No concern, Needs review, and Compliance concern; CVEs offer Not exploitable, Needs investigation, and Exploitable. If the selection includes rows that already carry a determination, the modal asks whether to skip those or replace them rather than quietly overwriting earlier work, and where the agent flagged a finding for review, its reasoning is kept as provenance alongside your decision.
• Plus a range of smaller improvements and fixes across the app.