Release Notes

Four command-line additions that let an automated agent drive OSSScan end to end: check the machine is ready, keep the scanning tools current, open a finished export in the Review tab, and turn reviewed evaluations into the annotated reports without a dialog. They are the foundation for the OSSScan Agent, which scans your projects on a schedule and brings its findings and fixes to you as pull requests.

• --headless --status --json. Reports everything a scan depends on before any scan runs: build state, license and expiry, Terms acceptance, Syft, Grype, and ScanCode with installed and latest versions, the Grype database age, what kinds of scan are ready, and a list of problems with the command that fixes each.
• --headless --upgrade-components. Installs or upgrades Syft, Grype, the Grype database, and ScanCode through the package manager that owns each (Homebrew on macOS, winget or scoop on Windows, pipx for ScanCode). A tool OSSScan did not install is never overwritten; you get the command to run instead.
• --ui --review <folder>. Opens OSSScan straight onto the Review tab with an export folder loaded, so a link or a script can land you on the evaluations that need a decision.
• --headless --report --evaluations <folder> --out <dir>. Writes the annotated CVE and License HTML reports from an export folder, including every acceptance, dispute, and completed review beside the results, with no save dialog.
• Details for all four are in the app's docs/CLI.md and in OSSScan --headless --help.

OSSScan leaves beta. Licenses are now bought directly, at introductory prices through the end of 2026, and the app drops its beta labelling.

• Out of beta. No access code, no beta license. Buy a 7-day or 30-day license from the licensing page, bound to one machine, with no subscription to manage. Introductory pricing runs through 31 December 2026: 7-day $100 $79, 30-day $200 $149. Downloading stays free, and so do Compatibility Check and Check Project Coverage, so you can confirm OSSScan runs on your machine and see how well it covers your project before spending anything.
• Plus a range of smaller improvements and fixes across the app.

Two integrations that carry your review work outward: cleared CVE verdicts into GitHub, and permissive-license attribution obligations into a report you can act on. Plus direct control over what a scan counts, and faster ways to work through a long review queue.

• Dependabot integration: push cleared CVE verdicts to GitHub. An Update Dependabot action dismisses the Dependabot alerts matching CVE findings your team has already cleared in OSSScan, so investigated alerts stop reappearing. Each dismissal carries the reviewer’s name and reason into the alert’s activity timeline. The repository is detected from your git remote, every run starts with a dry-run preview, and the token you paste is never stored. The integration is one-way by design: OSSScan writes dismissals and never reads Dependabot state back. It also fails closed, holding a package’s alerts whenever copies of it carry conflicting verdicts, never treating a disputed finding as cleared, and reopening its own dismissal if a later scan re-flags something it cleared earlier. Read: Dependabot and OSSScan, Better Together
• Attribution Report for permissive licenses. Permissive licenses are not obligation-free. Most require you to carry the license text and copyright notice into whatever you ship. Tick “Also check permissive-license attribution” in the bulk license export, or pass --check-attribution, and OSSScan lists every permissive package with its obligation category and exactly what that category requires, then your review agent reads the real project files and writes the report. The categories come from a published catalog of 183 permissive licenses: A requires no attribution, B requires the license text and copyright notice, C is Apache-style and involves a NOTICE file, and D is a special non-copyleft case, with compound expressions resolving to the strictest category present. OSSScan states the category as a fact and leaves the judgement to your reviewer. Read: Do I Need to Care About Permissive Licenses?
• Scan scope control. Tell OSSScan whether you are auditing dependencies or examining a shippable artifact, and it scopes the scan to match. Nested repositories, working copies and VCS directories are left out of a dependency audit; installed-environment folders such as node_modules and venv are set aside only when a manifest provably accounts for the same packages, and kept whenever it cannot. Per-project setting in the UI, --scope-intent on the CLI.
• Bulk edit for License and CVE evaluations. Every review row has a checkbox, and the header checkbox selects everything currently visible, so selection composes with the new search bar in both review tables: search for MIT, select all, uncheck the two you want to handle separately, then act on the rest. Bulk Edit opens one modal where you choose a single determination and write one shared comment, and both are applied to every selected row. Licenses offer No concern, Needs review, and Compliance concern; CVEs offer Not exploitable, Needs investigation, and Exploitable. If the selection includes rows that already carry a determination, the modal asks whether to skip those or replace them rather than quietly overwriting earlier work, and where the agent flagged a finding for review, its reasoning is kept as provenance alongside your decision.
• Plus a range of smaller improvements and fixes across the app.