chore: v2.0.0-beta1 changelog (#1542)

changelog for v2 beta release.

---------

Co-authored-by: Rex P <[email protected]>

Author: cuixq

CHANGELOG.md

@@ -1,20 +1,102 @@
-OSV-Scanner v2 is coming soon! The next release will start with version `v2.0.0-alpha1`.
+# v2.0.0-beta1
 
-Here's a peek at some of the exciting upcoming features:
+The first beta of OSV-Scanner V2 is here! This beta release introduces significant enhancements, including refactored dependency extraction capabilities, container image scanning, and guided remediation for Maven.
 
-- Standalone container image scanning support.
-  - Including support for Alpine and Debian images.
-- Refactored internals to use [`osv-scalibr`](https://github.com/google/osv-scalibr) library for better extraction capabilities.
-- HTML output format for clearer vulnerability results.
-- More control over output format and logging.
-- ...and more!
+This beta release does _not_ introduce any breaking CLI changes and the beta period is expected to last approximately one month. However, as this is a beta release, there may be breaking changes breaking changes in the final release compared to the first beta.
 
-Importantly, the CLI interface of osv-scanner will be maintained with minimal breaking changes.
-Most breaking changes will only be in the API. More details in the upcoming alpha release.
+We encourage you to try out these new features and would appreciate any feedback you might have on our discussion topics:
 
----
+- [General V2 feedback](https://github.com/google/osv-scanner/discussions/1529)
+- [Container scanning feedback](https://github.com/google/osv-scanner/discussions/1521)
 
-This is the final feature v1 release of osv-scanner, future releases for v1 will only contain bug fixes.
+### Layer and base image-aware container scanning
+
+A significant new feature is a rewritten, layer-aware container scanning support for Debian, Ubuntu, and Alpine container images. OSV-Scanner can now analyze container images to provide:
+
+- Layers where a package was first introduced
+- Layer history and commands
+- Base images the image is based on
+- OS/Distro the container is running on
+
+This layer analysis leverages [OSV-Scalibr](https://github.com/google/osv-scalibr), and supports the following OSes and languages:
+| Distro Support | Language Artifacts Support |
+| -------------- | -------------------------- |
+| Alpine OS | Go |
+| Debian | Java |
+| Ubuntu | Node |
+| | Python |
+
+Base image identification also leverages a new experimental API provided by https://deps.dev.
+
+For usage, run the new `scan image` command:
+
+```
+osv-scanner scan image <image-name>:<tag>
+```
+
+Check out our [documentation](https://google.github.io/osv-scanner/usage/scan-image) for more details.
+
+### Interactive HTML output
+
+A new, interactive HTML output is now available. This provides a lot more interactivity and information compared to terminal only outputs, including:
+
+- Severity breakdown
+- Package and ID filtering
+- Vulnerability importance filtering
+- Full vulnerability advisory entries
+
+And additionally for container image scanning:
+
+- Layer filtering
+- Image layer information
+- Base image identification
+
+![Screenshot of HTML output for container image scanning](./docs/images/html-container-output.png)
+
+### Guided Remediation for Maven pom.xml
+
+Last year we released a feature called [guided remediation](https://osv.dev/blog/posts/announcing-guided-remediation-in-osv-scanner/) for npm. We have now expanded support to Maven pom.xml.
+
+With guided remediation support for Maven, you can remediate vulnerabilities in both direct and transitive dependencies through direct version updates or overriding versions through dependency management.
+
+We’ve introduced a few new features for our Maven support:
+
+- A new remediation strategy `override` is introduced.
+- Support for reading and writing pom.xml files, including writing changes to local parent pom files.
+- Private registry can be specified to fetch Maven metadata.
+
+The guided remediation support for Maven is only available in the non-interactive mode. For basic usage, run the following command:
+
+```
+osv-scanner fix --non-interactive --strategy=override -M path/to/pom.xml
+```
+
+We also introduced machine readable output for guided remediation that makes it easier to integrate guided remediation into your workflow.
+
+For more usage details on guided remediation, please see our [documentation](https://google.github.io/osv-scanner/experimental/guided-remediation/).
+
+### Enhanced Dependency Extraction with `osv-scalibr`
+
+With the help from [OSV-Scalibr](https://github.com/google/osv-scalibr), we now also have expanded support for the kinds of dependencies we can extract from projects and containers:
+
+#### Source manifests and lockfiles
+
+- Haskell: `cabal.project.freeze`, `stack.yaml.lock`
+- .NET: `deps.json`
+- Python: `uv.lock`
+
+#### Artifacts
+
+- node_modules
+- Python wheels
+- Java uber jars
+- Go binaries
+
+The full list of supported formats can be found [here](https://google.github.io/osv-scanner/supported-languages-and-lockfiles/).
+
+The first beta doesn’t enable every single extractor currently available in OSV-Scalibr today. We’ll continue to add more leading up to the final 2.0.0 release.
+
+OSV-Scalibr also makes it incredibly easy to add new extractors. Please file a [feature request](https://github.com/google/osv-scalibr/issues) if a format you’re interested in is missing!
 
 # v1.9.1
 

cmd/osv-scanner/__snapshots__/main_test.snap

@@ -95,7 +95,7 @@ Loaded filter from: <rootdir>/fixtures/locks-many/osv-scanner.toml
           "informationUri": "https://github.com/google/osv-scanner",
           "name": "osv-scanner",
           "rules": [],
-          "version": "1.9.1"
+          "version": "2.0.0-beta1"
         }
       },
       "results": []
@@ -257,7 +257,7 @@ Loaded Alpine local db from <tempdir>/osv-scanner/Alpine/all.zip
               }
             }
           ],
-          "version": "1.9.1"
+          "version": "2.0.0-beta1"
         }
       },
       "artifacts": [
@@ -1067,7 +1067,7 @@ No issues found
 ---
 
 [TestRun/version - 1]
-osv-scanner version: 1.9.1
+osv-scanner version: 2.0.0-beta1
 commit: n/a
 built at: n/a
 
@@ -1274,7 +1274,7 @@ Scanned <rootdir>/fixtures/locks-insecure/osv-scanner-flutter-deps.json file as
               }
             }
           ],
-          "version": "1.9.1"
+          "version": "2.0.0-beta1"
         }
       },
       "artifacts": [