fix: change module name to v2 (#1546)

Go requires major version 2 of a package to be under a `/v2` module.

Per https://go.dev/doc/modules/major-version, must change the go.mod
file and all references to `github.com/google/osv-scanner` to
`github.com/google/osv-scanner/v2` for our v2 release.

.golangci.yaml

@@ -37,10 +37,10 @@ linters-settings:
     settings:
       printf:
         funcs:
-          - (github.com/google/osv-scanner/pkg/reporter.Reporter).Errorf
-          - (github.com/google/osv-scanner/pkg/reporter.Reporter).Warnf
-          - (github.com/google/osv-scanner/pkg/reporter.Reporter).Verbosef
-          - (github.com/google/osv-scanner/pkg/reporter.Reporter).Infof
+          - (github.com/google/osv-scanner/v2/pkg/reporter.Reporter).Errorf
+          - (github.com/google/osv-scanner/v2/pkg/reporter.Reporter).Warnf
+          - (github.com/google/osv-scanner/v2/pkg/reporter.Reporter).Verbosef
+          - (github.com/google/osv-scanner/v2/pkg/reporter.Reporter).Infof
   depguard:
     rules:
       regexp:
@@ -49,7 +49,7 @@ linters-settings:
           - "!**/main_test.go"
         deny:
           - pkg: "regexp"
-            desc: "Use github.com/google/osv-scanner/internal/cachedregexp instead"
+            desc: "Use github.com/google/osv-scanner/v2/internal/cachedregexp instead"
   gocritic:
     disabled-checks:
       - ifElseChain

.goreleaser.yml

@@ -18,7 +18,7 @@ builds:
       - -trimpath
     ldflags:
       # prettier-ignore
-      - '-s -w -X github.com/google/osv-scanner/internal/version.OSVVersion={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}}'
+      - '-s -w -X github.com/google/osv-scanner/v2/internal/version.OSVVersion={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}}'
     goos:
       # Further testing before supporting freebsd
       # - freebsd
@@ -46,7 +46,7 @@ builds:
       - -trimpath
     ldflags:
       # prettier-ignore
-      - '-s -w -X github.com/google/osv-scanner/internal/version.OSVVersion={{.Version}}_GHAction -X main.commit={{.Commit}} -X main.date={{.CommitDate}}'
+      - '-s -w -X github.com/google/osv-scanner/v2/internal/version.OSVVersion={{.Version}}_GHAction -X main.commit={{.Commit}} -X main.date={{.CommitDate}}'
     goos:
       - linux
     goarch:
@@ -62,7 +62,7 @@ builds:
       - -trimpath
     ldflags:
       # prettier-ignore
-      - '-s -w -X github.com/google/osv-scanner/internal/version.OSVVersion={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}}'
+      - '-s -w -X github.com/google/osv-scanner/v2/internal/version.OSVVersion={{.Version}} -X main.commit={{.Commit}} -X main.date={{.CommitDate}}'
     goos:
       - linux
     goarch:

README.md

@@ -38,7 +38,7 @@ The above all results in accurate and actionable vulnerability notifications, wh
 ## Basic installation
 
 To install OSV-Scanner, please refer to the [installation section](https://google.github.io/osv-scanner/installation) of our documentation. OSV-Scanner releases can be found on the [releases page](https://github.com/google/osv-scanner/releases) of the GitHub repository. The recommended method is to download a prebuilt binary for your platform. Alternatively, you can use  
-`go install github.com/google/osv-scanner/cmd/[email protected]`.
+`go install github.com/google/osv-scanner/v2/cmd/[email protected]`.
 
 ## Key Features
 

cmd/osv-reporter/main.go

@@ -7,11 +7,11 @@ import (
 	"os"
 	"strings"
 
-	"github.com/google/osv-scanner/internal/ci"
-	"github.com/google/osv-scanner/internal/version"
-	"github.com/google/osv-scanner/pkg/models"
-	"github.com/google/osv-scanner/pkg/osvscanner"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/internal/ci"
+	"github.com/google/osv-scanner/v2/internal/version"
+	"github.com/google/osv-scanner/v2/pkg/models"
+	"github.com/google/osv-scanner/v2/pkg/osvscanner"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"github.com/urfave/cli/v2"
 	"golang.org/x/term"
 )

cmd/osv-scanner/fix/interactive.go

@@ -5,7 +5,7 @@ import (
 	"errors"
 
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/google/osv-scanner/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/remediation"
 )
 
 // TODO: currently, it's impossible to undo commands

cmd/osv-scanner/fix/main.go

@@ -11,20 +11,20 @@ import (
 	"time"
 
 	"deps.dev/util/resolve"
-	"github.com/google/osv-scanner/internal/clients/clientimpl/localmatcher"
-	"github.com/google/osv-scanner/internal/clients/clientimpl/osvmatcher"
-	"github.com/google/osv-scanner/internal/depsdev"
-	"github.com/google/osv-scanner/internal/imodels/ecosystem"
-	"github.com/google/osv-scanner/internal/osvdev"
-	"github.com/google/osv-scanner/internal/remediation"
-	"github.com/google/osv-scanner/internal/remediation/upgrade"
-	"github.com/google/osv-scanner/internal/resolution"
-	"github.com/google/osv-scanner/internal/resolution/client"
-	"github.com/google/osv-scanner/internal/resolution/lockfile"
-	"github.com/google/osv-scanner/internal/resolution/manifest"
-	"github.com/google/osv-scanner/internal/resolution/util"
-	"github.com/google/osv-scanner/internal/version"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/internal/clients/clientimpl/localmatcher"
+	"github.com/google/osv-scanner/v2/internal/clients/clientimpl/osvmatcher"
+	"github.com/google/osv-scanner/v2/internal/depsdev"
+	"github.com/google/osv-scanner/v2/internal/imodels/ecosystem"
+	"github.com/google/osv-scanner/v2/internal/osvdev"
+	"github.com/google/osv-scanner/v2/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/remediation/upgrade"
+	"github.com/google/osv-scanner/v2/internal/resolution"
+	"github.com/google/osv-scanner/v2/internal/resolution/client"
+	"github.com/google/osv-scanner/v2/internal/resolution/lockfile"
+	"github.com/google/osv-scanner/v2/internal/resolution/manifest"
+	"github.com/google/osv-scanner/v2/internal/resolution/util"
+	"github.com/google/osv-scanner/v2/internal/version"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"github.com/ossf/osv-schema/bindings/go/osvschema"
 	"github.com/urfave/cli/v2"
 	"golang.org/x/term"

cmd/osv-scanner/fix/main_test.go

@@ -4,8 +4,8 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/google/osv-scanner/internal/remediation/upgrade"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/internal/remediation/upgrade"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"github.com/urfave/cli/v2"
 )
 

cmd/osv-scanner/fix/model.go

@@ -11,12 +11,12 @@ import (
 	"github.com/charmbracelet/bubbles/key"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/google/osv-scanner/internal/remediation"
-	"github.com/google/osv-scanner/internal/resolution"
-	"github.com/google/osv-scanner/internal/resolution/client"
-	manif "github.com/google/osv-scanner/internal/resolution/manifest"
-	"github.com/google/osv-scanner/internal/tui"
-	osvLockfile "github.com/google/osv-scanner/pkg/lockfile"
+	"github.com/google/osv-scanner/v2/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/resolution"
+	"github.com/google/osv-scanner/v2/internal/resolution/client"
+	manif "github.com/google/osv-scanner/v2/internal/resolution/manifest"
+	"github.com/google/osv-scanner/v2/internal/tui"
+	osvLockfile "github.com/google/osv-scanner/v2/pkg/lockfile"
 	"golang.org/x/term"
 )
 

cmd/osv-scanner/fix/noninteractive.go

@@ -9,14 +9,14 @@ import (
 
 	"deps.dev/util/resolve"
 	"deps.dev/util/resolve/dep"
-	"github.com/google/osv-scanner/internal/datasource"
-	"github.com/google/osv-scanner/internal/remediation"
-	"github.com/google/osv-scanner/internal/resolution"
-	"github.com/google/osv-scanner/internal/resolution/client"
-	lf "github.com/google/osv-scanner/internal/resolution/lockfile"
-	"github.com/google/osv-scanner/internal/resolution/manifest"
-	"github.com/google/osv-scanner/internal/resolution/util"
-	"github.com/google/osv-scanner/pkg/lockfile"
+	"github.com/google/osv-scanner/v2/internal/datasource"
+	"github.com/google/osv-scanner/v2/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/resolution"
+	"github.com/google/osv-scanner/v2/internal/resolution/client"
+	lf "github.com/google/osv-scanner/v2/internal/resolution/lockfile"
+	"github.com/google/osv-scanner/v2/internal/resolution/manifest"
+	"github.com/google/osv-scanner/v2/internal/resolution/util"
+	"github.com/google/osv-scanner/v2/pkg/lockfile"
 	"golang.org/x/exp/maps"
 )
 

cmd/osv-scanner/fix/output.go

@@ -7,7 +7,7 @@ import (
 	"slices"
 	"strings"
 
-	"github.com/google/osv-scanner/pkg/models"
+	"github.com/google/osv-scanner/v2/pkg/models"
 )
 
 // fixOutput is a description of changes made by guided remediation to a manifest/lockfile.

cmd/osv-scanner/fix/state-choose-in-place-patches.go

@@ -8,7 +8,7 @@ import (
 	"github.com/charmbracelet/bubbles/table"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/google/osv-scanner/internal/tui"
+	"github.com/google/osv-scanner/v2/internal/tui"
 )
 
 type stateChooseInPlacePatches struct {

cmd/osv-scanner/fix/state-choose-strategy.go

@@ -8,9 +8,9 @@ import (
 	"github.com/charmbracelet/bubbles/key"
 	"github.com/charmbracelet/bubbles/textinput"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/google/osv-scanner/internal/remediation"
-	"github.com/google/osv-scanner/internal/resolution"
-	"github.com/google/osv-scanner/internal/tui"
+	"github.com/google/osv-scanner/v2/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/resolution"
+	"github.com/google/osv-scanner/v2/internal/tui"
 	"golang.org/x/exp/slices"
 )
 

cmd/osv-scanner/fix/state-in-place-result.go

@@ -6,10 +6,10 @@ import (
 
 	"github.com/charmbracelet/bubbles/key"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/google/osv-scanner/internal/remediation"
-	"github.com/google/osv-scanner/internal/resolution"
-	lockf "github.com/google/osv-scanner/internal/resolution/lockfile"
-	"github.com/google/osv-scanner/internal/tui"
+	"github.com/google/osv-scanner/v2/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/resolution"
+	lockf "github.com/google/osv-scanner/v2/internal/resolution/lockfile"
+	"github.com/google/osv-scanner/v2/internal/tui"
 	"golang.org/x/exp/slices"
 )
 

cmd/osv-scanner/fix/state-initialize.go

@@ -6,7 +6,7 @@ import (
 
 	"github.com/charmbracelet/bubbles/spinner"
 	tea "github.com/charmbracelet/bubbletea"
-	"github.com/google/osv-scanner/internal/tui"
+	"github.com/google/osv-scanner/v2/internal/tui"
 )
 
 type stateInitialize struct {

cmd/osv-scanner/fix/state-relock-result.go

@@ -9,11 +9,11 @@ import (
 	"github.com/charmbracelet/bubbles/spinner"
 	tea "github.com/charmbracelet/bubbletea"
 	"github.com/charmbracelet/lipgloss"
-	"github.com/google/osv-scanner/internal/remediation"
-	"github.com/google/osv-scanner/internal/resolution"
-	"github.com/google/osv-scanner/internal/resolution/client"
-	manif "github.com/google/osv-scanner/internal/resolution/manifest"
-	"github.com/google/osv-scanner/internal/tui"
+	"github.com/google/osv-scanner/v2/internal/remediation"
+	"github.com/google/osv-scanner/v2/internal/resolution"
+	"github.com/google/osv-scanner/v2/internal/resolution/client"
+	manif "github.com/google/osv-scanner/v2/internal/resolution/manifest"
+	"github.com/google/osv-scanner/v2/internal/tui"
 	"golang.org/x/exp/maps"
 )
 

cmd/osv-scanner/fix_test.go

@@ -6,7 +6,7 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/google/osv-scanner/internal/testutility"
+	"github.com/google/osv-scanner/v2/internal/testutility"
 )
 
 func copyFileTo(t *testing.T, file, dir string) string {

cmd/osv-scanner/internal/helper/helper.go

@@ -9,7 +9,7 @@ import (
 	"strings"
 	"time"
 
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"github.com/urfave/cli/v2"
 )
 

cmd/osv-scanner/main.go

@@ -6,12 +6,12 @@ import (
 	"os"
 	"slices"
 
-	"github.com/google/osv-scanner/cmd/osv-scanner/fix"
-	"github.com/google/osv-scanner/cmd/osv-scanner/scan"
-	"github.com/google/osv-scanner/cmd/osv-scanner/update"
-	"github.com/google/osv-scanner/internal/version"
-	"github.com/google/osv-scanner/pkg/osvscanner"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/fix"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/scan"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/update"
+	"github.com/google/osv-scanner/v2/internal/version"
+	"github.com/google/osv-scanner/v2/pkg/osvscanner"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 
 	"github.com/urfave/cli/v2"
 )

cmd/osv-scanner/main_test.go

@@ -12,8 +12,8 @@ import (
 	"strings"
 	"testing"
 
-	"github.com/google/osv-scanner/internal/cachedregexp"
-	"github.com/google/osv-scanner/internal/testutility"
+	"github.com/google/osv-scanner/v2/internal/cachedregexp"
+	"github.com/google/osv-scanner/v2/internal/testutility"
 	"github.com/urfave/cli/v2"
 )
 

cmd/osv-scanner/scan/image/main.go

@@ -7,10 +7,10 @@ import (
 	"os"
 	"path/filepath"
 
-	"github.com/google/osv-scanner/cmd/osv-scanner/internal/helper"
-	"github.com/google/osv-scanner/pkg/models"
-	"github.com/google/osv-scanner/pkg/osvscanner"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/internal/helper"
+	"github.com/google/osv-scanner/v2/pkg/models"
+	"github.com/google/osv-scanner/v2/pkg/osvscanner"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"golang.org/x/term"
 
 	"github.com/urfave/cli/v2"

cmd/osv-scanner/scan/main.go

@@ -3,9 +3,9 @@ package scan
 import (
 	"io"
 
-	"github.com/google/osv-scanner/cmd/osv-scanner/scan/image"
-	"github.com/google/osv-scanner/cmd/osv-scanner/scan/source"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/scan/image"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/scan/source"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 
 	"github.com/urfave/cli/v2"
 )

cmd/osv-scanner/scan/source/main.go

@@ -8,11 +8,11 @@ import (
 	"path/filepath"
 	"strings"
 
-	"github.com/google/osv-scanner/cmd/osv-scanner/internal/helper"
-	"github.com/google/osv-scanner/internal/spdx"
-	"github.com/google/osv-scanner/pkg/models"
-	"github.com/google/osv-scanner/pkg/osvscanner"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/cmd/osv-scanner/internal/helper"
+	"github.com/google/osv-scanner/v2/internal/spdx"
+	"github.com/google/osv-scanner/v2/pkg/models"
+	"github.com/google/osv-scanner/v2/pkg/osvscanner"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"github.com/urfave/cli/v2"
 	"golang.org/x/term"
 )

cmd/osv-scanner/testmain_test.go

@@ -5,7 +5,7 @@ import (
 	"testing"
 
 	"github.com/go-git/go-git/v5"
-	"github.com/google/osv-scanner/internal/testutility"
+	"github.com/google/osv-scanner/v2/internal/testutility"
 )
 
 func TestMain(m *testing.M) {

cmd/osv-scanner/update/main.go

@@ -6,13 +6,13 @@ import (
 	"io"
 	"os"
 
-	"github.com/google/osv-scanner/internal/depsdev"
-	"github.com/google/osv-scanner/internal/remediation/suggest"
-	"github.com/google/osv-scanner/internal/resolution/client"
-	"github.com/google/osv-scanner/internal/resolution/manifest"
-	"github.com/google/osv-scanner/internal/version"
-	"github.com/google/osv-scanner/pkg/lockfile"
-	"github.com/google/osv-scanner/pkg/reporter"
+	"github.com/google/osv-scanner/v2/internal/depsdev"
+	"github.com/google/osv-scanner/v2/internal/remediation/suggest"
+	"github.com/google/osv-scanner/v2/internal/resolution/client"
+	"github.com/google/osv-scanner/v2/internal/resolution/manifest"
+	"github.com/google/osv-scanner/v2/internal/version"
+	"github.com/google/osv-scanner/v2/pkg/lockfile"
+	"github.com/google/osv-scanner/v2/pkg/reporter"
 	"github.com/urfave/cli/v2"
 )
 

cmd/osv-scanner/update_test.go

@@ -5,7 +5,7 @@ import (
 	"slices"
 	"testing"
 
-	"github.com/google/osv-scanner/internal/testutility"
+	"github.com/google/osv-scanner/v2/internal/testutility"
 )
 
 func TestRun_Update(t *testing.T) {

docs/installation.md

@@ -74,7 +74,7 @@ pkg_add osv-scanner
 Alternatively, you can install this from source by running:
 
 ```bash
-go install github.com/google/osv-scanner/cmd/osv-scanner@v1
+go install github.com/google/osv-scanner/v2/cmd/osv-scanner@v2.0.0-beta1
 ```
 
 This requires Go 1.23.5+ to be installed.

go.mod

@@ -1,4 +1,4 @@
-module github.com/google/osv-scanner
+module github.com/google/osv-scanner/v2
 
 go 1.23.5