Allow configuration of the library's logging

[spencerschrock]

The OpenSSF Scorecard project uses osv-scanner as a library, specifically osvscanner.DoScan. I experimented briefly with the migration to v2 recently and started getting a flood of logs to our stderr which are originating from osv-scanner.

2025/07/16 11:03:49 INFO Scanning dir <...>
2025/07/16 11:04:15 ERROR Error during extraction: (extracting as java/pomxmlnet) failed resolving
2025/07/16 11:04:39 INFO Scanned <...>/package-lock.json file and found 1568 packages

Is there anyway to introduce a control to disable cmdlogger's output? It seems most of the codebase uses cmdlogger.Info (and friends), which write to the default (global) slog handler.

osv-scanner/internal/cmdlogger/fmt.go

Lines 8 to 22 in 6515dc0

	func Debugf(msg string, args ...any) {
	slog.Debug(fmt.Sprintf(msg, args...))
	}
	func Infof(msg string, args ...any) {
	slog.Info(fmt.Sprintf(msg, args...))
	}
	func Warnf(msg string, args ...any) {
	slog.Warn(fmt.Sprintf(msg, args...))
	}
	func Errorf(msg string, args ...any) {
	slog.Error(fmt.Sprintf(msg, args...))
	}

I can set the slog default to something which would ignore it, like slog.DiscardHandler, but this would break many of our own logging.

[spencerschrock]

Maybe instead of using the global default and setting it with slog.SetDefault in your various binaries, you can have a package level variable such as cmdlogger.Default, and then the various helpers can call cmdlogger.Default.Info etc instead of slog.Info?

Since this is an internal package, we would still have problems setting/clearing cmdlogger.Default

[another-rex]

A perhaps hacky fix:

origHandler :=  slog.GetDefault() // Or something similar
slog.SetDefault(slog.DiscardHandler)
osvscanner.Run(...)
slog.SetDefault(origHandler)

This would only reliably work if scorecard is running osv-scanner non concurrently.

[another-rex]

Maybe instead of using the global default and setting it with slog.SetDefault in your various binaries, you can have a package level variable such as cmdlogger.Default, and then the various helpers can call cmdlogger.Default.Info etc instead of slog.Info?

Since this is an internal package, we would still have problems setting/clearing cmdlogger.Default

We can definitely look into that, I think we can just make a public function in osvscanner that sets the default used in cmdlogger to fix that issue.

[spencerschrock]

A perhaps hacky fix:

origHandler := slog.GetDefault() // Or something similar
slog.SetDefault(slog.DiscardHandler)
osvscanner.Run(...)
slog.SetDefault(origHandler)
This would only reliably work if scorecard is running osv-scanner non concurrently.

All of the checks run in a separate goroutine, so there is concurrency to worry about.

[spencerschrock]

This is still an issue on v2.3.3, I'll send a patch