2.5.0 breaks offline database caching

[panpomaly]

Since version 2.5.0 osv-scanner does not honour OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY anymore.

Files end up in ~/.cache/osv-scalibr/ (Linux) or ~/Library/Caches/osv-scalibr (macOS).

Additionally, --offline-vulnerabilities seems to do nothing if not explicitly called with --download-offline-databases.
--offline does work as expected, although it uses the "wrong" cache directory.

Checked against 2.4.0, where everything worked as expected.

Reproduce:

$ osv-scanner --version
osv-scanner version: 2.5.0
osv-scalibr version: 0.4.5
commit: a258868211a57052da6bd323f758b8388dee02bb
built at: 2026-08-07T03:49:44Z
$ export OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY=~/.cache/empty-folder
$ mkdir ~/.cache/empty-folder
$ ls -l ~/.cache/empty-folder/
total 0
$ ls ~/.cache/osv-scalibr/
ls: cannot access '/home/vscode/.cache/osv-scalibr/': No such file or directory
$ osv-scanner --offline-vulnerabilities . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 14.508121ms elapsed, 14.508871ms wall time

No issues found
$ osv-scanner --offline . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 14.939154ms elapsed, 14.940279ms wall time
could not load db for npm ecosystem: unable to fetch OSV database: no offline version of the OSV database is available
Error during extraction: (extracting as vulnmatch/osvlocal) unable to fetch OSV database: no offline version of the OSV database is available

Total 0 packages affected by 0 known vulnerabilities (0 Critical, 0 High, 0 Medium, 0 Low, 0 Unknown) from 0 ecosystems.
0 vulnerabilities can be fixed.

$ osv-scanner --offline --download-offline-databases . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 13.920393ms elapsed, 13.920684ms wall time
Loaded npm local db from /home/vscode/.cache/osv-scalibr/npm/all.zip
Loaded PyPI local db from /home/vscode/.cache/osv-scalibr/PyPI/all.zip

Total 1 package affected by 3 known vulnerabilities (0 Critical, 0 High, 3 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
3 vulnerabilities can be fixed.
$ ls ~/.cache/osv-scalibr/
npm  PyPI
$ ls -l ~/.cache/empty-folder/
total 0

Running --offline-vulnerabilities still outputs no findings or error even though the "wrong" DB folder ~/.cache/osv-scalibr is populated.

$ osv-scanner --offline-vulnerabilities . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 13.347554ms elapsed, 13.347846ms wall time

No issues found
$ osv-scanner --offline . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 13.333888ms elapsed, 13.334263ms wall time
Loaded npm local db from /home/vscode/.cache/osv-scalibr/npm/all.zip
Loaded PyPI local db from /home/vscode/.cache/osv-scalibr/PyPI/all.zip

Total 1 package affected by 3 known vulnerabilities (0 Critical, 0 High, 3 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
3 vulnerabilities can be fixed.

Funny enough, it works when explicitly combined with --download-offline-databases

$ osv-scanner --offline-vulnerabilities --download-offline-databases . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 12.366044ms elapsed, 12.366794ms wall time
Loaded PyPI local db from /home/vscode/.cache/osv-scalibr/PyPI/all.zip
Loaded npm local db from /home/vscode/.cache/osv-scalibr/npm/all.zip

Total 2 packages affected by 4 known vulnerabilities (0 Critical, 0 High, 4 Medium, 0 Low, 0 Unknown) from 1 ecosystem.
4 vulnerabilities can be fixed.

....
$ osv-scanner --offline-vulnerabilities . -r
Scanning dir .
Starting filesystem walk for root: /
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/requirements.txt file and found 1 package
Scanned /workspaces/osv-malscan/tests/fixtures/db-seed/package-lock.json file and found 1 package
End status: 129 dirs visited, 300 inodes visited, 2 Extract calls, 16.748865ms elapsed, 16.750032ms wall time

No issues found