Migration guide uses an unsupported osv-scanner SPDX format name

[haimingZZ]

Problem

The migration guide currently uses an SPDX format name that the osv-scanner CLI rejects:

• docs/migrating-from-scalibr.md:83 uses --format spdx-2.3-json.
• docs/migrating-from-scalibr.md:95 maps spdx23-json to --format spdx-2.3-json.
• internal/reporter/format.go:10 lists the supported format as spdx-2-3.

The example therefore fails with unsupported output format "spdx-2.3-json". The output documentation already shows the working command shape: osv-scanner scan --format spdx-2-3 ....

Expected behavior

The migration guide should use the current supported format name and command shape, including the documented scan and --output-file flags where appropriate.

Would a maintainer be willing to assign this documentation fix? I can prepare a small, focused PR after assignment.

[haimingZZ]

Confirmed on current main:

• docs/migrating-from-scalibr.md uses spdx-2.3-json in the migration example and mapping table.
• The current CLI accepts spdx-2-3 (as also shown in docs/output.md); the former spelling is rejected as an unsupported format.
• Proposed scope is limited to correcting the migration-guide examples and using the current scan --format ... --output-file command shape. No production behavior change is proposed.

I can prepare the focused documentation fix and run the repository-required lint/test checks once a maintainer assigns this issue. Please assign it if this scope is appropriate.

[Ly-Joey]

Hi @haimingZZ, thanks for your patience.
I have assigned the issue to you, feel free to raise a PR to update the documentation!
In addition, could you please also update the --output flag in the same doc? It is deprecated in favour of --output-file.