chore(deps): update google/osv-scanner-action action to v2.3.3 #15

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

Bug #2415 Add more PURL-to-ecosystem mappings
Bug #2422 MCP error for get_vulnerability_id because type definition is incorrect.
Bug #2460 Enable osv-scanner.json git queries
Bug #2456 Properly track if an ignore entry has been used
Bug #2450 Performance: Avoid loading the entire advisory unless it will actually be used
Bug #2445 Performance: Don't read the entire zip into memory
Bug #2433 Allow specifying user agent in v2 osvscanner package

Misc:

Misc #2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
Misc #2447 Include bun.lock as a supported lockfile
Misc #2444 Document GoVersionOverride in configuration.md

Full Changelog: https://github.com/google/osv-scanner/compare/v2.3.1...v2.3.2

`v2.3.1`

Compare Source

What's Changed

chore(deps): update workflows (major) by @renovate-bot in #105
chore(deps): update github/codeql-action action to v4.31.7 by @renovate-bot in #108
chore: more specific name for uploaded artifact by @marcusburghardt in #111
Update to v2.3.1 by @cuixq in #112

New Contributors

@marcusburghardt made their first contribution in #111

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.3.0...v2.3.1

`v2.3.0`

Compare Source

What's Changed

chore(deps): update workflows by @renovate-bot in #104
Add gemini config.yaml file by @michaelkedar in #107
Update to v2.3.0 by @michaelkedar in #106

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.2.4...v2.3.0

`v2.2.4`

Compare Source

What's Changed

chore(deps): update github/codeql-action action to v4 by @renovate-bot in #102
Update to v2.2.4 by @another-rex in #103

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.2.3...v2.2.4

`v2.2.3`

Compare Source

What's Changed

chore(deps): update workflows by @renovate-bot in #86
chore(deps): update workflows to v5 (major) by @renovate-bot in #87
Update to v2.2.3 by @jess-lowe in #101

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.2.2...v2.2.3

`v2.2.2`

Compare Source

This updates OSV-Scanner to v2.2.2.

What's Changed

docs: Update Automatic install instructions by @another-rex in #94
Update to v2.2.2 by @cuixq in #95

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.2.1...v2.2.2

`v2.2.1`

Compare Source

What's Changed

OSV-Scanner now supports all OSV-Scalibr features behind experimental flags (--experimental-plugins, see details here)!

Features:

Feature #2146 Allow manual OSV-Scalibr plugin selection.
Feature #2144 Add OSV-Scalibr version to osv-scanner --version output.
Feature #2021 Add experimental support for running OSV-Scalibr detectors.
Feature #2079 Fall back to offline extractor if the transitive one fails, so at least direct dependencies are returned.
Feature #2032 Add summary section at the top of outputs and a 'Fixed Version' column.
Feature #2076 Support Ubuntu severity type.

Fixes:

Bug #2141 Fix OSV-Scanner json scans not matching with correct ecosystem.
Bug #2084 Show absolute paths when scanning containers.
Bug #2126 Log and preserve package count before continuing on db error.
Bug #2095 Pass through plugin capabilities correctly.
Bug #2051 Properly flag if running on Linux or Mac OSs for plugin compatibility.
Bug #2072 Add missing "text" property in description fields.
Bug #2068 Change links in output to go to the specific vulnerability page instead of the list page.
Bug #2064 Fix SARIF v3 output to include results.
Bug #2151 Filter by ecosystem before querying.

API Changes:

API Change #2096 Allow log handler to be overridden.

[!WARNING]
This release was originally incorrectly pointing to the bugged v2.2.0 osv-scanner release, it has now been retagged to the correct v2.2.1 release.

`v2.1.0`

Compare Source

What's Changed

chore(deps): update github/codeql-action action to v3.29.0 by @renovate-bot in #76
Update to v2.1.0 by @michaelkedar in #81

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.0.3...v2.1.0

`v2.0.3`

Compare Source

Update to use osv-scanner v2.0.3

Notable changes:

There's now a flag --allow-no-lockfiles you can pass to osv-scanner to avoid getting an error when running against a repo with no lockfiles.
We no longer ignore general errors when they occur on osv-scanner-action, and will fail the workflow (e.g. invalid flags passed in)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [google/osv-scanner-action](https://redirect.github.com/google/osv-scanner-action) | action | minor | `v2.0.2` → `v2.3.3` | --- ### Release Notes <details> <summary>google/osv-scanner-action (google/osv-scanner-action)</summary> ### [`v2.3.3`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.3.3) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3) This updates OSV-Scanner to v2.3.3. ##### What's Changed - chore(deps): update github/codeql-action action to v4.31.10 by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#115](https://redirect.github.com/google/osv-scanner-action/pull/115) - Update to v2.3.3 by [@Ly-Joey](https://redirect.github.com/Ly-Joey) in [#118](https://redirect.github.com/google/osv-scanner-action/pull/118) ##### New Contributors - [@Ly-Joey](https://redirect.github.com/Ly-Joey) made their first contribution in [#118](https://redirect.github.com/google/osv-scanner-action/pull/118) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.3.2...v2.3.3> ### [`v2.3.2`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.3.2) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.3.1...v2.3.2) This updates OSV-Scanner to v2.3.2 This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get\_vulnerability\_details tool, git queries in `osv-scanner.json`, and ignore entry tracking, along with documentation updates. ##### Fixes: - [Bug #2415](https://redirect.github.com/google/osv-scanner/pull/2415) Add more PURL-to-ecosystem mappings - [Bug #2422](https://redirect.github.com/google/osv-scanner/pull/2422) MCP error for get\_vulnerability\_id because type definition is incorrect. - [Bug #2460](https://redirect.github.com/google/osv-scanner/pull/2460) Enable osv-scanner.json git queries - [Bug #2456](https://redirect.github.com/google/osv-scanner/pull/2456) Properly track if an ignore entry has been used - [Bug #2450](https://redirect.github.com/google/osv-scanner/pull/2450) **Performance:** Avoid loading the entire advisory unless it will actually be used - [Bug #2445](https://redirect.github.com/google/osv-scanner/pull/2445) **Performance:** Don't read the entire zip into memory - [Bug #2433](https://redirect.github.com/google/osv-scanner/pull/2433) Allow specifying user agent in v2 osvscanner package ##### Misc: - [Misc #2453](https://redirect.github.com/google/osv-scanner/pull/2453) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 - [Misc #2447](https://redirect.github.com/google/osv-scanner/pull/2447) Include `bun.lock` as a supported lockfile - [Misc #2444](https://redirect.github.com/google/osv-scanner/pull/2444) Document GoVersionOverride in configuration.md **Full Changelog**: <https://github.com/google/osv-scanner/compare/v2.3.1...v2.3.2> ### [`v2.3.1`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.3.1) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.3.0...v2.3.1) ##### What's Changed - chore(deps): update workflows (major) by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#105](https://redirect.github.com/google/osv-scanner-action/pull/105) - chore(deps): update github/codeql-action action to v4.31.7 by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#108](https://redirect.github.com/google/osv-scanner-action/pull/108) - chore: more specific name for uploaded artifact by [@marcusburghardt](https://redirect.github.com/marcusburghardt) in [#111](https://redirect.github.com/google/osv-scanner-action/pull/111) - Update to v2.3.1 by [@cuixq](https://redirect.github.com/cuixq) in [#112](https://redirect.github.com/google/osv-scanner-action/pull/112) ##### New Contributors - [@marcusburghardt](https://redirect.github.com/marcusburghardt) made their first contribution in [#111](https://redirect.github.com/google/osv-scanner-action/pull/111) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.3.0...v2.3.1> ### [`v2.3.0`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.3.0) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.2.4...v2.3.0) ##### What's Changed - chore(deps): update workflows by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#104](https://redirect.github.com/google/osv-scanner-action/pull/104) - Add gemini config.yaml file by [@michaelkedar](https://redirect.github.com/michaelkedar) in [#107](https://redirect.github.com/google/osv-scanner-action/pull/107) - Update to v2.3.0 by [@michaelkedar](https://redirect.github.com/michaelkedar) in [#106](https://redirect.github.com/google/osv-scanner-action/pull/106) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.2.4...v2.3.0> ### [`v2.2.4`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.2.4) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.2.3...v2.2.4) ##### What's Changed - chore(deps): update github/codeql-action action to v4 by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#102](https://redirect.github.com/google/osv-scanner-action/pull/102) - Update to v2.2.4 by [@another-rex](https://redirect.github.com/another-rex) in [#103](https://redirect.github.com/google/osv-scanner-action/pull/103) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.2.3...v2.2.4> ### [`v2.2.3`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.2.3) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.2.2...v2.2.3) ##### What's Changed - chore(deps): update workflows by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#86](https://redirect.github.com/google/osv-scanner-action/pull/86) - chore(deps): update workflows to v5 (major) by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#87](https://redirect.github.com/google/osv-scanner-action/pull/87) - Update to v2.2.3 by [@jess-lowe](https://redirect.github.com/jess-lowe) in [#101](https://redirect.github.com/google/osv-scanner-action/pull/101) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.2.2...v2.2.3> ### [`v2.2.2`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.2.2) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.2.1...v2.2.2) This updates OSV-Scanner to v2.2.2. ##### What's Changed - docs: Update Automatic install instructions by [@another-rex](https://redirect.github.com/another-rex) in [#94](https://redirect.github.com/google/osv-scanner-action/pull/94) - Update to v2.2.2 by [@cuixq](https://redirect.github.com/cuixq) in [#95](https://redirect.github.com/google/osv-scanner-action/pull/95) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.2.1...v2.2.2> ### [`v2.2.1`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.2.1) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.1.0...v2.2.1) ##### What's Changed OSV-Scanner now supports all OSV-Scalibr features behind experimental flags (`--experimental-plugins`, see details [here](https://google.github.io/osv-scanner/experimental/manual-plugin-selection/))! ##### Features: - [Feature #2146](https://redirect.github.com/google/osv-scanner/pull/2146) Allow manual OSV-Scalibr plugin selection. - [Feature #2144](https://redirect.github.com/google/osv-scanner/pull/2144) Add OSV-Scalibr version to osv-scanner --version output. - [Feature #2021](https://redirect.github.com/google/osv-scanner/pull/2021) Add experimental support for running OSV-Scalibr detectors. - [Feature #2079](https://redirect.github.com/google/osv-scanner/pull/2079) Fall back to offline extractor if the transitive one fails, so at least direct dependencies are returned. - [Feature #2032](https://redirect.github.com/google/osv-scanner/pull/2032) Add summary section at the top of outputs and a 'Fixed Version' column. - [Feature #2076](https://redirect.github.com/google/osv-scanner/pull/2076) Support Ubuntu severity type. ##### Fixes: - [Bug #2141](https://redirect.github.com/google/osv-scanner/pull/2141) Fix OSV-Scanner json scans not matching with correct ecosystem. - [Bug #2084](https://redirect.github.com/google/osv-scanner/pull/2084) Show absolute paths when scanning containers. - [Bug #2126](https://redirect.github.com/google/osv-scanner/pull/2126) Log and preserve package count before continuing on db error. - [Bug #2095](https://redirect.github.com/google/osv-scanner/pull/2095) Pass through plugin capabilities correctly. - [Bug #2051](https://redirect.github.com/google/osv-scanner/pull/2051) Properly flag if running on Linux or Mac OSs for plugin compatibility. - [Bug #2072](https://redirect.github.com/google/osv-scanner/pull/2072) Add missing "text" property in description fields. - [Bug #2068](https://redirect.github.com/google/osv-scanner/pull/2068) Change links in output to go to the specific vulnerability page instead of the list page. - [Bug #2064](https://redirect.github.com/google/osv-scanner/pull/2064) Fix SARIF v3 output to include results. - [Bug #2151](https://redirect.github.com/google/osv-scanner/issues/2151) Filter by ecosystem before querying. ##### API Changes: - [API Change #2096](https://redirect.github.com/google/osv-scanner/pull/2096) Allow log handler to be overridden. *** > \[!WARNING] > This release was originally incorrectly pointing to the bugged v2.2.0 osv-scanner release, it has now been retagged to the correct v2.2.1 release. ### [`v2.1.0`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.1.0) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.0.3...v2.1.0) ##### What's Changed - chore(deps): update github/codeql-action action to v3.29.0 by [@renovate-bot](https://redirect.github.com/renovate-bot) in [#76](https://redirect.github.com/google/osv-scanner-action/pull/76) - Update to v2.1.0 by [@michaelkedar](https://redirect.github.com/michaelkedar) in [#81](https://redirect.github.com/google/osv-scanner-action/pull/81) **Full Changelog**: <https://github.com/google/osv-scanner-action/compare/v2.0.3...v2.1.0> ### [`v2.0.3`](https://redirect.github.com/google/osv-scanner-action/releases/tag/v2.0.3) [Compare Source](https://redirect.github.com/google/osv-scanner-action/compare/v2.0.2...v2.0.3) Update to use osv-scanner v2.0.3 Notable changes: - There's now a flag `--allow-no-lockfiles` you can pass to osv-scanner to avoid getting an error when running against a repo with no lockfiles. - We no longer ignore general errors when they occur on osv-scanner-action, and will fail the workflow (e.g. invalid flags passed in) </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/Lochnair/sqm-autorate-rust).

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Lochnair-Labs/sqm-autorate-rust#15