Skip to content

build(deps): Bump github.com/google/osv-scanner/v2 from 2.6.0 to 2.7.0 - #132

Merged
miniprow[bot] merged 1 commit into
mainfrom
dependabot/go_modules/github.com/google/osv-scanner/v2-2.7.0
Oct 26, 2026
Merged

build(deps): Bump github.com/google/osv-scanner/v2 from 2.6.0 to 2.7.0#132
miniprow[bot] merged 1 commit into
mainfrom
dependabot/go_modules/github.com/google/osv-scanner/v2-2.7.0

Conversation

@dependabot

@dependabot dependabot Bot commented on behalf of github Oct 26, 2026

Copy link
Copy Markdown
Contributor

Bumps github.com/google/osv-scanner/v2 from 2.6.0 to 2.7.0.

Release notes

Sourced from github.com/google/osv-scanner/v2's releases.

v2.7.0

Features:

  • [Feature #2885](google/osv-scanner#2885) Include package URLs (purl) in JSON output when available.
  • [Feature #2589](google/osv-scanner#2589) Add shorter --x- flag aliases and deprecate --experimental- flags.
  • [Feature #3113](google/osv-scanner#3113) Include vulnerability severity and rating in CycloneDX output when available.
  • [Feature #3102](google/osv-scanner#3102) Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
  • Dependency scanning & lockfile improvements via osv-scalibr:
    • Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
    • Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
    • Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
    • Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
  • New extractors and plugin support via osv-scalibr:

Fixes:

  • [Bug #3137](google/osv-scanner#3137) Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
  • [Bug #3135](google/osv-scanner#3135) Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
  • [Bug #3134](google/osv-scanner#3134) Preserve call analysis information when diffing vulnerability results.
  • [Bug #3121](google/osv-scanner#3121) Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).
  • [Bug #3103](google/osv-scanner#3103) Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
  • [Bug #3087](google/osv-scanner#3087) Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).
  • Fixes via osv-scalibr:
    • Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
    • Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
    • Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
    • Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
    • Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
    • Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
    • Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
    • Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
    • Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
    • Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
    • Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc:

  • Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).
  • Remove unused root Dockerfile (#3130).

New Contributors

Full Changelog: google/osv-scanner@v2.6.0...v2.7.0

Changelog

Sourced from github.com/google/osv-scanner/v2's changelog.

v2.7.0

Features:

  • [Feature #2885](google/osv-scanner#2885) Include package URLs (purl) in JSON output when available.
  • [Feature #2589](google/osv-scanner#2589) Add shorter --x- flag aliases and deprecate --experimental- flags.
  • [Feature #3113](google/osv-scanner#3113) Include vulnerability severity and rating in CycloneDX output when available.
  • [Feature #3102](google/osv-scanner#3102) Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
  • Dependency scanning & lockfile improvements via osv-scalibr:
    • Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
    • Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
    • Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
    • Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
  • New extractors and plugin support via osv-scalibr:

Fixes:

  • [Bug #3137](google/osv-scanner#3137) Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
  • [Bug #3135](google/osv-scanner#3135) Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
  • [Bug #3134](google/osv-scanner#3134) Preserve call analysis information when diffing vulnerability results.
  • [Bug #3121](google/osv-scanner#3121) Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).
  • [Bug #3103](google/osv-scanner#3103) Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
  • [Bug #3087](google/osv-scanner#3087) Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).
  • Fixes via osv-scalibr:
    • Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
    • Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
    • Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
    • Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
    • Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
    • Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
    • Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
    • Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
    • Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
    • Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
    • Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc:

  • Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).
  • Remove unused root Dockerfile (#3130).
Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
build(deps): Bump github.com/google/osv-scanner/v2 from 2.6.0 to 2.7.0
20b330a 
Bumps [github.com/google/osv-scanner/v2](https://github.com/google/osv-scanner) from 2.6.0 to 2.7.0.
- [Release notes](https://github.com/google/osv-scanner/releases)
- [Changelog](https://github.com/google/osv-scanner/blob/main/CHANGELOG.md)
- [Commits](google/osv-scanner@v2.6.0...v2.7.0)

---
updated-dependencies:
- dependency-name: github.com/google/osv-scanner/v2
  dependency-version: 2.7.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update go code labels Oct 26, 2026
@miniprow

miniprow Bot commented Oct 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dependabot[bot], puerco

The full list of commands accepted by this bot can be found here.

Details Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@miniprow miniprow Bot added approved Indicates a PR has been approved by an approver from all required OWNERS files lgtm Indicates that a PR is ready to be merged (Looks Good To Me) labels Oct 26, 2026
@miniprow
miniprow Bot merged commit c5f636e into main Oct 26, 2026
6 checks passed
@dependabot
dependabot Bot deleted the dependabot/go_modules/github.com/google/osv-scanner/v2-2.7.0 branch October 26, 2026 21:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@puerco puerco puerco approved these changes

Assignees

No one assigned

Labels

approved Indicates a PR has been approved by an approver from all required OWNERS files dependencies Pull requests that update a dependency file go Pull requests that update go code lgtm Indicates that a PR is ready to be merged (Looks Good To Me)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@puerco