chore: update ci toolchain (v2.5.1 → v2.6.0)

Wuast94 commented

2026-09-15 00:49:01 +02:00

Owner

Updates ci toolchain.

Automerge: Enabled

Updates

Dependency	From	To	Type	Locations
`github.com/google/osv-scanner/v2`	`v2.5.1`	`v2.6.0`	minor	[1] L20 [2] L15

Files

[1] .devcontainer/Dockerfile
[2] Justfile

Release notes

github.com/google/osv-scanner/v2 (v2.5.1 → v2.6.0)

`v2.6.0`: v2.6.0

Compare source

Source

Source ref: main

Features:

Feature #2888 Publish multi-arch (linux/arm64) image for osv-scanner-action.
Feature #3066 Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins.
Dependency scanning & lockfile improvements via osv-scalibr:
- Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml, bun.lock).
- Assign pkg:git PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages (#2863).
- Retain packages without a version or PURL in SPDX output (google/osv-scalibr#2375) and merge related packages based on lineage relationships.
New extractors and plugin support via osv-scalibr:
- Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use --experimental-plugins flag. See "Supported Inventory Types" for the extractor name.

Fixes:

Bug #3075 Ensure results property in JSON output is an empty array [] instead of null when scanning with --allow-no-lockfiles and no lockfiles are found.
Bug #3071 Preserve valid UTF-8 sequences when truncating multibyte text in vertical output.
Bug #2919 Add filter to show packages with license violations but no vulnerabilities in the HTML report.
Bug #3049 Keep filter dropdown checklist open when clicking options in the HTML report.
Bug #3023 Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation.
Bug #3032 Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions.
Bug #3061 Remove purl caching in scan filtering to avoid dropping SBOM packages without purls.
Bug #3063 Log plugin and enricher errors during container scans instead of failing silently.
Bug #2977 Return an error instead of aborting the process (log.Fatalf) when an rlib archive has no object file during Rust source analysis.
Bug #3083 Return a descriptive error from DoContainerScan when ScannerActions.Image is empty instead of panicking.
Fixes via osv-scalibr:
- Fix false-positive Go standard library matches for packages with module paths ending in /go (e.g. pkg:golang/github.com/json-iterator/go) (#3017).
- Secure guided remediation file operations with os.Root to prevent path traversal attacks (google/osv-scalibr#2363).
- Prevent OOM and disk exhaustion issues with tar bombs during archive extraction.
- Strip platform suffix from RubyGems versions in CycloneDX (google/osv-scalibr#2313).
- Ignore .deps.json files that don't have an object as their root in dotnet/depsjson extractor (google/osv-scalibr#2423).

Misc:

Update osv-scalibr to v0.5.3-0.20260911142458-3090dbb7aaa2 (#3079).
Update Go to v1.27 and golangci-lint to v2.13 (#3046).
- This now supports call analysis on go v1.27 projects.
Update google.golang.org/grpc to v1.83.2 (#3062).

New Contributors

@summerpan688 made their first contribution in https://github.com/google/osv-scanner/pull/2919
@BenkiNew made their first contribution in https://github.com/google/osv-scanner/pull/3038
@Amey-Thakur made their first contribution in https://github.com/google/osv-scanner/pull/3032
@sl4x0 made their first contribution in https://github.com/google/osv-scanner/pull/3023
@shubhransh-gupta made their first contribution in https://github.com/google/osv-scanner/pull/3049
@kobihikri made their first contribution in https://github.com/google/osv-scanner/pull/2977
@skialpine made their first contribution in https://github.com/google/osv-scanner/pull/2888
@keeltrace made their first contribution in https://github.com/google/osv-scanner/pull/3071
@Muszic made their first contribution in https://github.com/google/osv-scanner/pull/3083
@knQzx made their first contribution in https://github.com/google/osv-scalibr/pull/2313
@micrictor made their first contribution in https://github.com/google/osv-scalibr/pull/2047
@srossross made their first contribution in https://github.com/google/osv-scalibr/pull/2375

Full Changelog: https://github.com/google/osv-scanner/compare/v2.5.1...v2.6.0

Updates `ci toolchain`. Automerge: Enabled ### Updates | Dependency | From | To | Type | Locations | | --- | --- | --- | --- | --- | | <code>github.com/google/osv-scanner/v2</code> | <code>v2.5.1</code> | <code>v2.6.0</code> | minor | [1] L20<br>[2] L15 | ### Files - [1] <code>.devcontainer/Dockerfile</code> - [2] <code>Justfile</code> ### Release notes <details> <summary>github.com/google/osv-scanner/v2 (v2.5.1 → v2.6.0)</summary> ### [`v2.6.0`](https://github.com/google/osv-scanner/releases/tag/v2.6.0): v2.6.0 [Compare source](https://github.com/google/osv-scanner/compare/v2.5.1...v2.6.0) [Source](https://github.com/google/osv-scanner) Source ref: <code>main</code> ### Features: - [Feature #2888](https://github.com/google/osv-scanner/pull/2888) Publish multi-arch (`linux/arm64`) image for `osv-scanner-action`. - [Feature #3066](https://github.com/google/osv-scanner/pull/3066) Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins. - **Dependency scanning & lockfile improvements via `osv-scalibr`**: - Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`). - Assign `pkg:git` PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages ([#2863](https://github.com/google/osv-scanner/pull/2863)). - Retain packages without a version or PURL in SPDX output ([google/osv-scalibr#2375](https://github.com/google/osv-scalibr/pull/2375)) and merge related packages based on lineage relationships. - **New extractors and plugin support via `osv-scalibr`**: - Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use `--experimental-plugins` flag. See ["Supported Inventory Types"](https://github.com/google/osv-scalibr/blob/3f6473abebb329f3e0dc7e9e0d9c91e0c6e51277/docs/supported_inventory_types.md) for the extractor name. ### Fixes: - [Bug #3075](https://github.com/google/osv-scanner/pull/3075) Ensure `results` property in JSON output is an empty array `[]` instead of `null` when scanning with `--allow-no-lockfiles` and no lockfiles are found. - [Bug #3071](https://github.com/google/osv-scanner/pull/3071) Preserve valid UTF-8 sequences when truncating multibyte text in vertical output. - [Bug #2919](https://github.com/google/osv-scanner/pull/2919) Add filter to show packages with license violations but no vulnerabilities in the HTML report. - [Bug #3049](https://github.com/google/osv-scanner/pull/3049) Keep filter dropdown checklist open when clicking options in the HTML report. - [Bug #3023](https://github.com/google/osv-scanner/pull/3023) Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation. - [Bug #3032](https://github.com/google/osv-scanner/pull/3032) Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions. - [Bug #3061](https://github.com/google/osv-scanner/pull/3061) Remove purl caching in scan filtering to avoid dropping SBOM packages without purls. - [Bug #3063](https://github.com/google/osv-scanner/pull/3063) Log plugin and enricher errors during container scans instead of failing silently. - [Bug #2977](https://github.com/google/osv-scanner/pull/2977) Return an error instead of aborting the process (`log.Fatalf`) when an `rlib` archive has no object file during Rust source analysis. - [Bug #3083](https://github.com/google/osv-scanner/pull/3083) Return a descriptive error from `DoContainerScan` when `ScannerActions.Image` is empty instead of panicking. - **Fixes via `osv-scalibr`**: - Fix false-positive Go standard library matches for packages with module paths ending in `/go` (e.g. `pkg:golang/github.com/json-iterator/go`) ([#3017](https://github.com/google/osv-scanner/issues/3017)). - Secure guided remediation file operations with `os.Root` to prevent path traversal attacks ([google/osv-scalibr#2363](https://github.com/google/osv-scalibr/pull/2363)). - Prevent OOM and disk exhaustion issues with tar bombs during archive extraction. - Strip platform suffix from RubyGems versions in CycloneDX ([google/osv-scalibr#2313](https://github.com/google/osv-scalibr/pull/2313)). - Ignore `.deps.json` files that don't have an object as their root in `dotnet/depsjson` extractor ([google/osv-scalibr#2423](https://github.com/google/osv-scalibr/pull/2423)). ### Misc: - Update `osv-scalibr` to `v0.5.3-0.20260911142458-3090dbb7aaa2` ([#3079](https://github.com/google/osv-scanner/pull/3079)). - Update Go to v1.27 and `golangci-lint` to v2.13 ([#3046](https://github.com/google/osv-scanner/pull/3046)). - This now supports call analysis on go v1.27 projects. - Update `google.golang.org/grpc` to v1.83.2 ([#3062](https://github.com/google/osv-scanner/pull/3062)). ## New Contributors * @summerpan688 made their first contribution in https://github.com/google/osv-scanner/pull/2919 * @BenkiNew made their first contribution in https://github.com/google/osv-scanner/pull/3038 * @Amey-Thakur made their first contribution in https://github.com/google/osv-scanner/pull/3032 * @sl4x0 made their first contribution in https://github.com/google/osv-scanner/pull/3023 * @shubhransh-gupta made their first contribution in https://github.com/google/osv-scanner/pull/3049 * @kobihikri made their first contribution in https://github.com/google/osv-scanner/pull/2977 * @skialpine made their first contribution in https://github.com/google/osv-scanner/pull/2888 * @keeltrace made their first contribution in https://github.com/google/osv-scanner/pull/3071 * @Muszic made their first contribution in https://github.com/google/osv-scanner/pull/3083 * @knQzx made their first contribution in https://github.com/google/osv-scalibr/pull/2313 * @micrictor made their first contribution in https://github.com/google/osv-scalibr/pull/2047 * @srossross made their first contribution in https://github.com/google/osv-scalibr/pull/2375 **Full Changelog**: https://github.com/google/osv-scanner/compare/v2.5.1...v2.6.0 </details>

Wuast94 added 1 commit

2026-09-15 00:49:01 +02:00