chore: update ci toolchain (v2.6.0 → v2.7.0) #337

Merged

Wuast94 merged 1 commit from updatarr/ci-toolchain-63db05fe2e into main

2026-10-12 22:54:38 +02:00

Wuast94 commented

2026-10-12 21:21:46 +02:00

Owner

Updates ci toolchain.

Automerge: Enabled

Updates

Dependency	From	To	Type	Locations
`github.com/google/osv-scanner/v2`	`v2.6.0`	`v2.7.0`	minor	`.devcontainer/Dockerfile` L20 `Justfile` L15

Release notes: github.com/google/osv-scanner/v2

`v2.7.0` `v2.7.0`

Features:

Feature #2885 Include package URLs (purl) in JSON output when available.
Feature #2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
Feature #3113 Include vulnerability severity and rating in CycloneDX output when available.
Feature #3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
Dependency scanning & lockfile improvements via osv-scalibr:
- Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
- Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
- Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
- Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
New extractors and plugin support via osv-scalibr:
- Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes:

Bug #3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #3099).
Bug #3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
Bug #3134 Preserve call analysis information when diffing vulnerability results.
Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #3120).
Bug #3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
Bug #3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #3086).
Fixes via osv-scalibr:
- Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
- Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
- Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
- Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
- Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
- Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
- Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
- Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
- Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
- Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
- Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc:

Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#3123, #3089, #3137).
Remove unused root Dockerfile (#3130).

New Contributors

@sanjay20m made their first contribution in https://github.com/google/osv-scanner/pull/3102
@manenim made their first contribution in https://github.com/google/osv-scanner/pull/3133

Full Changelog: https://github.com/google/osv-scanner/compare/v2.6.0...v2.7.0

Source

Release

Compare source

Updates <code>ci toolchain</code>. Automerge: Enabled ### Updates | Dependency | From | To | Type | Locations | | --- | --- | --- | --- | --- | | <code>github.com/google/osv-scanner/v2</code> | <code>v2.6.0</code> | <code>v2.7.0</code> | minor | <code>.devcontainer/Dockerfile</code> L20<br><code>Justfile</code> L15 | <details> <summary>Release notes: <code>github.com/google/osv-scanner/v2</code></summary> #### <code>v2.7.0</code> <code>v2.7.0</code> ### Features: - [Feature #2885](https://github.com/google/osv-scanner/pull/2885) Include package URLs (`purl`) in JSON output when available. - [Feature #2589](https://github.com/google/osv-scanner/pull/2589) Add shorter `--x-` flag aliases and deprecate `--experimental-` flags. - [Feature #3113](https://github.com/google/osv-scanner/pull/3113) Include vulnerability severity and rating in CycloneDX output when available. - [Feature #3102](https://github.com/google/osv-scanner/pull/3102) Enable Dart `package_config.json` (`dart/packageconfig`) extractor by default for lockfile scans ([google/osv-scalibr#2295](https://github.com/google/osv-scalibr/pull/2295)). - **Dependency scanning & lockfile improvements via `osv-scalibr`**: - Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution. - Support scanning Bitnami container SPDX SBOMs (`sbom/spdx`) ([google/osv-scalibr#2156](https://github.com/google/osv-scalibr/pull/2156)). - Add MinimOS ecosystem mapping to the APK extractor (`os/apk`) ([google/osv-scalibr#2406](https://github.com/google/osv-scalibr/pull/2406)). - Apply `--max-file-size` limit to container image contents and tag container image layers with Buildpacks lifecycle metadata. - **New extractors and plugin support via `osv-scalibr`**: - Added `zig/buildzigzon` (`build.zig.zon`, [google/osv-scalibr#1841](https://github.com/google/osv-scalibr/pull/1841)), available via `--x-plugins` (`--experimental-plugins`). See ["Supported Inventory Types"](https://github.com/google/osv-scalibr/blob/5be78a00e3c294c19a0b03949e4eb643653c0218/docs/supported_inventory_types.md) for the extractor name. ### Fixes: - [Bug #3137](https://github.com/google/osv-scanner/pull/3137) Delegate package normalization to `osv-scalibr`'s `osvutil` to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes [#3099](https://github.com/google/osv-scanner/issues/3099)). - [Bug #3135](https://github.com/google/osv-scanner/pull/3135) Prevent network-requiring plugins (such as base image enrichment) from running when `--offline` is combined with `--download-offline-databases`. - [Bug #3134](https://github.com/google/osv-scanner/pull/3134) Preserve call analysis information when diffing vulnerability results. - [Bug #3121](https://github.com/google/osv-scanner/pull/3121) Wrap `[[PackageOverrides]]` ecosystem suffix alternatives in a non-capturing group so `Ecosystem` regex matching applies correctly to all variants (fixes [#3120](https://github.com/google/osv-scanner/issues/3120)). - [Bug #3103](https://github.com/google/osv-scanner/pull/3103) Sort packages by location before applying config annotations for deterministic log output order during recursive scans. - [Bug #3087](https://github.com/google/osv-scanner/pull/3087) Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. `Alpine` and `Alpine:v3.18`) (fixes [#3086](https://github.com/google/osv-scanner/issues/3086)). - **Fixes via `osv-scalibr`**: - Skip OSV queries for local npm packages (`file:`, workspace, and local tarballs) and avoid extracting bogus versions or commits for `file:` and URL-based dependencies in `bun.lock` ([google/osv-scalibr#2443](https://github.com/google/osv-scalibr/pull/2443), [google/osv-scalibr#2444](https://github.com/google/osv-scalibr/pull/2444)). - Restrict `#commit` fragment extraction in JS lockfiles to Git-based dependency resolutions ([google/osv-scalibr#2448](https://github.com/google/osv-scalibr/pull/2448)). - Prevent slice-bounds panic in `javascript/pnpmlock` on malformed scoped dependency paths ([google/osv-scalibr#2263](https://github.com/google/osv-scalibr/pull/2263)). - Emit valid Hackage PURLs (`pkg:hackage/...`) and add `Hackage` OSV ecosystem mapping for Haskell (`cabal` and `stack.yaml.lock`) extractors ([google/osv-scalibr#2419](https://github.com/google/osv-scalibr/pull/2419)). - Match Python `setup.py` package names containing `-`, `.`, and `_` ([google/osv-scalibr#2162](https://github.com/google/osv-scalibr/pull/2162)). - Reject invalid ZIP64 sizes and bound metadata reads in `python/wheelegg` ([google/osv-scalibr#2012](https://github.com/google/osv-scalibr/pull/2012)). - Confine Maven registry disk cache writes with `os.Root` to prevent path traversal ([google/osv-scalibr#2398](https://github.com/google/osv-scalibr/pull/2398)). - Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) ([google/osv-scalibr#2456](https://github.com/google/osv-scalibr/pull/2456)). - Skip advisory `affected` entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory ([google/osv-scalibr#2429](https://github.com/google/osv-scalibr/pull/2429)). - Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of `wp-content/plugins` ([google/osv-scalibr#2424](https://github.com/google/osv-scalibr/pull/2424), [google/osv-scalibr#2445](https://github.com/google/osv-scalibr/pull/2445)). - Fix 32-bit `statfs` block size overflow when checking filesystem types on 32-bit architectures ([google/osv-scalibr#2439](https://github.com/google/osv-scalibr/pull/2439)). ### Misc: - Update `osv-scalibr` to `v0.5.4-0.20261009010329-5be78a00e3c2` ([#3123](https://github.com/google/osv-scanner/pull/3123), [#3089](https://github.com/google/osv-scanner/pull/3089), [#3137](https://github.com/google/osv-scanner/pull/3137)). - Remove unused root `Dockerfile` ([#3130](https://github.com/google/osv-scanner/pull/3130)). ## New Contributors * @sanjay20m made their first contribution in https://github.com/google/osv-scanner/pull/3102 * @manenim made their first contribution in https://github.com/google/osv-scanner/pull/3133 **Full Changelog**: https://github.com/google/osv-scanner/compare/v2.6.0...v2.7.0 <a href="https://github.com/google/osv-scanner">Source</a> <a href="https://github.com/google/osv-scanner/releases/tag/v2.7.0">Release</a> <a href="https://github.com/google/osv-scanner/compare/v2.6.0...main">Compare source</a> </details>

Wuast94 added 1 commit

2026-10-12 21:21:46 +02:00