ci(deps): bump google/osv-scanner from 1 to 2 by dependabot[bot] · Pull Request #6 · OpenConjecture/daglab

dependabot · 2025-09-18T21:16:50Z

Release notes

Sourced from google/osv-scanner's releases.

v2.0.0

This release merges the improvements, features, and fixes from v2.0.0-rc1, v2.0.0-beta2, and v2.0.0-beta1.

Important: This release includes several breaking changes aimed at future-proofing OSV-Scanner. Please consult our comprehensive Migration Guide to ensure a smooth upgrade.

Features:

Layer and base image-aware container scanning:

Rewritten support for Debian, Ubuntu, and Alpine container images.

Layer level analysis and vulnerability breakdown.

Supports Go, Java, Node, and Python artifacts within supported distros.

Base image identification via deps.dev.

Usage: osv-scanner scan image <image-name>:<tag>

Interactive HTML output:

Severity breakdown, package/ID/importance filtering, vulnerability details.

Container image layer filtering, layer info, base image identification.

Usage: osv-scanner scan --serve ...

Guided Remediation for Maven pom.xml:

Remediate direct and transitive dependencies (non-interactive mode).

New override remediation strategy.

Support for reading/writing pom.xml and parent POM files.

Private registry support for Maven metadata.

Machine-readable output for guided remediation.

Enhanced Dependency Extraction with osv-scalibr:

Haskell: cabal.project.freeze, stack.yaml.lock

.NET: deps.json

Python: uv.lock

Artifacts: node_modules, Python wheels, Java uber jars, Go binaries

[Feature #1636](google/osv-scanner#1636) osv-scanner update command for updating the local vulnerability database (formerly experimental).

[Feature #1582](google/osv-scanner#1582) Add container scanning information to vertical output format.

[Feature #1587](google/osv-scanner#1587) Add support for severity in SARIF report format.

[Feature #1569](google/osv-scanner#1569) Add support for bun.lock lockfiles.

[Feature #1547](google/osv-scanner#1547) Add experimental config support to the scan image command.

[Feature #1557](google/osv-scanner#1557) Allow setting port number with --serve using the new --port flag.

Breaking Changes:

[Feature #1670](google/osv-scanner#1670) Guided remediation now defaults to non-interactive mode; use the --interactive flag for interactive mode.

[Feature #1670](google/osv-scanner#1686) Removed the --verbosity=verbose verbosity level.

[Feature #1673](google/osv-scanner#1673) & [Feature #1664](google/osv-scanner#1664) All previous experimental flags are now out of experimental, and the experimental flag mechanism has been removed.

[Feature #1651](google/osv-scanner#1651) Multiple license flags have been merged into a single --license flag.

[Feature #1666](google/osv-scanner#1666) API: reporter removed; logging now uses slog, which can be overridden.

[Feature #1638](google/osv-scanner#1638) API: Deprecated packages removed, including lockfile (migrated to OSV-Scalibr).

Improvements:

[Feature #1561](google/osv-scanner#1561) Updated HTML report for better contrast and usability (from beta2).

[Feature #1584](google/osv-scanner#1584) Make skipping the root git repository the default behavior (from beta2).

[Feature #1648](google/osv-scanner#1648) Updated HTML report styling to improve contrast (from rc1).

... (truncated)

Changelog

Sourced from google/osv-scanner's changelog.

v2.0.0-rc1

Our first release candidate for OSV-Scanner V2, which includes various breaking changes osv-scanner to help future proof osv-scanner in V2! See the changelog for beta1 and beta2 for the full list of changes.

We've also added a migration guide here: https://google.github.io/osv-scanner/migration-guide.html

Changes:

[Feature #1670](google/osv-scanner#1670) Guided remediation now makes non-interactive the default mode, and adds the --interactive flag.

[Feature #1670](google/osv-scanner#1686) Removes the --verbosity=verbose verbosity level.

[Feature #1673](google/osv-scanner#1673) & [Feature #1664](google/osv-scanner#1664) Moves all our experimental flags out of experimental, and removes the experimental flags.

[Feature #1651](google/osv-scanner#1651) License flags have been merged into a single license flag. See --help or migration guide for more details.

Features:

[Feature #1636](google/osv-scanner#1636) osv-scanner update command has been released as an experimental feature.

[Feature #1582](google/osv-scanner#1582) Add container scanning related information to vertical output format.

[Feature #1587](google/osv-scanner#1587) Add support for severity in SARIF report format.

Fixes

[Fix #1677](google/osv-scanner#1677) Fix OS filter for HTML report.

[Fix #1598](google/osv-scanner#1598) Fix table output vulnerability ordering.

[Fix #1661](google/osv-scanner#1661) Add spinner to iframs in the HTML report.

[Fix #1648](google/osv-scanner#1648) Updated HTML report styling to improve contrast.

[Fix #1616](google/osv-scanner#1616) Display git scanning results in HTML report.

[Fix #1616](google/osv-scanner#1616) Filter out Ubuntu unimportant vulnerabilities.

API changes

[Feature #1666](google/osv-scanner#1666) Removes reporter, all logging now goes through slog, which you can override to change the output.

[Feature #1638](google/osv-scanner#1638) All deprecated packages have been removed from the osv-scanner module, this includes the lockfile package, which has been migrated to the OSV-Scalibr library.

v2.0.0-beta2

This second beta release brings a series of fixes and improvements to the previous release.

Improvements:

[Feature #1561](google/osv-scanner#1561) Updated HTML report for better contrast and usability

[Feature #1569](google/osv-scanner#1569) Add support for bun.lock lockfiles.

[Feature #1584](google/osv-scanner#1584) Make skip root git repository the default behavior.

[Feature #1547](google/osv-scanner#1547) Add experimental config support to the image command.

[Feature #1557](google/osv-scanner#1557) Allow setting port number when using the --serve flag with the new --port flag.

Fixes

[Fix #1585](google/osv-scanner#1585) Fixed issue where base images are occasionally duplicated.

[Fix #1597](google/osv-scanner#1597) Fixed issue where SBOM parsers are not correctly parsing CycloneDX files when using the bom.xml filename.

[Fix #1566](google/osv-scanner#1566) Fixed issue where offline scanning returns different results from online scanning.

... (truncated)

Commits

459ca69 Readd checks to v1 branch
50c2e11 Remove v2 from scorecard and other actions
ce99c72 chore: Fix linting
96eeff3 Merge remote-tracking branch 'upstream/main' into v2
dd77323 fix: set format to HTML when requesting serving resutls (#1424)
ee0945a fix: replace Debian package name with its source name (#1422)
3f1cc5c feat(output): auto-open HTML file after scan (#1412)
fe13252 fix: Update snapshots from merge
60049a3 feat: remove deprecated public packages (#1376)
f1f448c chore: Update v2 to main (#1374)
Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot merge will merge this PR after your CI passes on it
@dependabot squash and merge will squash and merge this PR after your CI passes on it
@dependabot cancel merge will cancel a previously requested merge and block automerging
@dependabot reopen will reopen this PR if it is closed
@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [google/osv-scanner](https://github.com/google/osv-scanner) from 1 to 2. - [Release notes](https://github.com/google/osv-scanner/releases) - [Changelog](https://github.com/google/osv-scanner/blob/main/CHANGELOG.md) - [Commits](google/osv-scanner@v1...v2) --- updated-dependencies: - dependency-name: google/osv-scanner dependency-version: '2' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>

dependabot · 2025-09-18T21:16:50Z

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

Navigation Menu

Uh oh!

ci(deps): bump google/osv-scanner from 1 to 2 - #6

ci(deps): bump google/osv-scanner from 1 to 2#6
dependabot[bot] wants to merge 1 commit into
mainfrom
dependabot/github_actions/google/osv-scanner-2

dependabot Bot commented on behalf of github Sep 18, 2025 •

edited

Loading

Uh oh!

dependabot Bot commented on behalf of github Sep 18, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github Sep 18, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v2.0.0

Features:

Breaking Changes:

Improvements:

v2.0.0-rc1

Changes:

Features:

Fixes

API changes

v2.0.0-beta2

Improvements:

Fixes

Uh oh!

dependabot Bot commented on behalf of github Sep 18, 2025

Labels

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github Sep 18, 2025 •

edited

Loading