Update google/osv-scanner-action action to v2

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
google/osv-scanner-action	action	major	v1.9.2 → v2.3.2

---

Release Notes

google/osv-scanner-action (google/osv-scanner-action)

v2.3.2

Compare Source

This updates OSV-Scanner to v2.3.2

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

• Bug #​2415 Add more PURL-to-ecosystem mappings
• Bug #​2422 MCP error for get_vulnerability_id because type definition is incorrect.
• Bug #​2460 Enable osv-scanner.json git queries
• Bug #​2456 Properly track if an ignore entry has been used
• Bug #​2450 Performance: Avoid loading the entire advisory unless it will actually be used
• Bug #​2445 Performance: Don't read the entire zip into memory
• Bug #​2433 Allow specifying user agent in v2 osvscanner package

Misc:

• Misc #​2453 Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
• Misc #​2447 Include bun.lock as a supported lockfile
• Misc #​2444 Document GoVersionOverride in configuration.md

Full Changelog: google/osv-scanner@v2.3.1...v2.3.2

v2.3.1

Compare Source

What's Changed

• chore(deps): update workflows (major) by @​renovate-bot in #​105
• chore(deps): update github/codeql-action action to v4.31.7 by @​renovate-bot in #​108
• chore: more specific name for uploaded artifact by @​marcusburghardt in #​111
• Update to v2.3.1 by @​cuixq in #​112

New Contributors

• @​marcusburghardt made their first contribution in #​111

Full Changelog: google/osv-scanner-action@v2.3.0...v2.3.1

v2.3.0

Compare Source

What's Changed

• chore(deps): update workflows by @​renovate-bot in #​104
• Add gemini config.yaml file by @​michaelkedar in #​107
• Update to v2.3.0 by @​michaelkedar in #​106

Full Changelog: google/osv-scanner-action@v2.2.4...v2.3.0

v2.2.4

Compare Source

What's Changed

• chore(deps): update github/codeql-action action to v4 by @​renovate-bot in #​102
• Update to v2.2.4 by @​another-rex in #​103

Full Changelog: google/osv-scanner-action@v2.2.3...v2.2.4

v2.2.3

Compare Source

What's Changed

• chore(deps): update workflows by @​renovate-bot in #​86
• chore(deps): update workflows to v5 (major) by @​renovate-bot in #​87
• Update to v2.2.3 by @​jess-lowe in #​101

Full Changelog: google/osv-scanner-action@v2.2.2...v2.2.3

v2.2.2

Compare Source

This updates OSV-Scanner to v2.2.2.

What's Changed

• docs: Update Automatic install instructions by @​another-rex in #​94
• Update to v2.2.2 by @​cuixq in #​95

Full Changelog: google/osv-scanner-action@v2.2.1...v2.2.2

v2.2.1

Compare Source

What's Changed

OSV-Scanner now supports all OSV-Scalibr features behind experimental flags (--experimental-plugins, see details here)!

Features:

• Feature #​2146 Allow manual OSV-Scalibr plugin selection.
• Feature #​2144 Add OSV-Scalibr version to osv-scanner --version output.
• Feature #​2021 Add experimental support for running OSV-Scalibr detectors.
• Feature #​2079 Fall back to offline extractor if the transitive one fails, so at least direct dependencies are returned.
• Feature #​2032 Add summary section at the top of outputs and a 'Fixed Version' column.
• Feature #​2076 Support Ubuntu severity type.

Fixes:

• Bug #​2141 Fix OSV-Scanner json scans not matching with correct ecosystem.
• Bug #​2084 Show absolute paths when scanning containers.
• Bug #​2126 Log and preserve package count before continuing on db error.
• Bug #​2095 Pass through plugin capabilities correctly.
• Bug #​2051 Properly flag if running on Linux or Mac OSs for plugin compatibility.
• Bug #​2072 Add missing "text" property in description fields.
• Bug #​2068 Change links in output to go to the specific vulnerability page instead of the list page.
• Bug #​2064 Fix SARIF v3 output to include results.
• Bug #​2151 Filter by ecosystem before querying.

API Changes:

• API Change #​2096 Allow log handler to be overridden.

---

[!WARNING]
This release was originally incorrectly pointing to the bugged v2.2.0 osv-scanner release, it has now been retagged to the correct v2.2.1 release.

v2.1.0

Compare Source

What's Changed

• chore(deps): update github/codeql-action action to v3.29.0 by @​renovate-bot in #​76
• Update to v2.1.0 by @​michaelkedar in #​81

Full Changelog: google/osv-scanner-action@v2.0.3...v2.1.0

v2.0.3

Compare Source

Update to use osv-scanner v2.0.3

Notable changes:

• There's now a flag --allow-no-lockfiles you can pass to osv-scanner to avoid getting an error when running against a repo with no lockfiles.
• We no longer ignore general errors when they occur on osv-scanner-action, and will fail the workflow (e.g. invalid flags passed in)

v2.0.2

Compare Source

Update osv-scanner to v2.0.2

v2.0.1

Compare Source

What's Changed

• Update to v2.0.1 by @​michaelkedar in #​69

Full Changelog: google/osv-scanner-action@v2.0.0...v2.0.1

v2.0.0

Compare Source

What's Changed

• Updated to support OSV-Scanner V2
• Workflows, add support for matrix strategies by @​GeoDerp in #​52
• Support checking out submodules by @​faern in #​57

Breaking changes

By default, osv-scanner-action no longer scans the HEAD git hash. This means if there are no other lockfiles found to scan, then osv-scanner-action will fail the workflow, as it is likely it's setup incorrectly.

To match the previous behavior, pass --include-git-root to scan-args, e.g.

  osv-scan:
    uses: "google/osv-scanner-action/.github/workflows/[email protected]"
    with:
      scan-args: |-
        --include-git-root
        --recursive
        ./

Full Changelog: google/osv-scanner-action@v1.9.2...v2.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.