Skip to content

Conversation

@spencerschrock
Copy link
Member

@spencerschrock spencerschrock commented Oct 27, 2025

What kind of change does this PR introduce?

bug fix

What is the current behavior?

osv-scanner was stuck on v1, and couldn't get new features/fixes

What is the new behavior (if this is a feature change)?**

osv-scanner is bumped to the latest release

  • Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #4695
Fixes #4604
Fixes #3074
Partially solves #3664
Fixes #3161

Special notes for your reviewer

Does this PR introduce a user-facing change?

For user-facing changes, please add a concise, human-readable release note to
the release-note

(In particular, describe what changes users might need to make in their
application as a result of this pull request.)

Updated osv-scanner to v2.2.4 for Vulnerabilities detection.

@codecov
Copy link

codecov bot commented Oct 27, 2025

Codecov Report

❌ Patch coverage is 79.71014% with 14 lines in your changes missing coverage. Please review.
✅ Project coverage is 69.51%. Comparing base (353ed60) to head (91d7aed).
⚠️ Report is 271 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4833      +/-   ##
==========================================
+ Coverage   66.80%   69.51%   +2.70%     
==========================================
  Files         230      251      +21     
  Lines       16602    15645     -957     
==========================================
- Hits        11091    10875     -216     
+ Misses       4808     3900     -908     
- Partials      703      870     +167     
🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@spencerschrock
Copy link
Member Author

/scdiff generate Vulnerabilities

@github-actions
Copy link

osv-scanner made their logic internal, so copy over the bits we need.

Signed-off-by: Spencer Schrock <[email protected]>
Signed-off-by: Spencer Schrock <[email protected]>
@spencerschrock spencerschrock marked this pull request as ready for review October 29, 2025 16:52
@spencerschrock spencerschrock requested a review from a team as a code owner October 29, 2025 16:52
@spencerschrock spencerschrock requested review from justaugustus and raghavkaul and removed request for a team October 29, 2025 16:52
@dosubot dosubot bot added the size:L This PR changes 100-499 lines, ignoring generated files. label Oct 29, 2025
@spencerschrock spencerschrock enabled auto-merge (squash) November 4, 2025 15:54
@spencerschrock spencerschrock merged commit bd018c7 into ossf:main Nov 4, 2025
37 checks passed
@spencerschrock spencerschrock deleted the osv-scanner-v2 branch November 4, 2025 16:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

size:L This PR changes 100-499 lines, ignoring generated files.

Projects

Status: Done

2 participants