Repository navigation
PRP #2059 go/gowork: add extractor for go.work and go.work.sum - #2139
Merged
copybara-service[bot] merged 9 commits intoOct 26, 2026
Merged
Conversation
Extracts Go packages from Go workspace files (go.work, go.work.sum), stable since Go 1.18. - stdlib version from the go/toolchain directive in go.work - versioned replace targets declared in go.work replace directives (local-path replacements with no version are skipped) - all versioned dependencies from go.work.sum (workspace-level supplement to the individual modules' go.sum files) The existing go/gomod extractor covers per-module go.mod files; go/gowork covers the workspace-level overlay that overrides the module graph when present. Registered in GoSource alongside go/gomod.
Contributor
Author
|
Hello @another-rex and @michaelkedar, just checking in to see if you had a chance to review this. Let me know if you need any help! |
another-rex
self-requested a review
July 7, 2026 01:45
Contributor
Author
|
Hi @another-rex, Any update on this? |
another-rex
reviewed
Sep 24, 2026
another-rex
left a comment
Collaborator
There was a problem hiding this comment.
Sorry for the late review! Made some comments.
Also you need to add to the docs here: docs/supported_inventory_types.md
Instead of emitting replace targets as standalone inventory entries,
apply go.work replace directives as mutations to the packages collected
from go.work.sum, mirroring the behaviour of the gomod extractor.
- Specific-version replaces (replace A v1 => B v2) update the matching
package entry in-place.
- All-version replaces (replace A => B v2) update every version of the
module found in the sum file.
- Local path replacements (no version on the new side) are skipped,
leaving the original entry unchanged.
- A deduplication pass after replacement handles multiple versions
collapsing to the same replacement target.
Also fixes two additional issues spotted in review:
- Use filepath.ToSlash() on the sum file path before FS.Open() so the
path is valid on Windows where input.Path uses backslashes.
- Guard the toolchain directive handling with strings.HasPrefix("go")
so the special values "default" and "local" do not corrupt the
stdlib version derived from the go directive.
Add go/gowork to docs/supported_inventory_types.md.
Two issues introduced after rebasing on latest main: 1. golang.org/x/net v0.54.0's http2/server.go is excluded under Go 1.27 (build tag: !(go1.27 && !http2legacy)), causing grpc v1.81.0 to fail with 'undefined: http2.TrailerPrefix'. Fix: upgrade golang.org/x/net to v0.59.0 where TrailerPrefix is moved to server_common.go (no build tag). 2. extractor/filesystem/list/list.go had a merge conflict leaving duplicate entries in GoSource: raw gomod.New/gowork.New alongside the new protoCfg() pattern, causing 'cannot use ... as InitFn' and duplicate key errors. Fix: keep the single correct protoCfg() form for all three Go extractors (gomod, gowork, vendormodules).
another-rex
reviewed
Oct 6, 2026
Local path replace directives (no version on the new side) previously skipped the replacement entirely, leaving the original version intact. Per reviewer feedback, remove the early continue and instead preserve the original module name (the new path is a relative dir, not a module path) while setting the version to "" — consistent with the gomod extractor's behaviour.
Contributor
Author
|
@another-rex, Please review again. Thanks! |
Contributor
Author
|
Hi @another-rex , Any update on the reward for this? Thanks! |
Collaborator
|
Hello! Thanks for your patience, PRP panel meet today (meets every 2 weeks) and rewards have been submitted on our end now. |
renokeeper Bot
added a commit
to schubydoo/clauster
that referenced
this pull request
Nov 9, 2026
This PR contains the following updates: | Package | Update | Change | OpenSSF | |---|---|---|---| | [google/osv-scanner](https://redirect.github.com/google/osv-scanner) | patch | `v2.7.0` → `v2.7.1` | [](https://securityscorecards.dev/viewer/?uri=github.com/google/osv-scanner) | --- ### Release Notes <details> <summary>google/osv-scanner</summary> ### [`v2.7.1`](https://redirect.github.com/google/osv-scanner/blob/HEAD/CHANGELOG.md#v271) [Compare Source](https://redirect.github.com/google/osv-scanner/compare/v2.7.0...v2.7.1) ##### Features: - [Feature #​3158](https://redirect.github.com/google/osv-scanner/pull/3158) Prefer ecosystem priority (such as Ubuntu severity) in table output when available (resolves [#​1275](https://redirect.github.com/google/osv-scanner/issues/1275)). - [Feature #​3178](https://redirect.github.com/google/osv-scanner/pull/3178) Add a "Fix available" filter checkbox to HTML reports (fixes [#​3016](https://redirect.github.com/google/osv-scanner/issues/3016)). - [Feature #​3173](https://redirect.github.com/google/osv-scanner/pull/3173) Warn about unused or expired `[[PackageOverrides]]` configuration entries (resolves [#​3160](https://redirect.github.com/google/osv-scanner/issues/3160)). - [Feature #​3184](https://redirect.github.com/google/osv-scanner/pull/3184) Support `EffectiveUntil` in `[[IgnoredVulns]]` configuration entries and deprecate `IgnoreUntil`. - [Feature #​3179](https://redirect.github.com/google/osv-scanner/pull/3179) Improve GitHub Actions annotation escaping and include line numbers so annotations appear directly on files. - [Feature #​3159](https://redirect.github.com/google/osv-scanner/pull/3159) Support mapping additional ecosystems (`Bitnami`, `GitHub Actions`, `Linux`, `OSS-Fuzz`) to PURL types in `osvscanner.json` (`osv/osvscannerjson`) extractor. - **Dependency scanning & lockfile improvements via `osv-scalibr`**: - Add Echo OS ecosystem mapping (`Echo`) to the DPKG extractor (`os/dpkg`) and Debian version parsing for `Echo` advisories ([google/osv-scalibr#2453](https://redirect.github.com/google/osv-scalibr/pull/2453)). - Add line number support to the `dotnet/paketlock` extractor ([google/osv-scalibr#2561](https://redirect.github.com/google/osv-scalibr/pull/2561)). - Append base images in the `deps.dev` `baseimage` enricher instead of overwriting pre-existing base image chains ([google/osv-scalibr#2481](https://redirect.github.com/google/osv-scalibr/pull/2481)). - Support `.tgz` archive files in `embeddedfs/archive` ([google/osv-scalibr#2540](https://redirect.github.com/google/osv-scalibr/pull/2540)). - **New extractors and plugin support via `osv-scalibr`**: - Enable `os/ubuntu/binarytosource` enricher in the `vulns` preset to map Ubuntu binary package names from Chisel manifests to source package names ([google/osv-scalibr#2482](https://redirect.github.com/google/osv-scalibr/pull/2482)). - Added extractors for FreeBSD packages (`os/freebsd`, [google/osv-scalibr#2048](https://redirect.github.com/google/osv-scalibr/pull/2048)), Go workspaces (`go/gowork`, [google/osv-scalibr#2139](https://redirect.github.com/google/osv-scalibr/pull/2139)), Cabal installed packages (`haskell/cabalconf`, [google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)), Python `setup.cfg` (`python/setupcfg`, [google/osv-scalibr#2369](https://redirect.github.com/google/osv-scalibr/pull/2369)), and installed R packages (`r/rpkg`, [google/osv-scalibr#2040](https://redirect.github.com/google/osv-scalibr/pull/2040)), available via `--x-plugins` (`--experimental-plugins`). - Rename `haskell/cabal` extractor to `haskell/cabalprojectfreeze` ([google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)) and `chrome/extensions` to `browser/extensions` (with added Edge and Firefox extension support, [google/osv-scalibr#2184](https://redirect.github.com/google/osv-scalibr/pull/2184)). See ["Supported Inventory Types"](https://redirect.github.com/google/osv-scalibr/blob/c80efcc25cd9e87731e9e82bf29509bc6ce0a855/docs/supported_inventory_types.md) for extractor names. ##### Fixes: - [Bug #​3216](https://redirect.github.com/google/osv-scanner/pull/3216) Scan npm registry packages with omitted `resolved` URLs while skipping local workspace and `file:`/`link:` packages (fixes [#​2881](https://redirect.github.com/google/osv-scanner/issues/2881), [#​3177](https://redirect.github.com/google/osv-scanner/issues/3177), [google/osv-scalibr#2560](https://redirect.github.com/google/osv-scalibr/pull/2560)). - [Bug #​3214](https://redirect.github.com/google/osv-scanner/pull/3214) Reject malformed `ar` archive member sizes instead of panicking during `--call-analysis=rust` scans (fixes [#​3202](https://redirect.github.com/google/osv-scanner/issues/3202)). - [Bug #​3251](https://redirect.github.com/google/osv-scanner/pull/3251) Pass extraction stats to `ScannerActions.StatsCollector` when provided. - [Bug #​3114](https://redirect.github.com/google/osv-scanner/pull/3114) Group connected vulnerabilities transitively regardless of the order they are encountered (resolves [#​3107](https://redirect.github.com/google/osv-scanner/issues/3107)). - [Bug #​3147](https://redirect.github.com/google/osv-scanner/pull/3147) Stop treating `upstream` identifiers as aliases when grouping vulnerabilities. - [Bug #​3199](https://redirect.github.com/google/osv-scanner/pull/3199) Sort package vulnerabilities deterministically by ID in output results. - [Bug #​3155](https://redirect.github.com/google/osv-scanner/pull/3155) Print license violations for OS sources without vulnerabilities or deprecations. - [Bug #​3156](https://redirect.github.com/google/osv-scanner/pull/3156) Don't display "No fix available" in table output for packages with license violations and no vulnerabilities. - [Bug #​3169](https://redirect.github.com/google/osv-scanner/pull/3169) Restrict the HTML report server (`--serve`) to bind to the loopback interface (`127.0.0.1`) by default (fixes [#​3165](https://redirect.github.com/google/osv-scanner/issues/3165)). - [Bug #​3213](https://redirect.github.com/google/osv-scanner/pull/3213) Use the correct `IgnoredVulns` key in MCP configuration instructions (resolves [#​3209](https://redirect.github.com/google/osv-scanner/issues/3209)). - [Bug #​3241](https://redirect.github.com/google/osv-scanner/pull/3241) Clarify that `--all-packages` applies to JSON and SBOM output formats (fixes [#​3220](https://redirect.github.com/google/osv-scanner/issues/3220)). - [Bug #​3252](https://redirect.github.com/google/osv-scanner/pull/3252) Reject `--apply-top=0` in `osv-scanner fix` instead of applying all patches (resolves [#​3234](https://redirect.github.com/google/osv-scanner/issues/3234)). - [Bug #​3246](https://redirect.github.com/google/osv-scanner/pull/3246) Update the `osv-scanner-docker` pre-commit hook image to `v2.7.1` (resolves [#​3225](https://redirect.github.com/google/osv-scanner/issues/3225)). - **Fixes via `osv-scalibr`**: - Normalize `NuGet` and `crates.io` package names before comparing in `vulnmatch/osvlocal` ([google/osv-scalibr#2556](https://redirect.github.com/google/osv-scalibr/pull/2556)). - Validate OSV database zip archives before caching and avoid reading the zip archive twice in `vulnmatch/osvlocal` ([google/osv-scalibr#2486](https://redirect.github.com/google/osv-scalibr/pull/2486)). - Continue matching packages across remaining ecosystems in `vulnmatch/osvlocal` when an offline OSV database fails to load for one ecosystem, and return all database load errors joined together ([google/osv-scalibr#2544](https://redirect.github.com/google/osv-scalibr/pull/2544)). - Skip `@patch:` entries in `javascript/yarnlock` so patched packages are not reported twice ([google/osv-scalibr#2498](https://redirect.github.com/google/osv-scalibr/pull/2498)). - Accept string values for `maintainers` and `contributors` fields in `javascript/packagejson` without skipping packages and guard against nil person entries ([google/osv-scalibr#2500](https://redirect.github.com/google/osv-scalibr/pull/2500)). - Read backslash-continued lines iteratively in `python/requirements` ([google/osv-scalibr#2457](https://redirect.github.com/google/osv-scalibr/pull/2457)). - Confine project `.npmrc` reads with `os.OpenRoot`, prevent project `.npmrc` files from overriding `userconfig`, `globalconfig`, or `prefix`, and avoid expanding environment variables from untrusted `.npmrc` files ([google/osv-scalibr#2536](https://redirect.github.com/google/osv-scalibr/pull/2536)). - Migrate `DirFS` and `GetRealPath` to `os.Root`, read `containerd`, `podman`, `gitrepo`, `vmdk`, and `qcow2` inputs via `ScanInput.FS`, and fix `dotnet/pe` temporary file cleanup ([google/osv-scalibr#2538](https://redirect.github.com/google/osv-scalibr/pull/2538), [google/osv-scalibr#2537](https://redirect.github.com/google/osv-scalibr/pull/2537), [google/osv-scalibr#2532](https://redirect.github.com/google/osv-scalibr/pull/2532), [google/osv-scalibr#2533](https://redirect.github.com/google/osv-scalibr/pull/2533)). - Confine archive and filesystem image (`ext4`, `FAT32`, `NTFS`, `exFAT`, `tar`) extraction writes with `os.Root` and bound extracted file sizes in `embeddedfs` ([google/osv-scalibr#2535](https://redirect.github.com/google/osv-scalibr/pull/2535)). ##### Misc: - Update `osv-scalibr` to `v0.5.4-0.20261105012210-c80efcc25cd9` ([#​3232](https://redirect.github.com/google/osv-scanner/pull/3232), [#​3216](https://redirect.github.com/google/osv-scanner/pull/3216), [#​3185](https://redirect.github.com/google/osv-scanner/pull/3185), [#​3192](https://redirect.github.com/google/osv-scanner/pull/3192), [#​3153](https://redirect.github.com/google/osv-scanner/pull/3153)). - Update Go version to 1.27.3 ([#​3152](https://redirect.github.com/google/osv-scanner/pull/3152)). - Switch GoReleaser Docker builds to Buildx (`dockers_v2`) for native multi-arch images and merge GoReleaser Dockerfiles ([#​3132](https://redirect.github.com/google/osv-scanner/pull/3132), [#​3131](https://redirect.github.com/google/osv-scanner/pull/3131)). </details> --- ### Configuration 📅 **Schedule**: (in timezone America/Los_Angeles) - Branch creation - "before 6am" - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xODguMiIsInVwZGF0ZWRJblZlciI6IjQ0LjE4OC4yIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJiaW5hcnktZGVwIl19--> Co-authored-by: renokeeper[bot] <308156799+renokeeper[bot]@users.noreply.github.com>
renovate Bot
added a commit
to nightah/encore
that referenced
this pull request
Nov 9, 2026
This PR contains the following updates: | Package | Update | Change | |---|---|---| | [ghcr.io/google/osv-scanner](https://redirect.github.com/google/osv-scanner) | patch | `v2.7.0` → `v2.7.1` | --- ### Release Notes <details> <summary>google/osv-scanner (ghcr.io/google/osv-scanner)</summary> ### [`v2.7.1`](https://redirect.github.com/google/osv-scanner/blob/HEAD/CHANGELOG.md#v271) [Compare Source](https://redirect.github.com/google/osv-scanner/compare/v2.7.0...v2.7.1) ##### Features: - [Feature #​3158](https://redirect.github.com/google/osv-scanner/pull/3158) Prefer ecosystem priority (such as Ubuntu severity) in table output when available (resolves [#​1275](https://redirect.github.com/google/osv-scanner/issues/1275)). - [Feature #​3178](https://redirect.github.com/google/osv-scanner/pull/3178) Add a "Fix available" filter checkbox to HTML reports (fixes [#​3016](https://redirect.github.com/google/osv-scanner/issues/3016)). - [Feature #​3173](https://redirect.github.com/google/osv-scanner/pull/3173) Warn about unused or expired `[[PackageOverrides]]` configuration entries (resolves [#​3160](https://redirect.github.com/google/osv-scanner/issues/3160)). - [Feature #​3184](https://redirect.github.com/google/osv-scanner/pull/3184) Support `EffectiveUntil` in `[[IgnoredVulns]]` configuration entries and deprecate `IgnoreUntil`. - [Feature #​3179](https://redirect.github.com/google/osv-scanner/pull/3179) Improve GitHub Actions annotation escaping and include line numbers so annotations appear directly on files. - [Feature #​3159](https://redirect.github.com/google/osv-scanner/pull/3159) Support mapping additional ecosystems (`Bitnami`, `GitHub Actions`, `Linux`, `OSS-Fuzz`) to PURL types in `osvscanner.json` (`osv/osvscannerjson`) extractor. - **Dependency scanning & lockfile improvements via `osv-scalibr`**: - Add Echo OS ecosystem mapping (`Echo`) to the DPKG extractor (`os/dpkg`) and Debian version parsing for `Echo` advisories ([google/osv-scalibr#2453](https://redirect.github.com/google/osv-scalibr/pull/2453)). - Add line number support to the `dotnet/paketlock` extractor ([google/osv-scalibr#2561](https://redirect.github.com/google/osv-scalibr/pull/2561)). - Append base images in the `deps.dev` `baseimage` enricher instead of overwriting pre-existing base image chains ([google/osv-scalibr#2481](https://redirect.github.com/google/osv-scalibr/pull/2481)). - Support `.tgz` archive files in `embeddedfs/archive` ([google/osv-scalibr#2540](https://redirect.github.com/google/osv-scalibr/pull/2540)). - **New extractors and plugin support via `osv-scalibr`**: - Enable `os/ubuntu/binarytosource` enricher in the `vulns` preset to map Ubuntu binary package names from Chisel manifests to source package names ([google/osv-scalibr#2482](https://redirect.github.com/google/osv-scalibr/pull/2482)). - Added extractors for FreeBSD packages (`os/freebsd`, [google/osv-scalibr#2048](https://redirect.github.com/google/osv-scalibr/pull/2048)), Go workspaces (`go/gowork`, [google/osv-scalibr#2139](https://redirect.github.com/google/osv-scalibr/pull/2139)), Cabal installed packages (`haskell/cabalconf`, [google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)), Python `setup.cfg` (`python/setupcfg`, [google/osv-scalibr#2369](https://redirect.github.com/google/osv-scalibr/pull/2369)), and installed R packages (`r/rpkg`, [google/osv-scalibr#2040](https://redirect.github.com/google/osv-scalibr/pull/2040)), available via `--x-plugins` (`--experimental-plugins`). - Rename `haskell/cabal` extractor to `haskell/cabalprojectfreeze` ([google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)) and `chrome/extensions` to `browser/extensions` (with added Edge and Firefox extension support, [google/osv-scalibr#2184](https://redirect.github.com/google/osv-scalibr/pull/2184)). See ["Supported Inventory Types"](https://redirect.github.com/google/osv-scalibr/blob/c80efcc25cd9e87731e9e82bf29509bc6ce0a855/docs/supported_inventory_types.md) for extractor names. ##### Fixes: - [Bug #​3216](https://redirect.github.com/google/osv-scanner/pull/3216) Scan npm registry packages with omitted `resolved` URLs while skipping local workspace and `file:`/`link:` packages (fixes [#​2881](https://redirect.github.com/google/osv-scanner/issues/2881), [#​3177](https://redirect.github.com/google/osv-scanner/issues/3177), [google/osv-scalibr#2560](https://redirect.github.com/google/osv-scalibr/pull/2560)). - [Bug #​3214](https://redirect.github.com/google/osv-scanner/pull/3214) Reject malformed `ar` archive member sizes instead of panicking during `--call-analysis=rust` scans (fixes [#​3202](https://redirect.github.com/google/osv-scanner/issues/3202)). - [Bug #​3251](https://redirect.github.com/google/osv-scanner/pull/3251) Pass extraction stats to `ScannerActions.StatsCollector` when provided. - [Bug #​3114](https://redirect.github.com/google/osv-scanner/pull/3114) Group connected vulnerabilities transitively regardless of the order they are encountered (resolves [#​3107](https://redirect.github.com/google/osv-scanner/issues/3107)). - [Bug #​3147](https://redirect.github.com/google/osv-scanner/pull/3147) Stop treating `upstream` identifiers as aliases when grouping vulnerabilities. - [Bug #​3199](https://redirect.github.com/google/osv-scanner/pull/3199) Sort package vulnerabilities deterministically by ID in output results. - [Bug #​3155](https://redirect.github.com/google/osv-scanner/pull/3155) Print license violations for OS sources without vulnerabilities or deprecations. - [Bug #​3156](https://redirect.github.com/google/osv-scanner/pull/3156) Don't display "No fix available" in table output for packages with license violations and no vulnerabilities. - [Bug #​3169](https://redirect.github.com/google/osv-scanner/pull/3169) Restrict the HTML report server (`--serve`) to bind to the loopback interface (`127.0.0.1`) by default (fixes [#​3165](https://redirect.github.com/google/osv-scanner/issues/3165)). - [Bug #​3213](https://redirect.github.com/google/osv-scanner/pull/3213) Use the correct `IgnoredVulns` key in MCP configuration instructions (resolves [#​3209](https://redirect.github.com/google/osv-scanner/issues/3209)). - [Bug #​3241](https://redirect.github.com/google/osv-scanner/pull/3241) Clarify that `--all-packages` applies to JSON and SBOM output formats (fixes [#​3220](https://redirect.github.com/google/osv-scanner/issues/3220)). - [Bug #​3252](https://redirect.github.com/google/osv-scanner/pull/3252) Reject `--apply-top=0` in `osv-scanner fix` instead of applying all patches (resolves [#​3234](https://redirect.github.com/google/osv-scanner/issues/3234)). - [Bug #​3246](https://redirect.github.com/google/osv-scanner/pull/3246) Update the `osv-scanner-docker` pre-commit hook image to `v2.7.1` (resolves [#​3225](https://redirect.github.com/google/osv-scanner/issues/3225)). - **Fixes via `osv-scalibr`**: - Normalize `NuGet` and `crates.io` package names before comparing in `vulnmatch/osvlocal` ([google/osv-scalibr#2556](https://redirect.github.com/google/osv-scalibr/pull/2556)). - Validate OSV database zip archives before caching and avoid reading the zip archive twice in `vulnmatch/osvlocal` ([google/osv-scalibr#2486](https://redirect.github.com/google/osv-scalibr/pull/2486)). - Continue matching packages across remaining ecosystems in `vulnmatch/osvlocal` when an offline OSV database fails to load for one ecosystem, and return all database load errors joined together ([google/osv-scalibr#2544](https://redirect.github.com/google/osv-scalibr/pull/2544)). - Skip `@patch:` entries in `javascript/yarnlock` so patched packages are not reported twice ([google/osv-scalibr#2498](https://redirect.github.com/google/osv-scalibr/pull/2498)). - Accept string values for `maintainers` and `contributors` fields in `javascript/packagejson` without skipping packages and guard against nil person entries ([google/osv-scalibr#2500](https://redirect.github.com/google/osv-scalibr/pull/2500)). - Read backslash-continued lines iteratively in `python/requirements` ([google/osv-scalibr#2457](https://redirect.github.com/google/osv-scalibr/pull/2457)). - Confine project `.npmrc` reads with `os.OpenRoot`, prevent project `.npmrc` files from overriding `userconfig`, `globalconfig`, or `prefix`, and avoid expanding environment variables from untrusted `.npmrc` files ([google/osv-scalibr#2536](https://redirect.github.com/google/osv-scalibr/pull/2536)). - Migrate `DirFS` and `GetRealPath` to `os.Root`, read `containerd`, `podman`, `gitrepo`, `vmdk`, and `qcow2` inputs via `ScanInput.FS`, and fix `dotnet/pe` temporary file cleanup ([google/osv-scalibr#2538](https://redirect.github.com/google/osv-scalibr/pull/2538), [google/osv-scalibr#2537](https://redirect.github.com/google/osv-scalibr/pull/2537), [google/osv-scalibr#2532](https://redirect.github.com/google/osv-scalibr/pull/2532), [google/osv-scalibr#2533](https://redirect.github.com/google/osv-scalibr/pull/2533)). - Confine archive and filesystem image (`ext4`, `FAT32`, `NTFS`, `exFAT`, `tar`) extraction writes with `os.Root` and bound extracted file sizes in `embeddedfs` ([google/osv-scalibr#2535](https://redirect.github.com/google/osv-scalibr/pull/2535)). ##### Misc: - Update `osv-scalibr` to `v0.5.4-0.20261105012210-c80efcc25cd9` ([#​3232](https://redirect.github.com/google/osv-scanner/pull/3232), [#​3216](https://redirect.github.com/google/osv-scanner/pull/3216), [#​3185](https://redirect.github.com/google/osv-scanner/pull/3185), [#​3192](https://redirect.github.com/google/osv-scanner/pull/3192), [#​3153](https://redirect.github.com/google/osv-scanner/pull/3153)). - Update Go version to 1.27.3 ([#​3152](https://redirect.github.com/google/osv-scanner/pull/3152)). - Switch GoReleaser Docker builds to Buildx (`dockers_v2`) for native multi-arch images and merge GoReleaser Dockerfiles ([#​3132](https://redirect.github.com/google/osv-scanner/pull/3132), [#​3131](https://redirect.github.com/google/osv-scanner/pull/3131)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/nightah/encore). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjAuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMC4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiXX0=--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
nylzo-dependency-updates Bot
added a commit
to misaon/nylzo
that referenced
this pull request
Nov 9, 2026
…#298) This PR contains the following updates: | Package | Type | Update | Change | [Age](https://docs.renovatebot.com/merge-confidence/) | [Confidence](https://docs.renovatebot.com/merge-confidence/) | OpenSSF | |---|---|---|---|---|---|---| | [osv-scanner](https://redirect.github.com/google/osv-scanner) | tools | patch | `2.7.0` → `2.7.1` |  |  | [](https://securityscorecards.dev/viewer/?uri=github.com/google/osv-scanner) | --- ### Release Notes <details> <summary>google/osv-scanner (osv-scanner)</summary> ### [`v2.7.1`](https://redirect.github.com/google/osv-scanner/blob/HEAD/CHANGELOG.md#v271) [Compare Source](https://redirect.github.com/google/osv-scanner/compare/v2.7.0...v2.7.1) ##### Features: - [Feature #​3158](https://redirect.github.com/google/osv-scanner/pull/3158) Prefer ecosystem priority (such as Ubuntu severity) in table output when available (resolves [#​1275](https://redirect.github.com/google/osv-scanner/issues/1275)). - [Feature #​3178](https://redirect.github.com/google/osv-scanner/pull/3178) Add a "Fix available" filter checkbox to HTML reports (fixes [#​3016](https://redirect.github.com/google/osv-scanner/issues/3016)). - [Feature #​3173](https://redirect.github.com/google/osv-scanner/pull/3173) Warn about unused or expired `[[PackageOverrides]]` configuration entries (resolves [#​3160](https://redirect.github.com/google/osv-scanner/issues/3160)). - [Feature #​3184](https://redirect.github.com/google/osv-scanner/pull/3184) Support `EffectiveUntil` in `[[IgnoredVulns]]` configuration entries and deprecate `IgnoreUntil`. - [Feature #​3179](https://redirect.github.com/google/osv-scanner/pull/3179) Improve GitHub Actions annotation escaping and include line numbers so annotations appear directly on files. - [Feature #​3159](https://redirect.github.com/google/osv-scanner/pull/3159) Support mapping additional ecosystems (`Bitnami`, `GitHub Actions`, `Linux`, `OSS-Fuzz`) to PURL types in `osvscanner.json` (`osv/osvscannerjson`) extractor. - **Dependency scanning & lockfile improvements via `osv-scalibr`**: - Add Echo OS ecosystem mapping (`Echo`) to the DPKG extractor (`os/dpkg`) and Debian version parsing for `Echo` advisories ([google/osv-scalibr#2453](https://redirect.github.com/google/osv-scalibr/pull/2453)). - Add line number support to the `dotnet/paketlock` extractor ([google/osv-scalibr#2561](https://redirect.github.com/google/osv-scalibr/pull/2561)). - Append base images in the `deps.dev` `baseimage` enricher instead of overwriting pre-existing base image chains ([google/osv-scalibr#2481](https://redirect.github.com/google/osv-scalibr/pull/2481)). - Support `.tgz` archive files in `embeddedfs/archive` ([google/osv-scalibr#2540](https://redirect.github.com/google/osv-scalibr/pull/2540)). - **New extractors and plugin support via `osv-scalibr`**: - Enable `os/ubuntu/binarytosource` enricher in the `vulns` preset to map Ubuntu binary package names from Chisel manifests to source package names ([google/osv-scalibr#2482](https://redirect.github.com/google/osv-scalibr/pull/2482)). - Added extractors for FreeBSD packages (`os/freebsd`, [google/osv-scalibr#2048](https://redirect.github.com/google/osv-scalibr/pull/2048)), Go workspaces (`go/gowork`, [google/osv-scalibr#2139](https://redirect.github.com/google/osv-scalibr/pull/2139)), Cabal installed packages (`haskell/cabalconf`, [google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)), Python `setup.cfg` (`python/setupcfg`, [google/osv-scalibr#2369](https://redirect.github.com/google/osv-scalibr/pull/2369)), and installed R packages (`r/rpkg`, [google/osv-scalibr#2040](https://redirect.github.com/google/osv-scalibr/pull/2040)), available via `--x-plugins` (`--experimental-plugins`). - Rename `haskell/cabal` extractor to `haskell/cabalprojectfreeze` ([google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)) and `chrome/extensions` to `browser/extensions` (with added Edge and Firefox extension support, [google/osv-scalibr#2184](https://redirect.github.com/google/osv-scalibr/pull/2184)). See ["Supported Inventory Types"](https://redirect.github.com/google/osv-scalibr/blob/c80efcc25cd9e87731e9e82bf29509bc6ce0a855/docs/supported_inventory_types.md) for extractor names. ##### Fixes: - [Bug #​3216](https://redirect.github.com/google/osv-scanner/pull/3216) Scan npm registry packages with omitted `resolved` URLs while skipping local workspace and `file:`/`link:` packages (fixes [#​2881](https://redirect.github.com/google/osv-scanner/issues/2881), [#​3177](https://redirect.github.com/google/osv-scanner/issues/3177), [google/osv-scalibr#2560](https://redirect.github.com/google/osv-scalibr/pull/2560)). - [Bug #​3214](https://redirect.github.com/google/osv-scanner/pull/3214) Reject malformed `ar` archive member sizes instead of panicking during `--call-analysis=rust` scans (fixes [#​3202](https://redirect.github.com/google/osv-scanner/issues/3202)). - [Bug #​3251](https://redirect.github.com/google/osv-scanner/pull/3251) Pass extraction stats to `ScannerActions.StatsCollector` when provided. - [Bug #​3114](https://redirect.github.com/google/osv-scanner/pull/3114) Group connected vulnerabilities transitively regardless of the order they are encountered (resolves [#​3107](https://redirect.github.com/google/osv-scanner/issues/3107)). - [Bug #​3147](https://redirect.github.com/google/osv-scanner/pull/3147) Stop treating `upstream` identifiers as aliases when grouping vulnerabilities. - [Bug #​3199](https://redirect.github.com/google/osv-scanner/pull/3199) Sort package vulnerabilities deterministically by ID in output results. - [Bug #​3155](https://redirect.github.com/google/osv-scanner/pull/3155) Print license violations for OS sources without vulnerabilities or deprecations. - [Bug #​3156](https://redirect.github.com/google/osv-scanner/pull/3156) Don't display "No fix available" in table output for packages with license violations and no vulnerabilities. - [Bug #​3169](https://redirect.github.com/google/osv-scanner/pull/3169) Restrict the HTML report server (`--serve`) to bind to the loopback interface (`127.0.0.1`) by default (fixes [#​3165](https://redirect.github.com/google/osv-scanner/issues/3165)). - [Bug #​3213](https://redirect.github.com/google/osv-scanner/pull/3213) Use the correct `IgnoredVulns` key in MCP configuration instructions (resolves [#​3209](https://redirect.github.com/google/osv-scanner/issues/3209)). - [Bug #​3241](https://redirect.github.com/google/osv-scanner/pull/3241) Clarify that `--all-packages` applies to JSON and SBOM output formats (fixes [#​3220](https://redirect.github.com/google/osv-scanner/issues/3220)). - [Bug #​3252](https://redirect.github.com/google/osv-scanner/pull/3252) Reject `--apply-top=0` in `osv-scanner fix` instead of applying all patches (resolves [#​3234](https://redirect.github.com/google/osv-scanner/issues/3234)). - [Bug #​3246](https://redirect.github.com/google/osv-scanner/pull/3246) Update the `osv-scanner-docker` pre-commit hook image to `v2.7.1` (resolves [#​3225](https://redirect.github.com/google/osv-scanner/issues/3225)). - **Fixes via `osv-scalibr`**: - Normalize `NuGet` and `crates.io` package names before comparing in `vulnmatch/osvlocal` ([google/osv-scalibr#2556](https://redirect.github.com/google/osv-scalibr/pull/2556)). - Validate OSV database zip archives before caching and avoid reading the zip archive twice in `vulnmatch/osvlocal` ([google/osv-scalibr#2486](https://redirect.github.com/google/osv-scalibr/pull/2486)). - Continue matching packages across remaining ecosystems in `vulnmatch/osvlocal` when an offline OSV database fails to load for one ecosystem, and return all database load errors joined together ([google/osv-scalibr#2544](https://redirect.github.com/google/osv-scalibr/pull/2544)). - Skip `@patch:` entries in `javascript/yarnlock` so patched packages are not reported twice ([google/osv-scalibr#2498](https://redirect.github.com/google/osv-scalibr/pull/2498)). - Accept string values for `maintainers` and `contributors` fields in `javascript/packagejson` without skipping packages and guard against nil person entries ([google/osv-scalibr#2500](https://redirect.github.com/google/osv-scalibr/pull/2500)). - Read backslash-continued lines iteratively in `python/requirements` ([google/osv-scalibr#2457](https://redirect.github.com/google/osv-scalibr/pull/2457)). - Confine project `.npmrc` reads with `os.OpenRoot`, prevent project `.npmrc` files from overriding `userconfig`, `globalconfig`, or `prefix`, and avoid expanding environment variables from untrusted `.npmrc` files ([google/osv-scalibr#2536](https://redirect.github.com/google/osv-scalibr/pull/2536)). - Migrate `DirFS` and `GetRealPath` to `os.Root`, read `containerd`, `podman`, `gitrepo`, `vmdk`, and `qcow2` inputs via `ScanInput.FS`, and fix `dotnet/pe` temporary file cleanup ([google/osv-scalibr#2538](https://redirect.github.com/google/osv-scalibr/pull/2538), [google/osv-scalibr#2537](https://redirect.github.com/google/osv-scalibr/pull/2537), [google/osv-scalibr#2532](https://redirect.github.com/google/osv-scalibr/pull/2532), [google/osv-scalibr#2533](https://redirect.github.com/google/osv-scalibr/pull/2533)). - Confine archive and filesystem image (`ext4`, `FAT32`, `NTFS`, `exFAT`, `tar`) extraction writes with `os.Root` and bound extracted file sizes in `embeddedfs` ([google/osv-scalibr#2535](https://redirect.github.com/google/osv-scalibr/pull/2535)). ##### Misc: - Update `osv-scalibr` to `v0.5.4-0.20261105012210-c80efcc25cd9` ([#​3232](https://redirect.github.com/google/osv-scanner/pull/3232), [#​3216](https://redirect.github.com/google/osv-scanner/pull/3216), [#​3185](https://redirect.github.com/google/osv-scanner/pull/3185), [#​3192](https://redirect.github.com/google/osv-scanner/pull/3192), [#​3153](https://redirect.github.com/google/osv-scanner/pull/3153)). - Update Go version to 1.27.3 ([#​3152](https://redirect.github.com/google/osv-scanner/pull/3152)). - Switch GoReleaser Docker builds to Buildx (`dockers_v2`) for native multi-arch images and merge GoReleaser Dockerfiles ([#​3132](https://redirect.github.com/google/osv-scanner/pull/3132), [#​3131](https://redirect.github.com/google/osv-scanner/pull/3131)). </details> --- ### Configuration 📅 **Schedule**: (in timezone Europe/Prague) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://redirect.github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuMCIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi4wIiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJkZXBlbmRlbmNpZXMiLCJpbmZyYXN0cnVjdHVyZSIsInNlY3VyaXR5Il19--> Co-authored-by: nylzo-dependency-updates[bot] <349732443+nylzo-dependency-updates[bot]@users.noreply.github.com>
yokozi-jp
pushed a commit
to yokozi-jp/agent-software-factory
that referenced
this pull request
Nov 10, 2026
This PR contains the following updates: | Package | Type | Update | Change | |---|---|---|---| | [osv-scanner](https://redirect.github.com/google/osv-scanner) | tools | patch | `2.7.0` → `2.7.1` | --- ### Release Notes <details> <summary>google/osv-scanner (osv-scanner)</summary> ### [`v2.7.1`](https://redirect.github.com/google/osv-scanner/blob/HEAD/CHANGELOG.md#v271) [Compare Source](https://redirect.github.com/google/osv-scanner/compare/v2.7.0...v2.7.1) ##### Features: - [Feature #​3158](https://redirect.github.com/google/osv-scanner/pull/3158) Prefer ecosystem priority (such as Ubuntu severity) in table output when available (resolves [#​1275](https://redirect.github.com/google/osv-scanner/issues/1275)). - [Feature #​3178](https://redirect.github.com/google/osv-scanner/pull/3178) Add a "Fix available" filter checkbox to HTML reports (fixes [#​3016](https://redirect.github.com/google/osv-scanner/issues/3016)). - [Feature #​3173](https://redirect.github.com/google/osv-scanner/pull/3173) Warn about unused or expired `[[PackageOverrides]]` configuration entries (resolves [#​3160](https://redirect.github.com/google/osv-scanner/issues/3160)). - [Feature #​3184](https://redirect.github.com/google/osv-scanner/pull/3184) Support `EffectiveUntil` in `[[IgnoredVulns]]` configuration entries and deprecate `IgnoreUntil`. - [Feature #​3179](https://redirect.github.com/google/osv-scanner/pull/3179) Improve GitHub Actions annotation escaping and include line numbers so annotations appear directly on files. - [Feature #​3159](https://redirect.github.com/google/osv-scanner/pull/3159) Support mapping additional ecosystems (`Bitnami`, `GitHub Actions`, `Linux`, `OSS-Fuzz`) to PURL types in `osvscanner.json` (`osv/osvscannerjson`) extractor. - **Dependency scanning & lockfile improvements via `osv-scalibr`**: - Add Echo OS ecosystem mapping (`Echo`) to the DPKG extractor (`os/dpkg`) and Debian version parsing for `Echo` advisories ([google/osv-scalibr#2453](https://redirect.github.com/google/osv-scalibr/pull/2453)). - Add line number support to the `dotnet/paketlock` extractor ([google/osv-scalibr#2561](https://redirect.github.com/google/osv-scalibr/pull/2561)). - Append base images in the `deps.dev` `baseimage` enricher instead of overwriting pre-existing base image chains ([google/osv-scalibr#2481](https://redirect.github.com/google/osv-scalibr/pull/2481)). - Support `.tgz` archive files in `embeddedfs/archive` ([google/osv-scalibr#2540](https://redirect.github.com/google/osv-scalibr/pull/2540)). - **New extractors and plugin support via `osv-scalibr`**: - Enable `os/ubuntu/binarytosource` enricher in the `vulns` preset to map Ubuntu binary package names from Chisel manifests to source package names ([google/osv-scalibr#2482](https://redirect.github.com/google/osv-scalibr/pull/2482)). - Added extractors for FreeBSD packages (`os/freebsd`, [google/osv-scalibr#2048](https://redirect.github.com/google/osv-scalibr/pull/2048)), Go workspaces (`go/gowork`, [google/osv-scalibr#2139](https://redirect.github.com/google/osv-scalibr/pull/2139)), Cabal installed packages (`haskell/cabalconf`, [google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)), Python `setup.cfg` (`python/setupcfg`, [google/osv-scalibr#2369](https://redirect.github.com/google/osv-scalibr/pull/2369)), and installed R packages (`r/rpkg`, [google/osv-scalibr#2040](https://redirect.github.com/google/osv-scalibr/pull/2040)), available via `--x-plugins` (`--experimental-plugins`). - Rename `haskell/cabal` extractor to `haskell/cabalprojectfreeze` ([google/osv-scalibr#2447](https://redirect.github.com/google/osv-scalibr/pull/2447)) and `chrome/extensions` to `browser/extensions` (with added Edge and Firefox extension support, [google/osv-scalibr#2184](https://redirect.github.com/google/osv-scalibr/pull/2184)). See ["Supported Inventory Types"](https://redirect.github.com/google/osv-scalibr/blob/c80efcc25cd9e87731e9e82bf29509bc6ce0a855/docs/supported_inventory_types.md) for extractor names. ##### Fixes: - [Bug #​3216](https://redirect.github.com/google/osv-scanner/pull/3216) Scan npm registry packages with omitted `resolved` URLs while skipping local workspace and `file:`/`link:` packages (fixes [#​2881](https://redirect.github.com/google/osv-scanner/issues/2881), [#​3177](https://redirect.github.com/google/osv-scanner/issues/3177), [google/osv-scalibr#2560](https://redirect.github.com/google/osv-scalibr/pull/2560)). - [Bug #​3214](https://redirect.github.com/google/osv-scanner/pull/3214) Reject malformed `ar` archive member sizes instead of panicking during `--call-analysis=rust` scans (fixes [#​3202](https://redirect.github.com/google/osv-scanner/issues/3202)). - [Bug #​3251](https://redirect.github.com/google/osv-scanner/pull/3251) Pass extraction stats to `ScannerActions.StatsCollector` when provided. - [Bug #​3114](https://redirect.github.com/google/osv-scanner/pull/3114) Group connected vulnerabilities transitively regardless of the order they are encountered (resolves [#​3107](https://redirect.github.com/google/osv-scanner/issues/3107)). - [Bug #​3147](https://redirect.github.com/google/osv-scanner/pull/3147) Stop treating `upstream` identifiers as aliases when grouping vulnerabilities. - [Bug #​3199](https://redirect.github.com/google/osv-scanner/pull/3199) Sort package vulnerabilities deterministically by ID in output results. - [Bug #​3155](https://redirect.github.com/google/osv-scanner/pull/3155) Print license violations for OS sources without vulnerabilities or deprecations. - [Bug #​3156](https://redirect.github.com/google/osv-scanner/pull/3156) Don't display "No fix available" in table output for packages with license violations and no vulnerabilities. - [Bug #​3169](https://redirect.github.com/google/osv-scanner/pull/3169) Restrict the HTML report server (`--serve`) to bind to the loopback interface (`127.0.0.1`) by default (fixes [#​3165](https://redirect.github.com/google/osv-scanner/issues/3165)). - [Bug #​3213](https://redirect.github.com/google/osv-scanner/pull/3213) Use the correct `IgnoredVulns` key in MCP configuration instructions (resolves [#​3209](https://redirect.github.com/google/osv-scanner/issues/3209)). - [Bug #​3241](https://redirect.github.com/google/osv-scanner/pull/3241) Clarify that `--all-packages` applies to JSON and SBOM output formats (fixes [#​3220](https://redirect.github.com/google/osv-scanner/issues/3220)). - [Bug #​3252](https://redirect.github.com/google/osv-scanner/pull/3252) Reject `--apply-top=0` in `osv-scanner fix` instead of applying all patches (resolves [#​3234](https://redirect.github.com/google/osv-scanner/issues/3234)). - [Bug #​3246](https://redirect.github.com/google/osv-scanner/pull/3246) Update the `osv-scanner-docker` pre-commit hook image to `v2.7.1` (resolves [#​3225](https://redirect.github.com/google/osv-scanner/issues/3225)). - **Fixes via `osv-scalibr`**: - Normalize `NuGet` and `crates.io` package names before comparing in `vulnmatch/osvlocal` ([google/osv-scalibr#2556](https://redirect.github.com/google/osv-scalibr/pull/2556)). - Validate OSV database zip archives before caching and avoid reading the zip archive twice in `vulnmatch/osvlocal` ([google/osv-scalibr#2486](https://redirect.github.com/google/osv-scalibr/pull/2486)). - Continue matching packages across remaining ecosystems in `vulnmatch/osvlocal` when an offline OSV database fails to load for one ecosystem, and return all database load errors joined together ([google/osv-scalibr#2544](https://redirect.github.com/google/osv-scalibr/pull/2544)). - Skip `@patch:` entries in `javascript/yarnlock` so patched packages are not reported twice ([google/osv-scalibr#2498](https://redirect.github.com/google/osv-scalibr/pull/2498)). - Accept string values for `maintainers` and `contributors` fields in `javascript/packagejson` without skipping packages and guard against nil person entries ([google/osv-scalibr#2500](https://redirect.github.com/google/osv-scalibr/pull/2500)). - Read backslash-continued lines iteratively in `python/requirements` ([google/osv-scalibr#2457](https://redirect.github.com/google/osv-scalibr/pull/2457)). - Confine project `.npmrc` reads with `os.OpenRoot`, prevent project `.npmrc` files from overriding `userconfig`, `globalconfig`, or `prefix`, and avoid expanding environment variables from untrusted `.npmrc` files ([google/osv-scalibr#2536](https://redirect.github.com/google/osv-scalibr/pull/2536)). - Migrate `DirFS` and `GetRealPath` to `os.Root`, read `containerd`, `podman`, `gitrepo`, `vmdk`, and `qcow2` inputs via `ScanInput.FS`, and fix `dotnet/pe` temporary file cleanup ([google/osv-scalibr#2538](https://redirect.github.com/google/osv-scalibr/pull/2538), [google/osv-scalibr#2537](https://redirect.github.com/google/osv-scalibr/pull/2537), [google/osv-scalibr#2532](https://redirect.github.com/google/osv-scalibr/pull/2532), [google/osv-scalibr#2533](https://redirect.github.com/google/osv-scalibr/pull/2533)). - Confine archive and filesystem image (`ext4`, `FAT32`, `NTFS`, `exFAT`, `tar`) extraction writes with `os.Root` and bound extracted file sizes in `embeddedfs` ([google/osv-scalibr#2535](https://redirect.github.com/google/osv-scalibr/pull/2535)). ##### Misc: - Update `osv-scalibr` to `v0.5.4-0.20261105012210-c80efcc25cd9` ([#​3232](https://redirect.github.com/google/osv-scanner/pull/3232), [#​3216](https://redirect.github.com/google/osv-scanner/pull/3216), [#​3185](https://redirect.github.com/google/osv-scanner/pull/3185), [#​3192](https://redirect.github.com/google/osv-scanner/pull/3192), [#​3153](https://redirect.github.com/google/osv-scanner/pull/3153)). - Update Go version to 1.27.3 ([#​3152](https://redirect.github.com/google/osv-scanner/pull/3152)). - Switch GoReleaser Docker builds to Buildx (`dockers_v2`) for native multi-arch images and merge GoReleaser Dockerfiles ([#​3132](https://redirect.github.com/google/osv-scanner/pull/3132), [#​3131](https://redirect.github.com/google/osv-scanner/pull/3131)). </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR was generated by [Mend Renovate](https://mend.io/renovate/). View the [repository job log](https://developer.mend.io/github/yokozi-jp/agent-software-factory). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4yMjIuNSIsInVwZGF0ZWRJblZlciI6IjQ0LjIyMi41IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6W119--> Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves #2059
Extracts Go packages from Go workspace files (go.work, go.work.sum), stable since Go 1.18.
The existing go/gomod extractor covers per-module go.mod files; go/gowork covers the workspace-level overlay that overrides the module graph when present.