From 3d4b87cc4c555ff18f5826ca56fa0079524eb8f5 Mon Sep 17 00:00:00 2001 From: Vu Anh Phung Date: Thu, 29 Oct 2026 19:20:24 +0000 Subject: [PATCH] ci: update OSV-Scanner to v2.7.0 Signed-off-by: Vu Anh Phung --- .github/workflows/securityScan.yml | 6 +++--- osv-scanner.toml | 4 ++-- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/securityScan.yml b/.github/workflows/securityScan.yml index 561e99ce..8cbd5562 100644 --- a/.github/workflows/securityScan.yml +++ b/.github/workflows/securityScan.yml @@ -17,7 +17,7 @@ name: Security Scan # # - workflow_dispatch: behaves like the cron run (full reporting). # -# Scanner: OSV-Scanner v2.3.8 (purl-based via OSV.dev; federates GHSA, +# Scanner: OSV-Scanner v2.7.0 (purl-based via OSV.dev; federates GHSA, # NVD, npm advisory DB, RustSec, Go vuln DB, PyPA). Reads # `package-lock.json` natively -- no separate SBOM tool needed. # @@ -27,7 +27,7 @@ name: Security Scan # justification ("dev-only, not shipped in dist/"). # # Suppressions live in `osv-scanner.toml` as [[IgnoredVulns]] entries -# (CVE-id global; OSV-Scanner v2.3.8 doesn't support per-package CVE +# (CVE-id global; OSV-Scanner v2.7.0 doesn't support per-package CVE # scoping). Each entry has a justification comment and an `ignoreUntil` # expiry so suppressions re-surface for re-review rather than lingering. @@ -67,7 +67,7 @@ jobs: run: | set -euo pipefail curl -fsSL -o /tmp/osv-scanner \ - https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 + https://github.com/google/osv-scanner/releases/download/v2.7.0/osv-scanner_linux_amd64 chmod +x /tmp/osv-scanner /tmp/osv-scanner --version diff --git a/osv-scanner.toml b/osv-scanner.toml index a2e28b5d..aa230777 100644 --- a/osv-scanner.toml +++ b/osv-scanner.toml @@ -9,7 +9,7 @@ # just the artifact we have in mind. The alternative # ([[PackageOverrides]] with `vulnerability.ignore = true`) is # per-package but blanket-ignores ALL vulnerabilities on that package, -# which is much worse. OSV-Scanner v2.3.8 does NOT support an +# which is much worse. OSV-Scanner v2.7.0 does NOT support an # intersection ("this CVE on this package only"). # # See google.github.io/osv-scanner/configuration/ for the schema. @@ -17,7 +17,7 @@ # CONVENTION: use suppressions sparingly, only with a strong reason # (unreachable code path + no fix available, or dev-only + not shipped). # EVERY [[IgnoredVulns]] entry MUST set `ignoreUntil = YYYY-MM-DD` -# (~6 months out). OSV-Scanner v2.3.8 honors it natively; when it lapses +# (~6 months out). OSV-Scanner v2.7.0 honors it natively; when it lapses # the finding re-surfaces, forcing a re-review instead of a permanent # silent ignore. #