Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package osv-scanner for openSUSE:Factory checked in at 2026-08-09 21:37:33 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/osv-scanner (Old) and /work/SRC/openSUSE:Factory/.osv-scanner.new.16738 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "osv-scanner" Sun Aug 9 21:37:33 2026 rev:47 rq:1370174 version:2.5.0 Changes: -------- --- /work/SRC/openSUSE:Factory/osv-scanner/osv-scanner.changes 2026-06-19 17:19:59.231215381 +0200 +++ /work/SRC/openSUSE:Factory/.osv-scanner.new.16738/osv-scanner.changes 2026-08-09 21:39:51.655502734 +0200 @@ -1,0 +2,36 @@ +Fri Aug 07 06:17:59 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 2.5.0: + * Features & Refactors: + - Full OSV-Scalibr pipeline: Migrated scanning, filtering, and + matching in osv-scanner to use osv-scalibr end-to-end, so + most plugins that's supported in osv-scalibr should be + supported via the --experimental-plugins flag (#2935). + - New extractors and ecosystem support via osv-scalibr: + - Add javascript/vsix extractor to support scanning VS Code + extension (.vsix) packages. + - Extend ecosystem mapping for: + - SUSE + - Azure Linux / Mariner + - Alpaquita + - Mageia + - openSUSE Leap + - Debian and Ubuntu PURL + - PURL Type Resolution: Updated osvscannerjson extractor to map + ecosystem names to valid PURL types (golang, gem, cargo, npm, + etc.). + * Fixes: + - Bug #2915 Fix issue where osv-scanner reported already-fixed + advisories as unfixed for RHEL-family RPM packages (Red Hat, + AlmaLinux, Rocky Linux) with epochs by sending + epoch-qualified versions. + - Fix Python requirements.txt extractor in osv-scalibr, + specifically regular expressions used to extract package + names and per-requirement options (Fixes #2940, #2931) + - Fix NPM and Composer PURL generation in osv-scalibr, + separating package namespace (scope) from package name + * Dependencies + - build(deps): bump faraday from 2.14.2 to 2.14.3 in /docs in + the bundler group across 1 directory (#2900) + +------------------------------------------------------------------- Old: ---- osv-scanner-2.4.0.obscpio New: ---- osv-scanner-2.5.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ osv-scanner.spec ++++++ --- /var/tmp/diff_new_pack.GkWbMw/_old 2026-08-09 21:39:54.503599990 +0200 +++ /var/tmp/diff_new_pack.GkWbMw/_new 2026-08-09 21:39:54.503599990 +0200 @@ -17,7 +17,7 @@ Name: osv-scanner -Version: 2.4.0 +Version: 2.5.0 Release: 0 Summary: Vulnerability scanner written in Go License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.GkWbMw/_old 2026-08-09 21:39:54.543601356 +0200 +++ /var/tmp/diff_new_pack.GkWbMw/_new 2026-08-09 21:39:54.547601493 +0200 @@ -1,9 +1,9 @@ <services> <service name="obs_scm" mode="manual"> - <param name="url">https://github.com/google/osv-scanner</param> + <param name="url">https://github.com/google/osv-scanner.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v2.4.0</param> + <param name="revision">refs/tags/v2.5.0</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.GkWbMw/_old 2026-08-09 21:39:54.571602312 +0200 +++ /var/tmp/diff_new_pack.GkWbMw/_new 2026-08-09 21:39:54.575602449 +0200 @@ -1,6 +1,8 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/google/osv-scanner</param> - <param name="changesrevision">b56b5191101d5f27d4787d5583d8d01e9518a7af</param></service></servicedata> + <param name="changesrevision">b56b5191101d5f27d4787d5583d8d01e9518a7af</param></service><service name="tar_scm"> + <param name="url">https://github.com/google/osv-scanner.git</param> + <param name="changesrevision">a258868211a57052da6bd323f758b8388dee02bb</param></service></servicedata> (No newline at EOF) ++++++ osv-scanner-2.4.0.obscpio -> osv-scanner-2.5.0.obscpio ++++++ ++++ 118492 lines of diff (skipped) ++++++ osv-scanner.obsinfo ++++++ --- /var/tmp/diff_new_pack.GkWbMw/_old 2026-08-09 21:39:56.043652580 +0200 +++ /var/tmp/diff_new_pack.GkWbMw/_new 2026-08-09 21:39:56.047652716 +0200 @@ -1,5 +1,5 @@ name: osv-scanner -version: 2.4.0 -mtime: 1781787327 -commit: b56b5191101d5f27d4787d5583d8d01e9518a7af +version: 2.5.0 +mtime: 1786074584 +commit: a258868211a57052da6bd323f758b8388dee02bb ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/osv-scanner/vendor.tar.gz /work/SRC/openSUSE:Factory/.osv-scanner.new.16738/vendor.tar.gz differ: char 110, line 1
