Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package osv-scanner for openSUSE:Factory checked in at 2026-10-12 22:06:10 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/osv-scanner (Old) and /work/SRC/openSUSE:Factory/.osv-scanner.new.3698736 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "osv-scanner" Mon Oct 12 22:06:10 2026 rev:50 rq:1384148 version:2.7.0 Changes: -------- --- /work/SRC/openSUSE:Factory/osv-scanner/osv-scanner.changes 2026-09-19 22:22:15.464395346 +0200 +++ /work/SRC/openSUSE:Factory/.osv-scanner.new.3698736/osv-scanner.changes 2026-10-12 22:06:27.521410394 +0200 @@ -1,0 +2,85 @@ +Mon Oct 12 04:48:13 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 2.7.0: + * Features: + - Feature #2885 Include package URLs (purl) in JSON output when + available. + - Feature #2589 Add shorter --x- flag aliases and deprecate + --experimental- flags. + - Feature #3113 Include vulnerability severity and rating in + CycloneDX output when available. + - Feature #3102 Enable Dart package_config.json + (dart/packageconfig) extractor by default for lockfile scans + (google/osv-scalibr#2295). + - Dependency scanning & lockfile improvements via osv-scalibr: + - Add best-effort Maven property pre-interpolation for + dependency versions and in-memory caching for Maven + resolution. + - Support scanning Bitnami container SPDX SBOMs (sbom/spdx) + (google/osv-scalibr#2156). + - Add MinimOS ecosystem mapping to the APK extractor (os/apk) + (google/osv-scalibr#2406). + - Apply --max-file-size limit to container image contents and + tag container image layers with Buildpacks lifecycle + metadata. + - New extractors and plugin support via osv-scalibr: + - Added zig/buildzigzon (build.zig.zon, + google/osv-scalibr#1841), available via --x-plugins + (--experimental-plugins). See "Supported Inventory Types" + for the extractor name. + * Fixes: + - Bug #3137 Delegate package normalization to osv-scalibr's + osvutil to preserve Maven group IDs in CycloneDX SBOMs so + fixed versions are properly reported (fixes #3099). + - Bug #3135 Prevent network-requiring plugins (such as base + image enrichment) from running when --offline is combined + with --download-offline-databases. + - Bug #3134 Preserve call analysis information when diffing + vulnerability results. + - Bug #3121 Wrap [[PackageOverrides]] ecosystem suffix + alternatives in a non-capturing group so Ecosystem regex + matching applies correctly to all variants (fixes #3120). + - Bug #3103 Sort packages by location before applying config + annotations for deterministic log output order during + recursive scans. + - Bug #3087 Group output packages by exact ecosystem name to + prevent duplicate entries when ecosystems share a prefix + (e.g. Alpine and Alpine:v3.18) (fixes #3086). + - Fixes via osv-scalibr: + - Skip OSV queries for local npm packages (file:, workspace, + and local tarballs) and avoid extracting bogus versions or + commits for file: and URL-based dependencies in bun.lock + (google/osv-scalibr#2443, google/osv-scalibr#2444). + - Restrict #commit fragment extraction in JS lockfiles to + Git-based dependency resolutions (google/osv-scalibr#2448). + - Prevent slice-bounds panic in javascript/pnpmlock on + malformed scoped dependency paths + (google/osv-scalibr#2263). + - Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage + OSV ecosystem mapping for Haskell (cabal and + stack.yaml.lock) extractors (google/osv-scalibr#2419). + - Match Python setup.py package names containing -, ., and _ + (google/osv-scalibr#2162). + - Reject invalid ZIP64 sizes and bound metadata reads in + python/wheelegg (google/osv-scalibr#2012). + - Confine Maven registry disk cache writes with os.Root to + prevent path traversal (google/osv-scalibr#2398). + - Compare PURL namespaces case-insensitively during OSV + vulnerability matching (e.g. for Go modules with uppercase + characters) (google/osv-scalibr#2456). + - Skip advisory affected entries with unrecognized ecosystems + in local OSV matcher instead of aborting matching for the + advisory (google/osv-scalibr#2429). + - Fix WordPress plugin name extraction from directory name + and restrict scanning to immediate subdirectories of + wp-content/plugins (google/osv-scalibr#2424, + google/osv-scalibr#2445). + - Fix 32-bit statfs block size overflow when checking + filesystem types on 32-bit architectures + (google/osv-scalibr#2439). + * Misc: + - Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 + (#3123, #3089, #3137). + - Remove unused root Dockerfile (#3130). + +------------------------------------------------------------------- Old: ---- osv-scanner-2.6.0.obscpio New: ---- osv-scanner-2.7.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ osv-scanner.spec ++++++ --- /var/tmp/diff_new_pack.1lGuZO/_old 2026-10-12 22:06:29.688500941 +0200 +++ /var/tmp/diff_new_pack.1lGuZO/_new 2026-10-12 22:06:29.690501024 +0200 @@ -17,7 +17,7 @@ Name: osv-scanner -Version: 2.6.0 +Version: 2.7.0 Release: 0 Summary: Vulnerability scanner written in Go License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.1lGuZO/_old 2026-10-12 22:06:29.727502570 +0200 +++ /var/tmp/diff_new_pack.1lGuZO/_new 2026-10-12 22:06:29.731502737 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/google/osv-scanner.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v2.6.0</param> + <param name="revision">refs/tags/v2.7.0</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.1lGuZO/_old 2026-10-12 22:06:29.760503949 +0200 +++ /var/tmp/diff_new_pack.1lGuZO/_new 2026-10-12 22:06:29.763504074 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/google/osv-scanner</param> <param name="changesrevision">b56b5191101d5f27d4787d5583d8d01e9518a7af</param></service><service name="tar_scm"> <param name="url">https://github.com/google/osv-scanner.git</param> - <param name="changesrevision">e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6</param></service></servicedata> + <param name="changesrevision">bfe2f84abd2f09fe0b83ba7f6dad40d296762f40</param></service></servicedata> (No newline at EOF) ++++++ osv-scanner-2.6.0.obscpio -> osv-scanner-2.7.0.obscpio ++++++ ++++ 945905 lines of diff (skipped) ++++++ osv-scanner.obsinfo ++++++ --- /var/tmp/diff_new_pack.1lGuZO/_old 2026-10-12 22:06:31.590580414 +0200 +++ /var/tmp/diff_new_pack.1lGuZO/_new 2026-10-12 22:06:31.595580623 +0200 @@ -1,5 +1,5 @@ name: osv-scanner -version: 2.6.0 -mtime: 1789350298 -commit: e840a6e8adb14b7777c78e26cfbf6e2abc1d1fc6 +version: 2.7.0 +mtime: 1791765579 +commit: bfe2f84abd2f09fe0b83ba7f6dad40d296762f40 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/osv-scanner/vendor.tar.gz /work/SRC/openSUSE:Factory/.osv-scanner.new.3698736/vendor.tar.gz differ: char 90, line 1
