Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package osv-scanner for openSUSE:Factory checked in at 2026-11-09 16:06:50 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/osv-scanner (Old) and /work/SRC/openSUSE:Factory/.osv-scanner.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "osv-scanner" Mon Nov 9 16:06:50 2026 rev:51 rq:1396241 version:2.7.1 Changes: -------- --- /work/SRC/openSUSE:Factory/osv-scanner/osv-scanner.changes 2026-10-12 22:06:27.521410394 +0200 +++ /work/SRC/openSUSE:Factory/.osv-scanner.new.3759290/osv-scanner.changes 2026-11-09 16:07:41.899493009 +0100 @@ -1,0 +2,116 @@ +Mon Nov 09 05:52:25 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 2.7.1: + * Features: + - Feature #3158 Prefer ecosystem priority (such as Ubuntu + severity) in table output when available (resolves #1275). + - Feature #3178 Add a "Fix available" filter checkbox to HTML + reports (fixes #3016). + - Feature #3173 Warn about unused or expired + [[PackageOverrides]] configuration entries (resolves #3160). + - Feature #3184 Support EffectiveUntil in [[IgnoredVulns]] + configuration entries and deprecate IgnoreUntil. + - Feature #3179 Improve GitHub Actions annotation escaping and + include line numbers so annotations appear directly on files. + - Feature #3159 Support mapping additional ecosystems (Bitnami, + GitHub Actions, Linux, OSS-Fuzz) to PURL types in + osvscanner.json (osv/osvscannerjson) extractor. + - Dependency scanning & lockfile improvements via osv-scalibr: + - Add Echo OS ecosystem mapping (Echo) to the DPKG extractor + (os/dpkg) and Debian version parsing for Echo advisories + (google/osv-scalibr#2453). + - Add line number support to the dotnet/paketlock extractor + (google/osv-scalibr#2561). + - Append base images in the deps.dev baseimage enricher + instead of overwriting pre-existing base image chains + (google/osv-scalibr#2481). + - Support .tgz archive files in embeddedfs/archive + (google/osv-scalibr#2540). + - New extractors and plugin support via osv-scalibr: + - Enable os/ubuntu/binarytosource enricher in the vulns + preset to map Ubuntu binary package names from Chisel + manifests to source package names + (google/osv-scalibr#2482). + - Added extractors for FreeBSD packages (os/freebsd, + google/osv-scalibr#2048), Go workspaces (go/gowork, + google/osv-scalibr#2139), Cabal installed packages + (haskell/cabalconf, google/osv-scalibr#2447), Python + setup.cfg (python/setupcfg, google/osv-scalibr#2369), and + installed R packages (r/rpkg, google/osv-scalibr#2040), + available via --x-plugins (--experimental-plugins). + - Rename haskell/cabal extractor to + haskell/cabalprojectfreeze (google/osv-scalibr#2447) and + chrome/extensions to browser/extensions (with added Edge + and Firefox extension support, google/osv-scalibr#2184). + See "Supported Inventory Types" for extractor names. + * Fixes: + - Bug #3216 Scan npm registry packages with omitted resolved + URLs while skipping local workspace and file:/link: packages + (fixes #2881, #3177, google/osv-scalibr#2560). + - Bug #3214 Reject malformed ar archive member sizes instead of + panicking during --call-analysis=rust scans (fixes #3202). + - Bug #3251 Pass extraction stats to + ScannerActions.StatsCollector when provided. + - Bug #3114 Group connected vulnerabilities transitively + regardless of the order they are encountered (resolves + #3107). + - Bug #3147 Stop treating upstream identifiers as aliases when + grouping vulnerabilities. + - Bug #3199 Sort package vulnerabilities deterministically by + ID in output results. + - Bug #3155 Print license violations for OS sources without + vulnerabilities or deprecations. + - Bug #3156 Don't display "No fix available" in table output + for packages with license violations and no vulnerabilities. + - Bug #3169 Restrict the HTML report server (--serve) to bind + to the loopback interface (127.0.0.1) by default (fixes + #3165). + - Bug #3213 Use the correct IgnoredVulns key in MCP + configuration instructions (resolves #3209). + - Bug #3241 Clarify that --all-packages applies to JSON and + SBOM output formats (fixes #3220). + - Bug #3252 Reject --apply-top=0 in osv-scanner fix instead of + applying all patches (resolves #3234). + - Bug #3246 Update the osv-scanner-docker pre-commit hook image + to v2.7.1 (resolves #3225). + - Fixes via osv-scalibr: + - Normalize NuGet and crates.io package names before + comparing in vulnmatch/osvlocal (google/osv-scalibr#2556). + - Validate OSV database zip archives before caching and avoid + reading the zip archive twice in vulnmatch/osvlocal + (google/osv-scalibr#2486). + - Continue matching packages across remaining ecosystems in + vulnmatch/osvlocal when an offline OSV database fails to + load for one ecosystem, and return all database load errors + joined together (google/osv-scalibr#2544). + - Skip @patch: entries in javascript/yarnlock so patched + packages are not reported twice (google/osv-scalibr#2498). + - Accept string values for maintainers and contributors + fields in javascript/packagejson without skipping packages + and guard against nil person entries + (google/osv-scalibr#2500). + - Read backslash-continued lines iteratively in + python/requirements (google/osv-scalibr#2457). + - Confine project .npmrc reads with os.OpenRoot, prevent + project .npmrc files from overriding userconfig, + globalconfig, or prefix, and avoid expanding environment + variables from untrusted .npmrc files + (google/osv-scalibr#2536). + - Migrate DirFS and GetRealPath to os.Root, read containerd, + podman, gitrepo, vmdk, and qcow2 inputs via ScanInput.FS, + and fix dotnet/pe temporary file cleanup + (google/osv-scalibr#2538, google/osv-scalibr#2537, + google/osv-scalibr#2532, google/osv-scalibr#2533). + - Confine archive and filesystem image (ext4, FAT32, NTFS, + exFAT, tar) extraction writes with os.Root and bound + extracted file sizes in embeddedfs + (google/osv-scalibr#2535). + * Misc: + - Update osv-scalibr to v0.5.4-0.20261105012210-c80efcc25cd9 + (#3232, #3216, #3185, #3192, #3153). + - Update Go version to 1.27.3 (#3152). + - Switch GoReleaser Docker builds to Buildx (dockers_v2) for + native multi-arch images and merge GoReleaser Dockerfiles + (#3132, #3131). + +------------------------------------------------------------------- Old: ---- osv-scanner-2.7.0.obscpio New: ---- osv-scanner-2.7.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ osv-scanner.spec ++++++ --- /var/tmp/diff_new_pack.KnF0bB/_old 2026-11-09 16:07:51.121879306 +0100 +++ /var/tmp/diff_new_pack.KnF0bB/_new 2026-11-09 16:07:51.123879389 +0100 @@ -17,14 +17,14 @@ Name: osv-scanner -Version: 2.7.0 +Version: 2.7.1 Release: 0 Summary: Vulnerability scanner written in Go License: Apache-2.0 URL: https://github.com/google/osv-scanner Source: osv-scanner-%{version}.tar.gz Source1: vendor.tar.gz -BuildRequires: go1.27 >= 1.27.0 +BuildRequires: go1.27 >= 1.27.3 # Build Error # vendor/github.com/google/osv-scalibr/extractor/filesystem/embeddedfs/common/common_linux.go:27:9: ++++++ _service ++++++ --- /var/tmp/diff_new_pack.KnF0bB/_old 2026-11-09 16:07:51.158880856 +0100 +++ /var/tmp/diff_new_pack.KnF0bB/_new 2026-11-09 16:07:51.161880981 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/google/osv-scanner.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v2.7.0</param> + <param name="revision">refs/tags/v2.7.1</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.KnF0bB/_old 2026-11-09 16:07:51.187882070 +0100 +++ /var/tmp/diff_new_pack.KnF0bB/_new 2026-11-09 16:07:51.190882196 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/google/osv-scanner</param> <param name="changesrevision">b56b5191101d5f27d4787d5583d8d01e9518a7af</param></service><service name="tar_scm"> <param name="url">https://github.com/google/osv-scanner.git</param> - <param name="changesrevision">bfe2f84abd2f09fe0b83ba7f6dad40d296762f40</param></service></servicedata> + <param name="changesrevision">02f96a40691c2d155fdda799af436e111231e365</param></service></servicedata> (No newline at EOF) ++++++ osv-scanner-2.7.0.obscpio -> osv-scanner-2.7.1.obscpio ++++++ ++++ 456804 lines of diff (skipped) ++++++ osv-scanner.obsinfo ++++++ --- /var/tmp/diff_new_pack.KnF0bB/_old 2026-11-09 16:07:54.506021057 +0100 +++ /var/tmp/diff_new_pack.KnF0bB/_new 2026-11-09 16:07:54.509021183 +0100 @@ -1,5 +1,5 @@ name: osv-scanner -version: 2.7.0 -mtime: 1791765579 -commit: bfe2f84abd2f09fe0b83ba7f6dad40d296762f40 +version: 2.7.1 +mtime: 1794195580 +commit: 02f96a40691c2d155fdda799af436e111231e365 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/osv-scanner/vendor.tar.gz /work/SRC/openSUSE:Factory/.osv-scanner.new.3759290/vendor.tar.gz differ: char 13, line 1
