[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
osv-scanner	v2.6.0 → v2.7.0

---

Release Notes

google/osv-scanner (osv-scanner)

v2.7.0

Compare Source

Features:

• Feature #​2885 Include package URLs (purl) in JSON output when available.
• Feature #​2589 Add shorter --x- flag aliases and deprecate --experimental- flags.
• Feature #​3113 Include vulnerability severity and rating in CycloneDX output when available.
• Feature #​3102 Enable Dart package_config.json (dart/packageconfig) extractor by default for lockfile scans (google/osv-scalibr#2295).
• Dependency scanning & lockfile improvements via osv-scalibr:
  • Add best-effort Maven property pre-interpolation for dependency versions and in-memory caching for Maven resolution.
  • Support scanning Bitnami container SPDX SBOMs (sbom/spdx) (google/osv-scalibr#2156).
  • Add MinimOS ecosystem mapping to the APK extractor (os/apk) (google/osv-scalibr#2406).
  • Apply --max-file-size limit to container image contents and tag container image layers with Buildpacks lifecycle metadata.
• New extractors and plugin support via osv-scalibr:
  • Added zig/buildzigzon (build.zig.zon, google/osv-scalibr#1841), available via --x-plugins (--experimental-plugins). See "Supported Inventory Types" for the extractor name.

Fixes:

• Bug #​3137 Delegate package normalization to osv-scalibr's osvutil to preserve Maven group IDs in CycloneDX SBOMs so fixed versions are properly reported (fixes #​3099).
• Bug #​3135 Prevent network-requiring plugins (such as base image enrichment) from running when --offline is combined with --download-offline-databases.
• Bug #​3134 Preserve call analysis information when diffing vulnerability results.
• Bug #​3121 Wrap [[PackageOverrides]] ecosystem suffix alternatives in a non-capturing group so Ecosystem regex matching applies correctly to all variants (fixes #​3120).
• Bug #​3103 Sort packages by location before applying config annotations for deterministic log output order during recursive scans.
• Bug #​3087 Group output packages by exact ecosystem name to prevent duplicate entries when ecosystems share a prefix (e.g. Alpine and Alpine:v3.18) (fixes #​3086).
• Fixes via osv-scalibr:
  • Skip OSV queries for local npm packages (file:, workspace, and local tarballs) and avoid extracting bogus versions or commits for file: and URL-based dependencies in bun.lock (google/osv-scalibr#2443, google/osv-scalibr#2444).
  • Restrict #commit fragment extraction in JS lockfiles to Git-based dependency resolutions (google/osv-scalibr#2448).
  • Prevent slice-bounds panic in javascript/pnpmlock on malformed scoped dependency paths (google/osv-scalibr#2263).
  • Emit valid Hackage PURLs (pkg:hackage/...) and add Hackage OSV ecosystem mapping for Haskell (cabal and stack.yaml.lock) extractors (google/osv-scalibr#2419).
  • Match Python setup.py package names containing -, ., and _ (google/osv-scalibr#2162).
  • Reject invalid ZIP64 sizes and bound metadata reads in python/wheelegg (google/osv-scalibr#2012).
  • Confine Maven registry disk cache writes with os.Root to prevent path traversal (google/osv-scalibr#2398).
  • Compare PURL namespaces case-insensitively during OSV vulnerability matching (e.g. for Go modules with uppercase characters) (google/osv-scalibr#2456).
  • Skip advisory affected entries with unrecognized ecosystems in local OSV matcher instead of aborting matching for the advisory (google/osv-scalibr#2429).
  • Fix WordPress plugin name extraction from directory name and restrict scanning to immediate subdirectories of wp-content/plugins (google/osv-scalibr#2424, google/osv-scalibr#2445).
  • Fix 32-bit statfs block size overflow when checking filesystem types on 32-bit architectures (google/osv-scalibr#2439).

Misc:

• Update osv-scalibr to v0.5.4-0.20261009010329-5be78a00e3c2 (#​3123, #​3089, #​3137).
• Remove unused root Dockerfile (#​3130).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: fccbfbad-ec2a-4d31-ba27-cdf90fc194f3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}