Watch

chore(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.3.8 to 2.5.0 #146

Merged

dependabot[bot] merged 1 commit from dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-2.5.0 into main

2026-08-16 18:57:29 -05:00

dependabot[bot] commented

2026-08-10 04:22:36 -05:00

(Migrated from github.com)

Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 2.3.8 to 2.5.0.

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases.

v2.5.0

This updates OSV-Scanner to v2.5.0 as well as:

What's Changed

feat: gate reusable workflow outputs with a flag by @another-rex in google/osv-scanner-action#130

Pin download-artifact action to SHA by @SVilgelm in google/osv-scanner-action#127

feat: add runs-on input to reusable workflows by @BeyondEvil in google/osv-scanner-action#131

fix: address zizmor warnings by @another-rex in google/osv-scanner-action#135

fix: add GOTOOLCHAIN=auto env to osv-scanner calls by @another-rex in google/osv-scanner-action#138

New Contributors

@SVilgelm made their first contribution in google/osv-scanner-action#127

@BeyondEvil made their first contribution in google/osv-scanner-action#131

Full Changelog: https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0

Commits

8deb546 Merge pull request #140 from google/update-to-v2.5.0
8fb3f8c Update unified workflow example to point to v2.5.0 reusable workflows
0c58c54 Update reusable workflows to point to v2.5.0 actions
06b2ab4 "Update actions to use v2.5.0 osv-scanner image"
9fd1bcc Merge pull request #138 from google/fix/gotoolchain-auto
01a87d5 fix: add GOTOOLCHAIN=auto env to osv-scanner calls
a82132c Merge pull request #135 from google/fix-zizmor-excessive-permissions
272ff57 fix: address zizmor template injection warnings
10621fb refactor: move permissions to job level to satisfy zizmor
fa4ff67 Merge pull request #131 from BeyondEvil/feat/add-runs-on-input
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) from 2.3.8 to 2.5.0. <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/google/osv-scanner-action/releases">google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases</a>.</em></p> <blockquote> <h2>v2.5.0</h2> <p>This updates OSV-Scanner to v2.5.0 as well as:</p> <h2>What's Changed</h2> <ul> <li>feat: gate reusable workflow outputs with a flag by <a href="https://github.com/another-rex"><code>@another-rex</code></a> in <a href="https://redirect.github.com/google/osv-scanner-action/pull/130">google/osv-scanner-action#130</a></li> <li>Pin download-artifact action to SHA by <a href="https://github.com/SVilgelm"><code>@SVilgelm</code></a> in <a href="https://redirect.github.com/google/osv-scanner-action/pull/127">google/osv-scanner-action#127</a></li> <li>feat: add runs-on input to reusable workflows by <a href="https://github.com/BeyondEvil"><code>@BeyondEvil</code></a> in <a href="https://redirect.github.com/google/osv-scanner-action/pull/131">google/osv-scanner-action#131</a></li> <li>fix: address zizmor warnings by <a href="https://github.com/another-rex"><code>@another-rex</code></a> in <a href="https://redirect.github.com/google/osv-scanner-action/pull/135">google/osv-scanner-action#135</a></li> <li>fix: add GOTOOLCHAIN=auto env to osv-scanner calls by <a href="https://github.com/another-rex"><code>@another-rex</code></a> in <a href="https://redirect.github.com/google/osv-scanner-action/pull/138">google/osv-scanner-action#138</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/SVilgelm"><code>@SVilgelm</code></a> made their first contribution in <a href="https://redirect.github.com/google/osv-scanner-action/pull/127">google/osv-scanner-action#127</a></li> <li><a href="https://github.com/BeyondEvil"><code>@BeyondEvil</code></a> made their first contribution in <a href="https://redirect.github.com/google/osv-scanner-action/pull/131">google/osv-scanner-action#131</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0">https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/google/osv-scanner-action/commit/8deb546fdb875b9996d27d4950be7312dac076a1"><code>8deb546</code></a> Merge pull request <a href="https://redirect.github.com/google/osv-scanner-action/issues/140">#140</a> from google/update-to-v2.5.0</li> <li><a href="https://github.com/google/osv-scanner-action/commit/8fb3f8c89519ea2c868d3277441ee7fd3c7f15af"><code>8fb3f8c</code></a> Update unified workflow example to point to v2.5.0 reusable workflows</li> <li><a href="https://github.com/google/osv-scanner-action/commit/0c58c542420dfd23fcac08dd9c8ca3cca9c36f1a"><code>0c58c54</code></a> Update reusable workflows to point to v2.5.0 actions</li> <li><a href="https://github.com/google/osv-scanner-action/commit/06b2ab4348248b456ee06c9e953637f55e03504f"><code>06b2ab4</code></a> "Update actions to use v2.5.0 osv-scanner image"</li> <li><a href="https://github.com/google/osv-scanner-action/commit/9fd1bcce27f67e3bd819a0a7620e332803dc43bc"><code>9fd1bcc</code></a> Merge pull request <a href="https://redirect.github.com/google/osv-scanner-action/issues/138">#138</a> from google/fix/gotoolchain-auto</li> <li><a href="https://github.com/google/osv-scanner-action/commit/01a87d56220b68b35ceebc4a7a3f3de666173da6"><code>01a87d5</code></a> fix: add GOTOOLCHAIN=auto env to osv-scanner calls</li> <li><a href="https://github.com/google/osv-scanner-action/commit/a82132c0bd6c7261ffcb78e754c46c70ab57ad9a"><code>a82132c</code></a> Merge pull request <a href="https://redirect.github.com/google/osv-scanner-action/issues/135">#135</a> from google/fix-zizmor-excessive-permissions</li> <li><a href="https://github.com/google/osv-scanner-action/commit/272ff57b30ae5bef2488ba122ab6852c0d735a2d"><code>272ff57</code></a> fix: address zizmor template injection warnings</li> <li><a href="https://github.com/google/osv-scanner-action/commit/10621fba4fb802e4fbe82d664deb6d5c44d233d5"><code>10621fb</code></a> refactor: move permissions to job level to satisfy zizmor</li> <li><a href="https://github.com/google/osv-scanner-action/commit/fa4ff678dd5d0a4fa3d628e57af8162873e93cd6"><code>fa4ff67</code></a> Merge pull request <a href="https://redirect.github.com/google/osv-scanner-action/issues/131">#131</a> from BeyondEvil/feat/add-runs-on-input</li> <li>Additional commits viewable in <a href="https://github.com/google/osv-scanner-action/compare/v2.3.8...v2.5.0">compare view</a></li> </ul> </details> <br /> [![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml&package-manager=github_actions&previous-version=2.3.8&new-version=2.5.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores) Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) </details>

Gitchegumi (Migrated from github.com) approved these changes

2026-08-16 18:57:23 -05:00

No reviewers

Gitchegumi

No milestone

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

gitchegumi/GitchAlerts!146

No description provided.

Rows
Columns