From 44ddaee9e64b2b793135e7c50a96dc6bcd2515b9 Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Wed, 10 Jun 2026 22:29:49 +0700 Subject: [PATCH 1/6] cmd/osv-scanner: add E2E test for Mageia ecosystem mapping Add end-to-end test for scanning Mageia 9 container images to verify that the Mageia ecosystem mapping (added in google/osv-scalibr#2199) is correctly exercised by osv-scanner. Changes: - Add test-mageia-9.Dockerfile fixture based on mageia:9 (pinned to sha256:9f7cd063...) which contains bundled Python wheels with known PyPI vulnerabilities - Add TestCommand_OCIImage/Scanning_Mageia_9_image test case in command_test.go to scan the generated Mageia tarball - Add TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image test case for JSON output format validation - Update snapshots and cassettes with successful scan results This follows the same pattern as the AlmaLinux E2E test (google/osv-scanner#2870) as requested by @michaelkedar in google/osv-scalibr#2177. Tested via: make test ACC=true SNAPS=true SHORT=false TestCommand_OCIImage/Scanning_Mageia_9_image passes successfully. --- .../image/__snapshots__/command_test.snap | 122 +++++++++++++++ cmd/osv-scanner/scan/image/command_test.go | 31 +++- .../cassettes/TestCommand_OCIImage.yaml | 146 ++++++++++++++++++ .../TestCommand_OCIImage_JSONFormat.yaml | 146 ++++++++++++++++++ .../image/testdata/test-mageia-9.Dockerfile | 1 + 5 files changed, 444 insertions(+), 2 deletions(-) create mode 100644 cmd/osv-scanner/scan/image/testdata/test-mageia-9.Dockerfile diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap index 42402af15d0..0fb2c0e0720 100755 --- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap @@ -583,6 +583,35 @@ failed to load image from tarball with path "../../testdata/locks-manyoci-image/ --- +[TestCommand_OCIImage/Scanning_Mageia_9_image - 1] +Scanning local image tarball "./testdata/test-mageia-9.tar" + +Total 2 packages affected by 9 known vulnerabilities (0 Critical, 3 High, 5 Medium, 1 Low, 0 Unknown) from 1 ecosystem. +9 vulnerabilities can be fixed. + ++-------------------------------------+------+-----------+------------+---------+---------------+------------------------------------------------------------+ +| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE | ++-------------------------------------+------+-----------+------------+---------+---------------+------------------------------------------------------------+ +| https://osv.dev/PYSEC-2023-228 | 6.8 | PyPI | pip | 23.0.1 | 23.3 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl | +| https://osv.dev/GHSA-mq26-g339-26xf | | | | | | | +| https://osv.dev/PYSEC-2026-196 | 5.5 | PyPI | pip | 23.0.1 | 26.1.2 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl | +| https://osv.dev/GHSA-4xh5-x5gv-qwph | 5.9 | PyPI | pip | 23.0.1 | 25.3 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl | +| https://osv.dev/GHSA-58qw-9mgm-455v | 4.6 | PyPI | pip | 23.0.1 | 26.1 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl | +| https://osv.dev/GHSA-6vgw-5pg2-w6jp | 2.0 | PyPI | pip | 23.0.1 | 26.0 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl | +| https://osv.dev/GHSA-jp4c-xjxw-mgf9 | 5.3 | PyPI | pip | 23.0.1 | 26.1 | usr/share/python-wheels/pip-23.0.1-py3-none-any.whl | +| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 65.5.0 | 65.5.1 | usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl | +| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | | +| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 65.5.0 | 78.1.1 | usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl | +| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | | +| https://osv.dev/GHSA-cx63-2mw6-8hw5 | 8.8 | PyPI | setuptools | 65.5.0 | 70.0.0 | usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl | ++-------------------------------------+------+-----------+------------+---------+---------------+------------------------------------------------------------+ + +--- + +[TestCommand_OCIImage/Scanning_Mageia_9_image - 2] + +--- + [TestCommand_OCIImage/Scanning_Ubuntu_image_with_go_OS_packages_json - 1] Scanning local image tarball "./testdata/test-ubuntu-with-packages.tar" @@ -3432,6 +3461,99 @@ Scanning local image tarball "./testdata/test-chisel.tar" --- +[TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image - 1] +{ + "results": [ + { + "source": { + "path": "/usr/share/python-wheels/pip-23.0.1-py3-none-any.whl", + "type": "artifact" + }, + "packages": [ + { + "package": { + "name": "pip", + "version": "23.0.1", + "ecosystem": "PyPI", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "PYSEC-2023-228", + "PYSEC-2026-196", + "GHSA-4xh5-x5gv-qwph", + "GHSA-58qw-9mgm-455v", + "GHSA-6vgw-5pg2-w6jp", + "GHSA-jp4c-xjxw-mgf9", + "GHSA-mq26-g339-26xf" + ] + } + ] + }, + { + "source": { + "path": "/usr/share/python-wheels/setuptools-65.5.0-py3-none-any.whl", + "type": "artifact" + }, + "packages": [ + { + "package": { + "name": "setuptools", + "version": "65.5.0", + "ecosystem": "PyPI", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "PYSEC-2022-43012", + "PYSEC-2025-49", + "GHSA-5rjg-fvgr-3xxf", + "GHSA-cx63-2mw6-8hw5", + "GHSA-r9hx-vwmv-q579" + ] + } + ] + } + ], + "experimental_config": { + "licenses": { + "summary": false, + "allowlist": null + } + }, + "image_metadata": { + "os": "Mageia 9", + "layer_metadata": [ + { + "diff_id": "sha256:...", + "command": "ADD rootfs.tar.xz / # buildkit", + "is_empty": false, + "base_image_index": 0 + }, + { + "diff_id": "", + "command": "CMD [/"/bin/bash/"]", + "is_empty": true, + "base_image_index": 0 + } + ], + "base_images": [ + {} + ] + } +} + +--- + +[TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image - 2] +Scanning local image tarball "./testdata/test-mageia-9.tar" + +--- + [TestCommand_OCIImage_JSONFormat/scanning_node_modules_using_npm_with_some_packages - 1] { "results": [ diff --git a/cmd/osv-scanner/scan/image/command_test.go b/cmd/osv-scanner/scan/image/command_test.go index 07b8c895ddb..b91cbec2880 100644 --- a/cmd/osv-scanner/scan/image/command_test.go +++ b/cmd/osv-scanner/scan/image/command_test.go @@ -309,8 +309,13 @@ func TestCommand_OCIImage(t *testing.T) { Exit: 1, }, { - Name: "scanning_image_with_go_binary", - Args: []string{"", "image", "--archive", "./testdata/test-package-tracing.tar"}, + Name: "Scanning_AlmaLinux_9_image", + Args: []string{"", "image", "--archive", "./testdata/test-almalinux-9.tar"}, + Exit: 1, + }, + { + Name: "Scanning_Mageia_9_image", + Args: []string{"", "image", "--archive", "./testdata/test-mageia-9.tar"}, Exit: 1, }, { @@ -448,6 +453,28 @@ func TestCommand_OCIImage_JSONFormat(t *testing.T) { testutility.AnyDiffID, }, }, + { + Name: "scanning_almalinux_9_image", + Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-almalinux-9.tar"}, + Exit: 1, + ReplaceRules: []testutility.JSONReplaceRule{ + testutility.GroupsAsArrayLen, + testutility.OnlyIDVulnsRule, + testutility.OnlyFirstBaseImage, + testutility.AnyDiffID, + }, + }, + { + Name: "scanning_mageia_9_image", + Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-mageia-9.tar"}, + Exit: 1, + ReplaceRules: []testutility.JSONReplaceRule{ + testutility.GroupsAsArrayLen, + testutility.OnlyIDVulnsRule, + testutility.OnlyFirstBaseImage, + testutility.AnyDiffID, + }, + }, { // This tests that the fzf go binary is not being reported because it's a OS package Name: "ubuntu_image_with_go_OS_packages_json", diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml index fabd5f39f6a..610b505c7d9 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml @@ -3834,6 +3834,152 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 866 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pygobject" + }, + "version": "3.44.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.18.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "23.0.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.18.2" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "65.5.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "six" + }, + "version": "1.16.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage/Scanning_Mageia_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 873 + body: | + { + "results": [ + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + {} + ] + } + headers: + Content-Length: + - "873" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index b64e77f150c..6280abb5902 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -2773,6 +2773,152 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 866 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pygobject" + }, + "version": "3.44.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.18.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "23.0.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.18.2" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "65.5.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "six" + }, + "version": "1.16.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 873 + body: | + { + "results": [ + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + {} + ] + } + headers: + Content-Length: + - "873" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/cmd/osv-scanner/scan/image/testdata/test-mageia-9.Dockerfile b/cmd/osv-scanner/scan/image/testdata/test-mageia-9.Dockerfile new file mode 100644 index 00000000000..e57cd4d8238 --- /dev/null +++ b/cmd/osv-scanner/scan/image/testdata/test-mageia-9.Dockerfile @@ -0,0 +1 @@ +FROM mageia:9@sha256:9f7cd06391618db304ec968f1610e7128e2d94bea80bcdc141ea55cf88699762 From 47ad52aa52f0c875bbc1be6db3f58a8556fbce06 Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Fri, 26 Jun 2026 17:50:13 +0700 Subject: [PATCH 2/6] cmd/osv-scanner: update cassettes to remove stale entries after rebase --- .../cassettes/TestCommand_OCIImage.yaml | 292 +++++++++--------- .../TestCommand_OCIImage_JSONFormat.yaml | 146 --------- 2 files changed, 146 insertions(+), 292 deletions(-) diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml index 610b505c7d9..856d41ddf2b 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml @@ -3834,152 +3834,6 @@ interactions: status: 200 OK code: 200 duration: 0s - - request: - proto: HTTP/1.1 - proto_major: 1 - proto_minor: 1 - content_length: 866 - host: api.osv.dev - body: | - { - "queries": [ - { - "package": { - "ecosystem": "PyPI", - "name": "pygobject" - }, - "version": "3.44.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "gpg" - }, - "version": "1.18.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "libcomps" - }, - "version": "0.1.18" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "pip" - }, - "version": "23.0.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "rpm" - }, - "version": "4.18.2" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "setuptools" - }, - "version": "65.5.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "six" - }, - "version": "1.16.0" - } - ] - } - headers: - Content-Type: - - application/json - X-Test-Name: - - TestCommand_OCIImage/Scanning_Mageia_9_image - url: https://api.osv.dev/v1/querybatch - method: POST - response: - proto: HTTP/2.0 - proto_major: 2 - proto_minor: 0 - content_length: 873 - body: | - { - "results": [ - {}, - {}, - {}, - { - "vulns": [ - { - "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-03-24T01:43:53.135277Z" - }, - { - "id": "GHSA-58qw-9mgm-455v", - "modified": "2026-05-20T21:00:09.920997Z" - }, - { - "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-03-24T01:43:46.425088Z" - }, - { - "id": "GHSA-jp4c-xjxw-mgf9", - "modified": "2026-05-07T16:59:14.079020Z" - }, - { - "id": "GHSA-mq26-g339-26xf", - "modified": "2026-03-24T01:43:05.410801Z" - }, - { - "id": "PYSEC-2023-228", - "modified": "2026-03-24T01:42:37.905754Z" - }, - { - "id": "PYSEC-2026-196", - "modified": "2026-06-05T12:45:14.124059Z" - } - ] - }, - {}, - { - "vulns": [ - { - "id": "GHSA-5rjg-fvgr-3xxf", - "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-02-04T03:54:02.259111Z" - }, - { - "id": "GHSA-r9hx-vwmv-q579", - "modified": "2026-02-04T03:03:25.892107Z" - }, - { - "id": "PYSEC-2022-43012", - "modified": "2023-12-06T01:02:35.662444Z" - }, - { - "id": "PYSEC-2025-49", - "modified": "2026-05-11T00:26:34.671259Z" - } - ] - }, - {} - ] - } - headers: - Content-Length: - - "873" - Content-Type: - - application/json - status: 200 OK - code: 200 - duration: 0s - request: proto: HTTP/1.1 proto_major: 1 @@ -12688,3 +12542,149 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 866 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pygobject" + }, + "version": "3.44.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.18.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "23.0.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.18.2" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "65.5.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "six" + }, + "version": "1.16.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage/Scanning_Mageia_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 873 + body: | + { + "results": [ + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + {} + ] + } + headers: + Content-Length: + - "873" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index 6280abb5902..b64e77f150c 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -2773,152 +2773,6 @@ interactions: status: 200 OK code: 200 duration: 0s - - request: - proto: HTTP/1.1 - proto_major: 1 - proto_minor: 1 - content_length: 866 - host: api.osv.dev - body: | - { - "queries": [ - { - "package": { - "ecosystem": "PyPI", - "name": "pygobject" - }, - "version": "3.44.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "gpg" - }, - "version": "1.18.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "libcomps" - }, - "version": "0.1.18" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "pip" - }, - "version": "23.0.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "rpm" - }, - "version": "4.18.2" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "setuptools" - }, - "version": "65.5.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "six" - }, - "version": "1.16.0" - } - ] - } - headers: - Content-Type: - - application/json - X-Test-Name: - - TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image - url: https://api.osv.dev/v1/querybatch - method: POST - response: - proto: HTTP/2.0 - proto_major: 2 - proto_minor: 0 - content_length: 873 - body: | - { - "results": [ - {}, - {}, - {}, - { - "vulns": [ - { - "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-03-24T01:43:53.135277Z" - }, - { - "id": "GHSA-58qw-9mgm-455v", - "modified": "2026-05-20T21:00:09.920997Z" - }, - { - "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-03-24T01:43:46.425088Z" - }, - { - "id": "GHSA-jp4c-xjxw-mgf9", - "modified": "2026-05-07T16:59:14.079020Z" - }, - { - "id": "GHSA-mq26-g339-26xf", - "modified": "2026-03-24T01:43:05.410801Z" - }, - { - "id": "PYSEC-2023-228", - "modified": "2026-03-24T01:42:37.905754Z" - }, - { - "id": "PYSEC-2026-196", - "modified": "2026-06-05T12:45:14.124059Z" - } - ] - }, - {}, - { - "vulns": [ - { - "id": "GHSA-5rjg-fvgr-3xxf", - "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-02-04T03:54:02.259111Z" - }, - { - "id": "GHSA-r9hx-vwmv-q579", - "modified": "2026-02-04T03:03:25.892107Z" - }, - { - "id": "PYSEC-2022-43012", - "modified": "2023-12-06T01:02:35.662444Z" - }, - { - "id": "PYSEC-2025-49", - "modified": "2026-05-11T00:26:34.671259Z" - } - ] - }, - {} - ] - } - headers: - Content-Length: - - "873" - Content-Type: - - application/json - status: 200 OK - code: 200 - duration: 0s - request: proto: HTTP/1.1 proto_major: 1 From f8393818712ada0b71e318d77bd965287742379a Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Sat, 27 Jun 2026 01:33:31 +0700 Subject: [PATCH 3/6] cmd/osv-scanner: remove accidentally included AlmaLinux test (belongs in PR #2870) --- cmd/osv-scanner/scan/image/command_test.go | 16 ---------------- 1 file changed, 16 deletions(-) diff --git a/cmd/osv-scanner/scan/image/command_test.go b/cmd/osv-scanner/scan/image/command_test.go index b91cbec2880..2f2559fa60b 100644 --- a/cmd/osv-scanner/scan/image/command_test.go +++ b/cmd/osv-scanner/scan/image/command_test.go @@ -308,11 +308,6 @@ func TestCommand_OCIImage(t *testing.T) { Args: []string{"", "image", "--archive", "./testdata/test-node_modules-pnpm-full.tar"}, Exit: 1, }, - { - Name: "Scanning_AlmaLinux_9_image", - Args: []string{"", "image", "--archive", "./testdata/test-almalinux-9.tar"}, - Exit: 1, - }, { Name: "Scanning_Mageia_9_image", Args: []string{"", "image", "--archive", "./testdata/test-mageia-9.tar"}, @@ -453,17 +448,6 @@ func TestCommand_OCIImage_JSONFormat(t *testing.T) { testutility.AnyDiffID, }, }, - { - Name: "scanning_almalinux_9_image", - Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-almalinux-9.tar"}, - Exit: 1, - ReplaceRules: []testutility.JSONReplaceRule{ - testutility.GroupsAsArrayLen, - testutility.OnlyIDVulnsRule, - testutility.OnlyFirstBaseImage, - testutility.AnyDiffID, - }, - }, { Name: "scanning_mageia_9_image", Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-mageia-9.tar"}, From fb431008bc95ad64bbb31e3ce4bc1867c363453c Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Sat, 27 Jun 2026 02:01:54 +0700 Subject: [PATCH 4/6] cmd/osv-scanner: add Mageia cassette entries for JSONFormat test --- .../TestCommand_OCIImage_JSONFormat.yaml | 146 ++++++++++++++++++ 1 file changed, 146 insertions(+) diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index b64e77f150c..83a64686b1e 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -6283,3 +6283,149 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 866 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pygobject" + }, + "version": "3.44.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.18.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "23.0.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.18.2" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "65.5.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "six" + }, + "version": "1.16.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 873 + body: | + { + "results": [ + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + {} + ] + } + headers: + Content-Length: + - "873" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s From 7ab2a4795bdd217b16dc6aa30ffb2a27460ef6d2 Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Thu, 2 Jul 2026 22:27:55 +0700 Subject: [PATCH 5/6] cmd/osv-scanner: fix Mageia cassette - add missing PyPI query interactions --- .../cassettes/TestCommand_OCIImage.yaml | 292 +++++++++--------- 1 file changed, 146 insertions(+), 146 deletions(-) diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml index 856d41ddf2b..610b505c7d9 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml @@ -3834,6 +3834,152 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 866 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pygobject" + }, + "version": "3.44.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.18.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "23.0.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.18.2" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "65.5.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "six" + }, + "version": "1.16.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage/Scanning_Mageia_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 873 + body: | + { + "results": [ + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + {} + ] + } + headers: + Content-Length: + - "873" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 @@ -12542,149 +12688,3 @@ interactions: status: 200 OK code: 200 duration: 0s - - request: - proto: HTTP/1.1 - proto_major: 1 - proto_minor: 1 - content_length: 866 - host: api.osv.dev - body: | - { - "queries": [ - { - "package": { - "ecosystem": "PyPI", - "name": "pygobject" - }, - "version": "3.44.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "gpg" - }, - "version": "1.18.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "libcomps" - }, - "version": "0.1.18" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "pip" - }, - "version": "23.0.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "rpm" - }, - "version": "4.18.2" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "setuptools" - }, - "version": "65.5.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "six" - }, - "version": "1.16.0" - } - ] - } - headers: - Content-Type: - - application/json - X-Test-Name: - - TestCommand_OCIImage/Scanning_Mageia_9_image - url: https://api.osv.dev/v1/querybatch - method: POST - response: - proto: HTTP/2.0 - proto_major: 2 - proto_minor: 0 - content_length: 873 - body: | - { - "results": [ - {}, - {}, - {}, - { - "vulns": [ - { - "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-03-24T01:43:53.135277Z" - }, - { - "id": "GHSA-58qw-9mgm-455v", - "modified": "2026-05-20T21:00:09.920997Z" - }, - { - "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-03-24T01:43:46.425088Z" - }, - { - "id": "GHSA-jp4c-xjxw-mgf9", - "modified": "2026-05-07T16:59:14.079020Z" - }, - { - "id": "GHSA-mq26-g339-26xf", - "modified": "2026-03-24T01:43:05.410801Z" - }, - { - "id": "PYSEC-2023-228", - "modified": "2026-03-24T01:42:37.905754Z" - }, - { - "id": "PYSEC-2026-196", - "modified": "2026-06-05T12:45:14.124059Z" - } - ] - }, - {}, - { - "vulns": [ - { - "id": "GHSA-5rjg-fvgr-3xxf", - "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-02-04T03:54:02.259111Z" - }, - { - "id": "GHSA-r9hx-vwmv-q579", - "modified": "2026-02-04T03:03:25.892107Z" - }, - { - "id": "PYSEC-2022-43012", - "modified": "2023-12-06T01:02:35.662444Z" - }, - { - "id": "PYSEC-2025-49", - "modified": "2026-05-11T00:26:34.671259Z" - } - ] - }, - {} - ] - } - headers: - Content-Length: - - "873" - Content-Type: - - application/json - status: 200 OK - code: 200 - duration: 0s From af567ebb4547d037df603669dd816fa9e3961f8d Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Mon, 13 Jul 2026 19:44:29 +0700 Subject: [PATCH 6/6] fix: update Mageia snapshot and bump osv-scalibr to detect Mageia base image - Bump github.com/google/osv-scalibr to v0.4.6-0.20260713000915-500ad84f4ed1 which includes the Mageia ecosystem mapping fix (google/osv-scalibr#2199) - Update TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image snapshot to reflect that the Mageia base image is now correctly detected (base_image_index updated, 'mageia' added to base_images list) - Update TestCommand_OCIImage_JSONFormat cassette with new API interaction order Fixes snapshot mismatch that caused CI failures on all platforms. --- .../image/__snapshots__/command_test.snap | 10 +- .../TestCommand_OCIImage_JSONFormat.yaml | 292 +++++++++--------- go.mod | 3 +- go.sum | 4 +- 4 files changed, 156 insertions(+), 153 deletions(-) diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap index 0fb2c0e0720..d9840cc05a5 100755 --- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap @@ -3532,17 +3532,21 @@ Scanning local image tarball "./testdata/test-chisel.tar" "diff_id": "sha256:...", "command": "ADD rootfs.tar.xz / # buildkit", "is_empty": false, - "base_image_index": 0 + "base_image_index": 1 }, { "diff_id": "", "command": "CMD [/"/bin/bash/"]", "is_empty": true, - "base_image_index": 0 + "base_image_index": 1 } ], "base_images": [ - {} + {}, + { + "name": "mageia", + "tags": null + } ] } } diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index 83a64686b1e..6280abb5902 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -2773,6 +2773,152 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 866 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "pygobject" + }, + "version": "3.44.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.18.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "23.0.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.18.2" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "65.5.0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "six" + }, + "version": "1.16.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 873 + body: | + { + "results": [ + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + }, + {} + ] + } + headers: + Content-Length: + - "873" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 @@ -6283,149 +6429,3 @@ interactions: status: 200 OK code: 200 duration: 0s - - request: - proto: HTTP/1.1 - proto_major: 1 - proto_minor: 1 - content_length: 866 - host: api.osv.dev - body: | - { - "queries": [ - { - "package": { - "ecosystem": "PyPI", - "name": "pygobject" - }, - "version": "3.44.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "gpg" - }, - "version": "1.18.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "libcomps" - }, - "version": "0.1.18" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "pip" - }, - "version": "23.0.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "rpm" - }, - "version": "4.18.2" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "setuptools" - }, - "version": "65.5.0" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "six" - }, - "version": "1.16.0" - } - ] - } - headers: - Content-Type: - - application/json - X-Test-Name: - - TestCommand_OCIImage_JSONFormat/scanning_mageia_9_image - url: https://api.osv.dev/v1/querybatch - method: POST - response: - proto: HTTP/2.0 - proto_major: 2 - proto_minor: 0 - content_length: 873 - body: | - { - "results": [ - {}, - {}, - {}, - { - "vulns": [ - { - "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-03-24T01:43:53.135277Z" - }, - { - "id": "GHSA-58qw-9mgm-455v", - "modified": "2026-05-20T21:00:09.920997Z" - }, - { - "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-03-24T01:43:46.425088Z" - }, - { - "id": "GHSA-jp4c-xjxw-mgf9", - "modified": "2026-05-07T16:59:14.079020Z" - }, - { - "id": "GHSA-mq26-g339-26xf", - "modified": "2026-03-24T01:43:05.410801Z" - }, - { - "id": "PYSEC-2023-228", - "modified": "2026-03-24T01:42:37.905754Z" - }, - { - "id": "PYSEC-2026-196", - "modified": "2026-06-05T12:45:14.124059Z" - } - ] - }, - {}, - { - "vulns": [ - { - "id": "GHSA-5rjg-fvgr-3xxf", - "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-02-04T03:54:02.259111Z" - }, - { - "id": "GHSA-r9hx-vwmv-q579", - "modified": "2026-02-04T03:03:25.892107Z" - }, - { - "id": "PYSEC-2022-43012", - "modified": "2023-12-06T01:02:35.662444Z" - }, - { - "id": "PYSEC-2025-49", - "modified": "2026-05-11T00:26:34.671259Z" - } - ] - }, - {} - ] - } - headers: - Content-Length: - - "873" - Content-Type: - - application/json - status: 200 OK - code: 200 - duration: 0s diff --git a/go.mod b/go.mod index bd251985178..6fc3ef50525 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/go-git/go-git/v5 v5.19.1 github.com/gobwas/glob v0.2.3 github.com/google/go-cmp v0.7.0 - github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e + github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1 github.com/ianlancetaylor/demangle v0.0.0-20260505044615-1ff4bf46051f github.com/jedib0t/go-pretty/v6 v6.7.10 github.com/modelcontextprotocol/go-sdk v1.6.1 @@ -214,4 +214,3 @@ require ( www.velocidex.com/golang/go-ntfs v0.2.0 // indirect www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 // indirect ) - diff --git a/go.sum b/go.sum index 011959e3f7e..333924428fd 100644 --- a/go.sum +++ b/go.sum @@ -247,8 +247,8 @@ github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEE github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y= github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0= github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE= -github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e h1:cQTtydMwNMniteU1xth8JECOBS6vtw0FIjZVZUAqAJo= -github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= +github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1 h1:yHo18phm3Xy56T1ngXgNqCMJR7uFWVWrnWyvTbzD+Ak= +github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=