From 3ca812f215b8eadf140d5e5f0ec8026d635cb6f4 Mon Sep 17 00:00:00 2001 From: Jess Lowe Date: Tue, 21 Jul 2026 01:14:10 +0000 Subject: [PATCH] Release 2.4.1 --- CHANGELOG.md | 6 + cmd/osv-scanner/__snapshots__/main_test.snap | 2 +- .../source/__snapshots__/command_test.snap | 6 +- docs/github-action.md | 14 +-- internal/output/__snapshots__/sarif_test.snap | 106 +++++++++--------- internal/spdx/licenses.go | 4 + internal/version/version.go | 2 +- 7 files changed, 75 insertions(+), 65 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index b6304e3c0ba..8d626dde021 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,9 @@ +# v2.4.1 + +### Fixes: + +- [Bug #2915](https://github.com/google/osv-scanner/pull/2915) Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions. + # v2.4.0 ### Features: diff --git a/cmd/osv-scanner/__snapshots__/main_test.snap b/cmd/osv-scanner/__snapshots__/main_test.snap index ed35b90e594..887641df7c8 100755 --- a/cmd/osv-scanner/__snapshots__/main_test.snap +++ b/cmd/osv-scanner/__snapshots__/main_test.snap @@ -46,7 +46,7 @@ OPTIONS: --- [Test_run/version - 1] -osv-scanner version: 2.4.0 +osv-scanner version: 2.4.1 osv-scalibr version: 0.4.5 commit: n/a built at: n/a diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap index 978c67d723e..a882175ecda 100755 --- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap @@ -135,7 +135,7 @@ Loaded filter from: /testdata/locks-many/osv-scanner-test.toml "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -391,7 +391,7 @@ Total 2 packages affected by 3 known vulnerabilities (1 Critical, 2 High, 0 Medi ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -3767,7 +3767,7 @@ Total 1 package affected by 2 known vulnerabilities (0 Critical, 0 High, 0 Mediu ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, diff --git a/docs/github-action.md b/docs/github-action.md index 5a48af0b98a..1c3bd34b53d 100644 --- a/docs/github-action.md +++ b/docs/github-action.md @@ -54,7 +54,7 @@ permissions: jobs: scan-pr: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.4.1" ``` ### View results @@ -97,7 +97,7 @@ permissions: jobs: scan-scheduled: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.4.1" ``` As written, the scanner will run on 12:30 pm UTC every Monday, and also on every push to the main branch. You can change the schedule by following the instructions [here](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#schedule). @@ -132,7 +132,7 @@ permissions: jobs: osv-scan: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.4.1" with: # Only scan the top level go.mod file without recursively scanning directories since # this pipeline is about releasing the go module and binary @@ -184,7 +184,7 @@ Examples ```yml jobs: scan-pr: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.4.1" with: scan-args: |- --lockfile=./path/to/lockfile1 @@ -196,7 +196,7 @@ jobs: ```yml jobs: scan-pr: - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.4.1" with: scan-args: |- --recursive @@ -222,7 +222,7 @@ jobs: name: Vulnerability scanning # makes sure the extraction step is completed before running the scanner needs: extract-deps - uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.4.1" with: # Download the artifact uploaded in extract-deps step download-artifact: converted-OSV-Scanner-deps @@ -272,7 +272,7 @@ jobs: {target_arch: armhf}, {target_arch: aarch64} ] - uses: "extract/osv-scanner/.github/workflows/osv-scanner-reusable.yml@v2.3.8" + uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.4.1" with: download-artifact: "${{ matrix.platform.target_arch }}-OSV-Scanner-deps" matrix-property: "${{ matrix.platform.target_arch }}-" diff --git a/internal/output/__snapshots__/sarif_test.snap b/internal/output/__snapshots__/sarif_test.snap index 118862e662d..ce0bf856c4f 100755 --- a/internal/output/__snapshots__/sarif_test.snap +++ b/internal/output/__snapshots__/sarif_test.snap @@ -212,7 +212,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -262,7 +262,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -312,7 +312,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -362,7 +362,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -412,7 +412,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -462,7 +462,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -512,7 +512,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -562,7 +562,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -612,7 +612,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -662,7 +662,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -712,7 +712,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -762,7 +762,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -812,7 +812,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -862,7 +862,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -912,7 +912,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -962,7 +962,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1012,7 +1012,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1062,7 +1062,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1291,7 +1291,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1520,7 +1520,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1749,7 +1749,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1868,7 +1868,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -1918,7 +1918,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -2037,7 +2037,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -2156,7 +2156,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -2275,7 +2275,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -2394,7 +2394,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -2762,7 +2762,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -3130,7 +3130,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -3180,7 +3180,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -3409,7 +3409,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -3777,7 +3777,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4145,7 +4145,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4513,7 +4513,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4563,7 +4563,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4613,7 +4613,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4663,7 +4663,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4713,7 +4713,7 @@ "rules": [], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -4888,7 +4888,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5007,7 +5007,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5126,7 +5126,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5245,7 +5245,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5364,7 +5364,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5483,7 +5483,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5639,7 +5639,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5795,7 +5795,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -5951,7 +5951,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -6070,7 +6070,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -6189,7 +6189,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -6364,7 +6364,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -6483,7 +6483,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -6602,7 +6602,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, @@ -6766,7 +6766,7 @@ ], "supportedTaxonomies": [], "taxa": [], - "version": "2.4.0" + "version": "2.4.1" }, "extensions": [] }, diff --git a/internal/spdx/licenses.go b/internal/spdx/licenses.go index ebbbc8b1145..94a6a894398 100644 --- a/internal/spdx/licenses.go +++ b/internal/spdx/licenses.go @@ -56,6 +56,7 @@ var IDs = map[string]bool{ "aspell-ru": true, "aswf-digital-assets-1.0": true, "aswf-digital-assets-1.1": true, + "atc-game": true, "baekmuk": true, "bahyph": true, "barr": true, @@ -114,6 +115,7 @@ var IDs = map[string]bool{ "bsd-systemics-w3works": true, "bsl-1.0": true, "buddy": true, + "bugroff": true, "busl-1.1": true, "bzip2-1.0.5": true, "bzip2-1.0.6": true, @@ -142,6 +144,7 @@ var IDs = map[string]bool{ "cc-by-nc-2.5": true, "cc-by-nc-3.0": true, "cc-by-nc-3.0-de": true, + "cc-by-nc-3.0-igo": true, "cc-by-nc-4.0": true, "cc-by-nc-nd-1.0": true, "cc-by-nc-nd-2.0": true, @@ -377,6 +380,7 @@ var IDs = map[string]bool{ "imatix": true, "imlib2": true, "info-zip": true, + "informatica": true, "inner-net-2.0": true, "innosetup": true, "intel": true, diff --git a/internal/version/version.go b/internal/version/version.go index f7ae88517dc..722a2b37898 100644 --- a/internal/version/version.go +++ b/internal/version/version.go @@ -2,4 +2,4 @@ package version // OSVVersion is the current release version, you should update this variable when doing a release -const OSVVersion = "2.4.0" +const OSVVersion = "2.4.1"