chore(deps): bump google/osv-scanner-action/osv-reporter-action from 8dc09193bb540e09b23da07ad7e30bd33bf87018 to ffa0a5f39214d80778c9b494822d94d0d9668458 - #1309
Open
dependabot[bot] wants to merge 1 commit into
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| print(f"... {len(findings) - 50} additional {label} OSV finding(s) omitted from the log summary.") | ||
| - name: Report PR-introduced OSV findings | ||
| uses: google/osv-scanner-action/osv-reporter-action@8dc09193bb540e09b23da07ad7e30bd33bf87018 # v2.3.8 | ||
| uses: google/osv-scanner-action/osv-reporter-action@ffa0a5f39214d80778c9b494822d94d0d9668458 # v2.3.8 |
Contributor
There was a problem hiding this comment.
🟡 Misleading version comment on bumped reporter pin
The reporter pin is bumped to ffa0a5f, which the PR's own commit list identifies as v2.5.1, but the trailing comment still reads # v2.3.8. The scanner-action steps remain pinned to v2.3.8, so the annotation is wrong and the reporter and scanner now run different versions.
Suggested change
| uses: google/osv-scanner-action/osv-reporter-action@ffa0a5f39214d80778c9b494822d94d0d9668458 # v2.3.8 | |
| uses: google/osv-scanner-action/osv-reporter-action@ffa0a5f39214d80778c9b494822d94d0d9668458 # v2.5.1 |
Was this helpful? React with 👍 or 👎 to provide feedback.
Comment on lines
+192
to
195
| uses: google/osv-scanner-action/osv-reporter-action@ffa0a5f39214d80778c9b494822d94d0d9668458 # v2.3.8 | ||
| with: | ||
| scan-args: | | ||
| --output=results.sarif |
Contributor
There was a problem hiding this comment.
🔍 Reporter now newer than the scanner it consumes
The bumped reporter (v2.5.1 per ffa0a5f) reads JSON produced by scanner-action steps still pinned to v2.3.8. One bumped commit is "Fix JSON results export". Confirm the newer reporter still parses the older scanner's --old/--new JSON, since a format mismatch could break the vulnerability gate.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/google/osv-scanner-action/osv-reporter-action-ffa0a5f39214d80778c9b494822d94d0d9668458
branch
7 times, most recently
from
August 25, 2026 21:50
5983b30 to
12bdd48
Compare
seonghobae
enabled auto-merge (squash)
August 25, 2026 22:29
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/google/osv-scanner-action/osv-reporter-action-ffa0a5f39214d80778c9b494822d94d0d9668458
branch
4 times, most recently
from
August 26, 2026 19:40
3bf7254 to
8ae4407
Compare
Bumps [google/osv-scanner-action/osv-reporter-action](https://github.com/google/osv-scanner-action) from 8dc09193bb540e09b23da07ad7e30bd33bf87018 to ffa0a5f39214d80778c9b494822d94d0d9668458. - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@8dc0919...ffa0a5f) --- updated-dependencies: - dependency-name: google/osv-scanner-action/osv-reporter-action dependency-version: ffa0a5f39214d80778c9b494822d94d0d9668458 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/google/osv-scanner-action/osv-reporter-action-ffa0a5f39214d80778c9b494822d94d0d9668458
branch
from
August 26, 2026 22:01
8ae4407 to
a6180fe
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps google/osv-scanner-action/osv-reporter-action from 8dc09193bb540e09b23da07ad7e30bd33bf87018 to ffa0a5f39214d80778c9b494822d94d0d9668458.
Commits
ffa0a5fMerge pull request #142 from google/fix-json-export-code259ba4aFix JSON results export6e4298eMerge pull request #141 from google/update-to-v2.5.15957b4eUpdate unified workflow example to point to v2.5.1 reusable workflows880d9b5Update reusable workflows to point to v2.5.1 actionsbaa4139"Update actions to use v2.5.1 osv-scanner image"f4cfcc0Merge pull request #117 from renovate-bot/renovate/workflowsdfd4cd1Update workflowse13f842Merge pull request #133 from renovate-bot/renovate/major-workflows8deb546Merge pull request #140 from google/update-to-v2.5.0