chore(deps): bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 to ffa0a5f39214d80778c9b494822d94d0d9668458 - #1310
Conversation
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
![devin-ai-integration[bot]](https://avatars.githubusercontent.com/in/811515?s=60&v=4){kind=small}
| # GitHub's 1,048,576-byte job-outputs cap and failing the run. Same nested | ||
| # action pins as v2.3.8; only the Export step is now conditional. | ||
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 # v2.3.8 + export-results gate | ||
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@ffa0a5f39214d80778c9b494822d94d0d9668458 # v2.3.8 + export-results gate |
Contributor
There was a problem hiding this comment.
🟡 Stale version label on bumped OSV pin
The uses: pin is bumped to ffa0a5f, a v2.5.1-based commit per the upstream history, but its trailing comment still reads # v2.3.8 + export-results gate. The label now misstates the pinned version.
Prompt for agents
The pinned SHA on the uses: line was bumped to ffa0a5f, which upstream commit history shows is based on osv-scanner-action v2.5.1 with a JSON export fix, not v2.3.8. Update the trailing comment on this line and the explanatory block above it (currently referencing 3a7550f and "v2.3.8 + export-results gate") so they accurately describe the new pinned version and re-verify that the export-results/job-outputs-cap rationale still holds for v2.5.1.
Was this helpful? React with 👍 or 👎 to provide feedback.
Comment on lines
39
to
+42
| # full old/new osv-scanner JSON into job outputs unconditionally, tripping | ||
| # GitHub's 1,048,576-byte job-outputs cap and failing the run. Same nested | ||
| # action pins as v2.3.8; only the Export step is now conditional. | ||
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 # v2.3.8 + export-results gate | ||
| uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@ffa0a5f39214d80778c9b494822d94d0d9668458 # v2.3.8 + export-results gate |
Contributor
There was a problem hiding this comment.
🔍 Verify export-results gate persists at v2.5.1
The pin rationale relies on the export-results gate (default false) to avoid tripping GitHub's job-outputs cap that v2.3.8 hit. The new pin is v2.5.1-based with a JSON export fix. Confirm v2.5.1 still gates JSON output behind export-results and defaults it false, otherwise the cap failure can return.
(Refers to this code)
Was this helpful? React with 👍 or 👎 to provide feedback.
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-ffa0a5f39214d80778c9b494822d94d0d9668458
branch
7 times, most recently
from
August 25, 2026 21:48
105e04d to
da66ab7
Compare
seonghobae
enabled auto-merge (squash)
August 25, 2026 22:29
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-ffa0a5f39214d80778c9b494822d94d0d9668458
branch
4 times, most recently
from
August 26, 2026 19:40
3279a1e to
2a80e3f
Compare
…nner-reusable-pr.yml Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) from 3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 to ffa0a5f39214d80778c9b494822d94d0d9668458. - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@3a7550f...ffa0a5f) --- updated-dependencies: - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: ffa0a5f39214d80778c9b494822d94d0d9668458 dependency-type: direct:production ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/main/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-ffa0a5f39214d80778c9b494822d94d0d9668458
branch
from
August 26, 2026 22:03
2a80e3f to
3c674b2
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 3a7550f43ba5b58905a821ce3a0ed24c4858b3f4 to ffa0a5f39214d80778c9b494822d94d0d9668458.
Commits
ffa0a5fMerge pull request #142 from google/fix-json-export-code259ba4aFix JSON results export6e4298eMerge pull request #141 from google/update-to-v2.5.15957b4eUpdate unified workflow example to point to v2.5.1 reusable workflows880d9b5Update reusable workflows to point to v2.5.1 actionsbaa4139"Update actions to use v2.5.1 osv-scanner image"f4cfcc0Merge pull request #117 from renovate-bot/renovate/workflowsdfd4cd1Update workflowse13f842Merge pull request #133 from renovate-bot/renovate/major-workflows8deb546Merge pull request #140 from google/update-to-v2.5.0