Bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 1.9.2 to 2.3.5#1148
Conversation
dependabot
Bot
added
dependencies
Kusari Analysis Results:Caution Flagged Issues Detected The code analysis identified a supply chain security risk in .github/workflows/osv-scanner-pr.yml at line 19, where the reusable workflow google/osv-scanner-action is referenced using the mutable tag v2.3.5 instead of an immutable full commit SHA. Mutable tags can be silently reassigned to point to arbitrary or malicious code at any time without any visible change in the workflow file. This is particularly concerning given the security-sensitive nature of this repository. The dependency analysis found no issues. Action required: Pin the google/osv-scanner-action reference to the full immutable commit SHA corresponding to the v2.3.5 release before merging. Note View full detailed analysis result for more information on the output and the checks that were run. Required Code MitigationsThe reusable workflow is referenced using the mutable tag v2.3.5. Tags can be reassigned at any time to point to arbitrary or malicious code. Pin this reference to the full immutable commit SHA corresponding to the intended release of google/osv-scanner-action to prevent supply chain attacks via tag mutation.
Found this helpful? Give it a 👍 or 👎 reaction! |
![kusari-inspector[bot]](https://avatars.githubusercontent.com/in/1220830?s=60&v=4){kind=small}
| jobs: | ||
| scan-pr: | ||
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v1.9.2" | ||
| uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml@v2.3.5" |
There was a problem hiding this comment.
The reusable workflow is referenced using the mutable tag v2.3.5. Tags can be reassigned at any time to point to arbitrary or malicious code. Pin this reference to the full immutable commit SHA corresponding to the intended release of google/osv-scanner-action to prevent supply chain attacks via tag mutation.
dependabot
Bot
force-pushed
the
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-2.3.5
branch
from
2d9044b to
0e37901
Compare
|
Kusari PR Analysis rerun based on - 0e37901 performed at: 2026-05-15T01:58:06Z - link to updated analysis |
dependabot
Bot
force-pushed
the
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-2.3.5
branch
from
0e37901 to
bdfed93
Compare
|
Kusari PR Analysis rerun based on - bdfed93 performed at: 2026-05-15T02:06:08Z - link to updated analysis |
dependabot
Bot
force-pushed
the
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-2.3.5
branch
from
bdfed93 to
bd9ca8f
Compare
|
Kusari PR Analysis rerun based on - bd9ca8f performed at: 2026-05-15T02:18:00Z - link to updated analysis |
…-pr.yml Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml](https://github.com/google/osv-scanner-action) from 1.9.2 to 2.3.5. - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@v1.9.2...v2.3.5) --- updated-dependencies: - dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml dependency-version: 2.3.5 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
force-pushed
the
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-2.3.5
branch
from
bd9ca8f to
6b4b981
Compare
|
Kusari PR Analysis rerun based on - 6b4b981 performed at: 2026-05-15T03:52:09Z - link to updated analysis |
calebbrown
deleted the
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable-pr.yml-2.3.5
branch
1 participant
Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 1.9.2 to 2.3.5.
Release notes
Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases.
... (truncated)
Commits
c518547Merge pull request #124 from google/update-to-v2.3.51fc5ec2Update unified workflow example to point to v2.3.5 reusable workflows3d5827dUpdate reusable workflows to point to v2.3.5 actions7222d1c"Update actions to use v2.3.5 osv-scanner image"a30b4c3Merge pull request #120 from google/lsc-1771431861.838104562f47c7Fix missing env var after the initial changeb7ee968Refactor Github Action per b/485167538c5996e0Merge pull request #118 from google/update-to-v2.3.3f4fac92Update unified workflow example to point to v2.3.3 reusable workflows8ae4be8Update reusable workflows to point to v2.3.3 actions