Skip to content

Bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 1.9.2 to 2.3.5#1149

Merged
calebbrown merged 1 commit into
mainfrom
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable.yml-2.3.5
May 15, 2026
Merged

Bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 1.9.2 to 2.3.5#1149
calebbrown merged 1 commit into
mainfrom
dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable.yml-2.3.5

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github May 15, 2026 •
edited
Loading

Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml from 1.9.2 to 2.3.5.

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml's releases.

v2.3.5

This updates OSV-Scanner to v2.3.5.

What's Changed

New Contributors

Full Changelog: google/osv-scanner-action@v2.3.3...v2.3.5

v2.3.3

This updates OSV-Scanner to v2.3.3.

What's Changed

New Contributors

Full Changelog: google/osv-scanner-action@v2.3.2...v2.3.3

v2.3.2

This updates OSV-Scanner to v2.3.2

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

Misc:

Full Changelog: google/osv-scanner@v2.3.1...v2.3.2

v2.3.1

What's Changed

... (truncated)

Commits
  • c518547 Merge pull request #124 from google/update-to-v2.3.5
  • 1fc5ec2 Update unified workflow example to point to v2.3.5 reusable workflows
  • 3d5827d Update reusable workflows to point to v2.3.5 actions
  • 7222d1c "Update actions to use v2.3.5 osv-scanner image"
  • a30b4c3 Merge pull request #120 from google/lsc-1771431861.8381045
  • 62f47c7 Fix missing env var after the initial change
  • b7ee968 Refactor Github Action per b/485167538
  • c5996e0 Merge pull request #118 from google/update-to-v2.3.3
  • f4fac92 Update unified workflow example to point to v2.3.3 reusable workflows
  • 8ae4be8 Update reusable workflows to point to v2.3.3 actions
  • Additional commits viewable in compare view

@dependabot dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels May 15, 2026
@kusari-inspector
Copy link
Copy Markdown

kusari-inspector Bot commented May 15, 2026 •
edited
Loading

Kusari Inspector

Kusari Analysis Results:

Do not proceed without addressing issues

Caution

Flagged Issues Detected
These changes contain flagged issues that may introduce security risks.

The dependency analysis found no issues. However, the code analysis identified a high-severity supply chain security risk in .github/workflows/osv-scanner-scheduled.yml (line 18): the reusable workflow google/osv-scanner-action is referenced using a mutable version tag (v2.3.5) instead of a pinned, immutable commit SHA. Mutable tags can be silently reassigned by the upstream repository owner or a compromised account to point to malicious code, enabling a supply chain attack within the CI pipeline. This risk is especially critical for a repository under the OpenSSF package-analysis project, where supply chain integrity is a primary concern. Action Required: Replace the mutable tag reference with the full commit SHA corresponding to the v2.3.5 release: uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@<full-commit-sha> # v2.3.5

Note

View full detailed analysis result for more information on the output and the checks that were run.

Required Code Mitigations

The reusable workflow reference uses a mutable tag v2.3.5 instead of a pinned immutable commit SHA. Tags can be reassigned to point to malicious commits, enabling supply chain compromise. Pin the reference to the full commit SHA corresponding to the v2.3.5 release of google/osv-scanner-action.

uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@<full-commit-sha> # v2.3.5

@kusari-inspector rerun - Trigger a re-analysis of this PR
@kusari-inspector feedback [your message] - Send feedback to our AI and team
See Kusari's documentation for setup and configuration.
Commit: bb6d801, performed at: 2026-05-15T02:17:46Z

Found this helpful? Give it a 👍 or 👎 reaction!

kusari-inspector[bot]
kusari-inspector Bot reviewed May 15, 2026
View reviewed changes
Comment thread .github/workflows/osv-scanner-scheduled.yml
jobs:
scan-scheduled:
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v1.9.2"
uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@v2.3.5"
Copy link
Copy Markdown

@kusari-inspector kusari-inspector Bot May 15, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Issue: The reusable workflow reference uses a mutable tag v2.3.5 instead of a pinned immutable commit SHA. Tags can be reassigned to point to malicious commits, enabling supply chain compromise. Pin the reference to the full commit SHA corresponding to the v2.3.5 release of google/osv-scanner-action.

Recommended Code Changes:

uses: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@<full-commit-sha> # v2.3.5

@dependabot dependabot Bot force-pushed the dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable.yml-2.3.5 branch from f11e0ce to 34a20ea Compare May 15, 2026 01:57
@kusari-inspector
Copy link
Copy Markdown

kusari-inspector Bot commented May 15, 2026

Kusari PR Analysis rerun based on - 34a20ea performed at: 2026-05-15T01:58:32Z - link to updated analysis

@dependabot dependabot Bot force-pushed the dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable.yml-2.3.5 branch from 34a20ea to bf700f5 Compare May 15, 2026 02:05
@kusari-inspector
Copy link
Copy Markdown

kusari-inspector Bot commented May 15, 2026

Kusari PR Analysis rerun based on - bf700f5 performed at: 2026-05-15T02:06:11Z - link to updated analysis

@dependabot
Bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable…
bb6d801 
….yml

Bumps [google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml](https://github.com/google/osv-scanner-action) from 1.9.2 to 2.3.5.
- [Release notes](https://github.com/google/osv-scanner-action/releases)
- [Commits](google/osv-scanner-action@v1.9.2...v2.3.5)

---
updated-dependencies:
- dependency-name: google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml
  dependency-version: 2.3.5
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot force-pushed the dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable.yml-2.3.5 branch from bf700f5 to bb6d801 Compare May 15, 2026 02:16
@kusari-inspector
Copy link
Copy Markdown

kusari-inspector Bot commented May 15, 2026

Kusari PR Analysis rerun based on - bb6d801 performed at: 2026-05-15T02:18:02Z - link to updated analysis

@calebbrown calebbrown merged commit a548069 into main May 15, 2026
10 of 12 checks passed
@calebbrown calebbrown deleted the dependabot/github_actions/google/osv-scanner-action/dot-github/workflows/osv-scanner-reusable.yml-2.3.5 branch May 15, 2026 03:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@kusari-inspector kusari-inspector[bot] kusari-inspector[bot] left review comments

@calebbrown calebbrown calebbrown approved these changes

Assignees

No one assigned

Labels

dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@calebbrown