build(deps): bump github.com/google/osv-scalibr from 0.3.4 to 0.4.5 by dependabot[bot] · Pull Request #6179 · mindersec/minder

dependabot · 2026-03-18T06:14:22Z

Bumps github.com/google/osv-scalibr from 0.3.4 to 0.4.5.

Release notes

Sourced from github.com/google/osv-scalibr's releases.

v0.4.5

New secret detectors: Supabase credentials, Packagist credentials, Discord bot tokens, Bitwarden OAuth2 access tokens

New vulnerability detector: PAM misconfigurations

New software extractors: NuGet .csproj, Spack packages

Improved accuracy and test coverage of various secret detectors

GKE image-streaming support in the containerd extractor

Started migration of inventory locations to a more structured format

This release only includes proto changes. The next release will bump a major version and remove the old locations fields in favor of the new structured ones.

v0.4.4

New extractors: QEMU disk images, opam, Bazel Maven dependencies

New secret detectors: Square API creds, Salesforce creds, SendGrid API key, Deno PAT, Heroku Platform API Key, npmjs Registry Access Token, Cloudfare API token

Fixed the StoreAbsolutePath ScanConfig option to work with annotators + enrichers

v0.4.3

New secret scanners: OpenRouter key, base64-encoded Github PATs, PayStack secret,Telegram Bot API key, Cursor API key, Elastic Cloud API key, Salesforce OAuth2 Client Credential / Access Token / Refresh Token, Mistral API Key, CircleCI Personal Access Token and Project Access Token

New extractor: Mise tools

New detectors: NetScaler CVE-2025-7775, Cron job privesc vulns

New annotators: Homebrew source metadata

More comprehensive testing for secret detectors

Migrated extractors to use global proto for configuration

--unsafe flag for enabling potentially unsafe plugins

v0.4.2

New secret extractor for Bitbucket and Amazon CodeCommit git basic auth URLs

Rust reachability annotation migrated from OSV-Scanner

New extractor for Chocolatey packages (Windows)

Deps.dev API usage for pomxml dependency resolution

v0.4.1

New secret detectors: AWS access token, Recaptcha secret key, pyx v1/v2 user key, Amazon CodeCatalyst, generic JWT

Go source reachability enrichment using Govulncheck

Support for more assignment patterns in the .gemspec extractor

Support for BellSoft/Alpaquita OS packages

Fixes: Correct the COS os-duplicate annotator behavior, avoid duplicate inventories when traversing multiple ScanRoots

Include PackageVulns in output proto

v0.4.0

Global plugin config: Plugins can now be configured through a unified flag from the CLI and proto field from the library

Using e.g. --plugin-config=max_file_size_bytes:10000000 --plugin-config=go_binary:{version_from_content:true}

Migration for all plugins to use this setup is still in progress

This adds a new plugin config param to the list.go plugin initializers (list.FromNames()) and is thus a breaking change for current list.go API users

New secret scanners: MariaDB creds, MySQL mylogin.cnf creds, VAPID keys

Guided Remediation support for Python projects managed with Pipenv

Enricher that adds package deprecation information: -plugins=packagedeprecation/depsdev

Annotator for DPKG package sources: -plugins=misc/dpkg-source

v0.3.6

New extractors: K8s images, .node-version, pylock.toml, VirtualBox disk images, openEuler support in RPM extractor

New secret detectors: 1password, Postgres pgpassfile, crates.io API token

... (truncated)

Commits

6510600 Bump SCALIBR version in preparation for a new release.
9c92834 Merge pull request #1870 from cuixq:npm
ea5d428 fix: escape package names in manifest writer
c7f2e9b Add new structured Location fields to protos.
352fc38 Merge pull request #1855 from cleanstart-community-admin:feat/cleanstart-ecos...
6742f9c Merge pull request #1862 from ackama:refactor/remove-unneeded-parentheses
afc5764 Merge pull request #1861 from ackama:refactor/use-packagist-directly
0bf9e87 Merge pull request #1853 from ackama:adjust-version
886caf3 Merge pull request #1859 from ackama:enrichers-root
8bd4660 Merge pull request #1858 from ackama:adjust-comment
Additional commits viewable in compare view

Note
Automatic rebases have been disabled on this pull request as it has been open for over 30 days.

Bumps [github.com/google/osv-scalibr](https://github.com/google/osv-scalibr) from 0.3.4 to 0.4.5. - [Release notes](https://github.com/google/osv-scalibr/releases) - [Commits](google/osv-scalibr@v0.3.4...v0.4.5) --- updated-dependencies: - dependency-name: github.com/google/osv-scalibr dependency-version: 0.4.5 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

coveralls · 2026-05-08T00:01:01Z

coverage: 61.778% (+0.02%) from 61.755% — dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 into main

evankanderson · 2026-05-08T05:08:24Z

+	if scanResults.Status.Status == scalibr_plugin.ScanStatusSucceeded {
+		return scanResults.Inventory.Packages, nil
 	}
-
-	return scanResults.Inventory.Packages, nil
+	// Scalibr runs a lot of plugins and aggregates the result.  Some of these are picky, and
+	// fail for random reasons.  Accept partial success, but log the failing plugins.
+	if scanResults.Status.Status == scalibr_plugin.ScanStatusPartiallySucceeded {


Do you prefer this set of if statements, or a switch like in scalibr.go, line 94?

(Yeah, we need to unify these two code paths or retire one)

evankanderson · 2026-06-03T18:18:55Z

@JAORMX - can you take a look at this? I had to do some code updates to support the new scalibr evaluation (and ignore a couple scanners that were over-sensitive).

github-actions · 2026-07-04T04:59:28Z

This PR needs additional information before we can continue. It is now marked as stale because it has been open for 30 days with no activity. Please provide the necessary details to continue or it will be closed in 30 days.

…es/github.com/google/osv-scalibr-0.4.5

evankanderson · 2026-07-20T22:11:29Z

@dakshhhhh16 or @krrish175-byte

Could you take a look at this? I'd like to get scalibr updated to their most recent release in prep for clearing out the pin on OCI v1.2.1 spec.

dakshhhhh16 · 2026-07-21T06:00:17Z

+		_ = os.RemoveAll(tmpDir)
+	}()
+	cfg := scalibr_cfg.PluginConfig{
+		MaxFileSizeBytes:  1024 * 1024,


Could we avoid setting a global 1 MiB file-size limit here and in internal/engine/ingester/diff/diff.go?

This configuration is passed to every selected plugin, including the package-lock.json extractor, which silently skips valid lockfiles larger than this limit. I reproduced a valid lockfile over 1 MiB returning an empty dependency inventory. Previously, an unset value of 0 meant no limit.

If this cap is intended only for binary extractors, could we configure those plugins specifically and add a large-lockfile regression test?

Good point! We're trying to avoid blowing up memory during rule evaluation on the Minder server side, so let me bump this to 2MB, and see if we can check the stats for ignored files.

GitHub security alerts apparently only trigger for <0.5MB, so there is precedent for this sort of limit.

dakshhhhh16 · 2026-07-21T06:00:34Z

+		return nil, err
+	}
+	// unknownbinariesextr uses file extension to determine "binary-ness", and triggers on e.g. .py files
+	skipPlugins := []string{"ffa/unknownbinariesextr"}


Should go/binary remain in this skip list?

Before this PR, Minder explicitly removed the Go-binary extractor because it can panic on certain files. The v0.4.5 implementation retains the same extraction path, and SCALIBR does not recover extractor panics, so removing that exclusion appears to reintroduce a process-level crash risk.

Could we keep it excluded unless there is an upstream fix we can reference and cover with a regression test?

It looks like google/osv-scalibr#2316 may have (incidentally) fixed this. I added a regression test.

👍🏻👍🏻

evankanderson

Feedback addressed and test cases added! Thanks for the review!

evankanderson · 2026-07-21T18:29:19Z

+		_ = os.RemoveAll(tmpDir)
+	}()
+	cfg := scalibr_cfg.PluginConfig{
+		MaxFileSizeBytes:  1024 * 1024,


Good point! We're trying to avoid blowing up memory during rule evaluation on the Minder server side, so let me bump this to 2MB, and see if we can check the stats for ignored files.

GitHub security alerts apparently only trigger for <0.5MB, so there is precedent for this sort of limit.

evankanderson · 2026-07-21T21:05:00Z

+		return nil, err
+	}
+	// unknownbinariesextr uses file extension to determine "binary-ness", and triggers on e.g. .py files
+	skipPlugins := []string{"ffa/unknownbinariesextr"}


It looks like google/osv-scalibr#2316 may have (incidentally) fixed this. I added a regression test.

…scalibr-0.4.5

dependabot · 2026-08-19T06:16:08Z

A newer version of github.com/google/osv-scalibr exists, but since this PR has been edited by someone other than Dependabot I haven't updated it. You'll get a PR for the updated version as normal once this PR is merged.

…es/github.com/google/osv-scalibr-0.4.5

dakshhhhh16 · 2026-08-20T03:36:57Z

+	return cmp.Or(
+		cmp.Compare(a.Name, b.Name),
+		cmp.Compare(a.Version, b.Version),
+		cmp.Compare(a.Location.PathOrEmpty(), b.Location.PathOrEmpty()),


Could we include Location.Related in this comparison too? If the base and head packages have the same name, version, and descriptor but the head adds another related file, this comparator returns 0. setDifference then considers them identical, so the new file never makes it into the dependency diff.
The old comparison included all locations. A focused test where only Related changes would help make sure we don’t lose that case.

I'll add a.Id as a tie-breaker to avoid this comparison. The old set of affected files was the best we could do with the previous API, but we're really interested in collecting packages and the corresponding file-points (e.g. package.json and package-lock.json), which should be consistent given a particular packaging ecosystem.

I checked this against the current SCALIBR output, and I don’t think ID works as the tie-breaker here. I ran the same requirements.txt scan twice, and the package ID was empty both times. That means when only Location.Related changes, this comparator still returns 0 and setDifference drops the update.
IDs can also be randomly generated in some SCALIBR enrichment paths, so they don’t look like a stable cross-scan identity. Could we compare Related directly, or build a stable key from the PURL plus descriptor and related locations? A focused setDifference test would make this much easier to verify.

@evankanderson I think this should be looked at

dakshhhhh16 · 2026-08-20T03:37:37Z

Can we guard the PURL before calling String() here? SCALIBR returns nil when a package has no PURLType, so one such inventory item would panic the whole scan.
We already account for a nil PURL in inventoryToEcosystem; I think this path should do the same and simply omit the identifier when there isn’t one. A small regression test would be useful too.

Done. I'll see if I can find an example scan that doesn't produce a PURL; my experience has been that all the scanners for the types that we detect (at least on Linux) produce PURLs.

Confirmed, this is fixed now. Moving the conversion into nodeFromPackage, guarding the nil PURL, and covering the empty-package case addresses the panic. Thanks!

dakshhhhh16 · 2026-08-20T03:38:06Z

+	}()
+	cfg := scalibr_config.PluginConfig{
+		ProtoConfig: &scalibr_cfg.PluginConfig{
+			MaxFileSizeBytes:  1024 * 1024,


I think one half of the earlier size-limit feedback is still open. scanFilesystem wires in the stats collector and logs files skipped because of this limit, but the new-deps path here doesn’t install that collector.
That means a large lockfile is silently omitted from a PR dependency diff. Could we share the scan configuration/stats wiring between the two paths and add a regression test for this path as well?

Updated the code. Given the copying between the two, I'm not sure that a regression test here adds a lot. (I'd like to figure out how to retire this path in favor of the SBOM-output variety.)

Confirmed, the diff path now installs the same stats collector and logs skipped files. I’m okay with not duplicating the heavier scan test while this path is being phased out. Thanks!

dakshhhhh16 · 2026-08-20T03:38:35Z

+			assert.Contains(t, string(logOutput.String()), tc.expectedLog)
 			require.NoError(t, err)
+			if tc.expectedLog == "" {
+				assert.Equal(t, logOutput.String(), tc.expectedLog)


I think requiring a completely empty log makes this test platform-dependent. On macOS, the broader plugin set reports a legitimate partial-success warning from vex/os-duplicate/rpm (“not implemented outside of Linux”), so the focused test fails here even though dependency extraction succeeds.
Could we only assert on the log when the test case provides an expected message, rather than requiring every normal case to produce no warnings?

I was concerned about known cases producing ScanStatusPartiallySucceeded and clogging up the logs. What do you think about only performing this check on GOOS=linux?

The Linux-only check works for me. It still catches unexpected server-side log spam without breaking local macOS or Windows runs. I reran the focused tests on macOS and they pass now.

…es/github.com/google/osv-scalibr-0.4.5

evankanderson · 2026-08-21T02:29:56Z

@dakshhhhh16 -- ready for another round of review.

dependabot Bot added dependencies Pull requests that update a dependency file go Pull requests that update Go code labels Mar 18, 2026

dependabot Bot requested a review from a team as a code owner March 18, 2026 06:14

dependabot Bot added the go Pull requests that update Go code label Mar 18, 2026

dependabot Bot mentioned this pull request Mar 18, 2026

build(deps): bump github.com/google/osv-scalibr from 0.3.4 to 0.4.4 #6155

Closed

dependabot Bot force-pushed the dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 branch 2 times, most recently from ef68922 to 6a1c5e9 Compare March 26, 2026 18:42

dependabot Bot force-pushed the dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 branch 3 times, most recently from 80adf4f to 74901c5 Compare April 3, 2026 04:05

dependabot Bot force-pushed the dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 branch from 74901c5 to c955573 Compare April 8, 2026 18:53

evankanderson force-pushed the dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 branch 2 times, most recently from c955573 to 4e2b677 Compare May 7, 2026 16:51

evankanderson force-pushed the dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 branch from 4e2b677 to da5b197 Compare May 7, 2026 23:49

Upgrade to accomodate scalibr 0.4.5 changes

ca585a0

evankanderson force-pushed the dependabot/go_modules/github.com/google/osv-scalibr-0.4.5 branch from da5b197 to ca585a0 Compare May 8, 2026 05:06

evankanderson reviewed May 8, 2026

View reviewed changes

evankanderson assigned JAORMX May 11, 2026

evankanderson requested a review from JAORMX May 11, 2026 20:14

github-actions Bot added the Stale label Jul 4, 2026

Merge remote-tracking branch 'upstream/main' into dependabot/go_modul…

811501c

…es/github.com/google/osv-scalibr-0.4.5

github-actions Bot removed the Stale label Jul 21, 2026

dakshhhhh16 reviewed Jul 21, 2026

View reviewed changes

Address feedback from dakshhhhh16

3814c5f

evankanderson reviewed Jul 21, 2026

View reviewed changes

Merge branch 'main' into dependabot/go_modules/github.com/google/osv-…

237fc8c

…scalibr-0.4.5

evankanderson added 4 commits August 19, 2026 11:00

Update for scalibr 0.5.2

4fa64d2

Cleanup list of bad modules after fixes merged

c81199b

Merge remote-tracking branch 'upstream/main' into dependabot/go_modul…

0c12835

…es/github.com/google/osv-scalibr-0.4.5

Fix lint errors

16a1f4b

dakshhhhh16 requested changes Aug 20, 2026

View reviewed changes

evankanderson added 2 commits August 20, 2026 15:39

Address PR feedback

e79fb4f

Merge remote-tracking branch 'upstream/main' into dependabot/go_modul…

8901feb

…es/github.com/google/osv-scalibr-0.4.5

Uh oh!

Conversation

dependabot Bot commented on behalf of github Mar 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v0.4.5

v0.4.4

v0.4.3

v0.4.2

v0.4.1

v0.4.0

v0.3.6

Uh oh!

coveralls commented May 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evankanderson commented Jun 3, 2026

Uh oh!

github-actions Bot commented Jul 4, 2026

Uh oh!

evankanderson commented Jul 20, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evankanderson left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

dependabot Bot commented on behalf of github Aug 19, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

evankanderson commented Aug 21, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dependabot Bot commented on behalf of github Mar 18, 2026 •

edited

Loading

coveralls commented May 8, 2026 •

edited

Loading