build(deps): bump google/osv-scanner-action/osv-scanner-action from 2.5.0 to 2.5.1 - #495
Merged
qnbs merged 2 commits intoAug 26, 2026
Conversation
The latest updates on your projects. Learn more about Vercel for GitHub.
|
Skipping PR review because a bot author is detected. If you want to trigger CodeAnt AI, comment |
🏁 CodeAnt Quality Gate ResultsCommit: ✅ Overall Status: PASSEDQuality Gate Details
|
qnbs
commented
Aug 26, 2026
Owner
@dependabot rebase |
Bumps [google/osv-scanner-action/osv-scanner-action](https://github.com/google/osv-scanner-action) from 2.5.0 to 2.5.1. - [Release notes](https://github.com/google/osv-scanner-action/releases) - [Commits](google/osv-scanner-action@8deb546...6e4298e) --- updated-dependencies: - dependency-name: google/osv-scanner-action/osv-scanner-action dependency-version: 2.5.1 dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
dependabotBotforce-pushed
the
dependabot/github_actions/google/osv-scanner-action/osv-scanner-action-2.5.1
branch
from
August 26, 2026 13:59
776141b to
0d911dbComparetests/unit/workflowPolicy.test.ts asserted the exact SHA-pinned osv-scanner-action reference in security-scheduled.yml, which this PR's own version bump (2.5.0 -> 2.5.1) legitimately changes. Verified the new SHA against the real upstream v2.5.1 tag before updating the assertion.
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Uh oh!
There was an error while loading. Please reload this page.
qnbs
deleted the
dependabot/github_actions/google/osv-scanner-action/osv-scanner-action-2.5.1
branch
August 26, 2026 14:46
4 tasks
qnbs added a commit
that referenced
this pull request
Aug 26, 2026
A bare pnpm install (no --frozen-lockfile) was used to bootstrap a new worktree during PR #495 handling. It happened to be harmless this time (lockfile was already in sync), but the flag omission means it could have silently rewritten pnpm-lock.yaml on any drift instead of failing loudly, and it skips the repo's own dependency-fingerprint write that pnpm run <script> later verifies against. Codified the correct procedure (node scripts/dependency-state.mjs reconcile / pnpm run deps:reconcile) in both CLAUDE.md and AGENTS.md so this doesn't recur, especially on branches that shouldn't touch dependencies at all.
qnbs added a commit
that referenced
this pull request
Aug 26, 2026
… install policy (#512) * docs: codify never-bare-pnpm-install policy for new worktree bootstrap A bare pnpm install (no --frozen-lockfile) was used to bootstrap a new worktree during PR #495 handling. It happened to be harmless this time (lockfile was already in sync), but the flag omission means it could have silently rewritten pnpm-lock.yaml on any drift instead of failing loudly, and it skips the repo's own dependency-fingerprint write that pnpm run <script> later verifies against. Codified the correct procedure (node scripts/dependency-state.mjs reconcile / pnpm run deps:reconcile) in both CLAUDE.md and AGENTS.md so this doesn't recur, especially on branches that shouldn't touch dependencies at all. * docs: refresh AUDIT.md and TODO.md release/sprint truth to v1.28.1 AUDIT.md's "Current version" summary and test counts were one release behind (v1.28.0/6888 tests/565 files, missing v1.28.1 entirely). Added an accurate v1.28.1 release-gate entry (real CI run IDs, real asset list) verified against the actual GitHub Release, and refreshed the summary line to current numbers (7114+/580/2925 keys x 19 locales). TODO.md's "Current Sprint" header dated 2026-08-20 and referenced PR #427, predating both the #477 merge and the v1.28.1 release plus this session's reconstruction reconciliation and Dependabot work. Archived the stale sprint entry and replaced it with the current state. * fix: precise dependency-fingerprint scope, signing claim, and sprint text - CLAUDE.md/AGENTS.md: correct the fingerprint-verification claim — the repo's own dependency fingerprint is checked only by deps:verify, ci:prepush, and the pre-commit hook, not by arbitrary pnpm run <script> calls. Separated it from pnpm's own independent verifyDepsBeforeRun check (a different mechanism, comparing node_modules against the lockfile) that produces ERR_PNPM_VERIFY_DEPS_BEFORE_RUN. - AUDIT.md: removed the "signed" qualifier from the v1.28.1 release artifacts line — the release evidence ledger explicitly keeps platform code-signing/notarization as a separate, unverified claim; only structural/asset/updater-payload crypto verification is confirmed. - TODO.md: the "full signed release cut" open item read as self-contradictory next to v1.28.1's already-published status three lines above. Marked the documentation pass done and clarified the remaining item is a new release cut for this sprint's accumulated work, not a repeat of v1.28.1. * chore: re-trigger CI after a GitHub Actions platform outage The previous run for this head got stuck in a queued state during GitHub's Aug 26 database-failover incident (investigating 15:09 UTC, resolved 16:07 UTC) and remained stuck afterward with an inconsistent run record (the run-status API reported "queued" while the cancel endpoint reported "already completed" for the same run ID). No code or doc content changed; this empty commit only requests a fresh pull_request synchronize event.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps google/osv-scanner-action/osv-scanner-action from 2.5.0 to 2.5.1.
Release notes
Sourced from google/osv-scanner-action/osv-scanner-action's releases.
Commits
6e4298eMerge pull request #141 from google/update-to-v2.5.15957b4eUpdate unified workflow example to point to v2.5.1 reusable workflows880d9b5Update reusable workflows to point to v2.5.1 actionsbaa4139"Update actions to use v2.5.1 osv-scanner image"f4cfcc0Merge pull request #117 from renovate-bot/renovate/workflowsdfd4cd1Update workflowse13f842Merge pull request #133 from renovate-bot/renovate/major-workflows3f2e7feUpdate actions/checkout action to v7