From fbac13993db7f821f76d16637c09b6594eb60884 Mon Sep 17 00:00:00 2001 From: vvillait88 Date: Fri, 21 Aug 2026 09:47:58 -0700 Subject: [PATCH] Scan with osv-scanner v2.5.1 The scanner version rides a download URL, so dependabot never sees it and it only moves by hand. Nine repos sat on v2.4.0 while the fleet template had already moved to v2.5.1, so half the workspace was being scanned by an older scanner than the other half and nothing said so. Verified the v2.5.1 release carries both asset names our workflows fetch (osv-scanner_linux_amd64 and _arm64) before changing the URL, since a renamed asset would have broken every one of these jobs at once. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index e9bf3ae..15fb759 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -24,7 +24,7 @@ jobs: - name: Install osv-scanner run: | - curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.4.0/osv-scanner_linux_arm64 -o osv-scanner + curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_arm64 -o osv-scanner chmod +x osv-scanner - name: Scan dependencies