From 4f85ec7e1e6860a8a883f1f0962b0e2b1d50eec4 Mon Sep 17 00:00:00 2001 From: vvillait88 Date: Fri, 21 Aug 2026 09:47:53 -0700 Subject: [PATCH] Scan with osv-scanner v2.5.1 The scanner version rides a download URL, so dependabot never sees it and it only moves by hand. Nine repos sat on v2.4.0 while the fleet template had already moved to v2.5.1, so half the workspace was being scanned by an older scanner than the other half and nothing said so. Verified the v2.5.1 release carries both asset names our workflows fetch (osv-scanner_linux_amd64 and _arm64) before changing the URL, since a renamed asset would have broken every one of these jobs at once. Co-Authored-By: Claude Opus 5 (1M context) --- .github/workflows/security.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 60287de..e8ded8a 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -24,7 +24,7 @@ jobs: - name: Install osv-scanner run: | - curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.4.0/osv-scanner_linux_arm64 -o osv-scanner + curl -fsSL https://github.com/google/osv-scanner/releases/download/v2.5.1/osv-scanner_linux_arm64 -o osv-scanner chmod +x osv-scanner - name: Scan dependencies