chore(deps): update module osv-scanner to v2.5.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
osv-scanner	v2.3.8 → v2.5.0

---

Release Notes

google/osv-scanner (osv-scanner)

v2.5.0

Compare Source

Features & Refactors:

• Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#​2935).

• New extractors and ecosystem support via osv-scalibr:

  • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
  • Extend ecosystem mapping for:
    • SUSE
    • Azure Linux / Mariner
    • Alpaquita
    • Mageia
    • openSUSE Leap
    • Debian and Ubuntu PURL

• PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

• Bug #​2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
• Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #​2940, #​2931)
• Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

v2.4.0

Compare Source

Features:

• Feature #​2815 Add support for the CycloneDX 1.7 specification (bumps cyclonedx-go to v0.11.0).
• Feature #​2799 Enable .csproj and Central Package Management (nugetcpm) source scanning plugins by default.
• Feature #​2871 Extract and parse Alpine OS distro version (e.g. Alpine:v3.17, Alpine:edge) from PURL distro qualifiers to scan packages under their respective Alpine ecosystems.
• Feature #​2801 Enable the swift/packageresolved plugin by default to support SwiftURL vulnerability scans.
• Feature #​2666 Add a Docker-based variant of the pre-commit hook in .pre-commit-hooks.yaml to avoid local compilation.
• Feature #​2637 Add a new configuration setting ScanGoModVersion (disabled by default) to avoid parsing toolchain version directives directly from go.mod, preventing misleading warnings.
• Feature #​2772 Scan container images built with Canonical Chisel by enabling the os/chisel extractor plugin.

Fixes:

• Bug #​2807 Sanitize package name, source, and version fields in the vertical output format to prevent GitHub Actions workflow command injection vulnerabilities from crafted lock files.
• Bug #​2876 Improve HTML scan report usability by supporting standard click modifiers (Ctrl/Cmd/middle click) to open vulnerabilities in new tabs, and preserving scroll position when switching tabs.
• Bug #​2783 Keep transitive dependency scanning enabled when specifying the --offline-vulnerabilities flag.
• Bug #​2808 Deduplicate equivalent OSV matcher requests before executing bulk queries to reduce API overhead.
• Bug #​2837 Prevent panics during offline matcher scans (e.g. on unsupported GitHub Actions ecosystem) by avoiding parsing errors when checking version ranges.
• Bug #​2836 Ensure the scanner returns an exit code of 0 when --help or -h is explicitly requested.

Misc:

• Update Go version to 1.26.4.
• Update osv-scalibr to v0.4.6-0.20260612031204-164402d9140e.
• Tag built Docker and GitHub Action images with the major version (e.g. :v2) to allow users to pin to a major version (#​2857).

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[BergCyrill]

lgtm - dev-kit version bump