dependencies/osv-scanner
Looks up every locked dependency in the Open Source Vulnerabilities (OSV) advisory database.
Part of the dependencies configuration, at the recommended level. It runs at the push stage, once for the repository. It runs osv-scanner. It needs network access.
An advisory identifies a vulnerability in a dependency version.
What to do
Section titled “What to do”Upgrade the package the finding names. When no fix exists, accept the advisory until a recheck date with gspot ignore dependencies/osv-scanner --rule <advisory-id> --reason "<why>" --until <YYYY-MM-DD>.
Example
Section titled “Example”A locked package version named in an OSV advisory reports a finding. Upgrade to a fixed version, and update the lockfile.
Turn it off
Section titled “Turn it off”Turn it off for some files, or one of its lint rules, with a reason:
gspot ignore dependencies/osv-scanner --paths "<glob>" --reason "<why>"gspot ignore dependencies/osv-scanner --rule <rule> --reason "<why>"