chore(deps): bump google/osv-scanner-action from 2.0.2 to 2.3.8

[dependabot]

Bumps google/osv-scanner-action from 2.0.2 to 2.3.8.

Release notes

Sourced from google/osv-scanner-action's releases.

v2.3.8

What's Changed

This updates OSV-Scanner to v2.3.8.

Full Changelog: google/osv-scanner-action@v2.3.5...v2.3.8

v2.3.5

This updates OSV-Scanner to v2.3.5.

What's Changed

• Update to v2.3.5 by @​tobyhawker in google/osv-scanner-action#124

New Contributors

• @​tobyhawker made their first contribution in google/osv-scanner-action#124

Full Changelog: google/osv-scanner-action@v2.3.3...v2.3.5

v2.3.3

This updates OSV-Scanner to v2.3.3.

What's Changed

• chore(deps): update github/codeql-action action to v4.31.10 by @​renovate-bot in google/osv-scanner-action#115
• Update to v2.3.3 by @​Ly-Joey in google/osv-scanner-action#118

New Contributors

• @​Ly-Joey made their first contribution in google/osv-scanner-action#118

Full Changelog: google/osv-scanner-action@v2.3.2...v2.3.3

v2.3.2

This updates OSV-Scanner to v2.3.2

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

• [Bug #2415](google/osv-scanner#2415) Add more PURL-to-ecosystem mappings
• [Bug #2422](google/osv-scanner#2422) MCP error for get_vulnerability_id because type definition is incorrect.
• [Bug #2460](google/osv-scanner#2460) Enable osv-scanner.json git queries
• [Bug #2456](google/osv-scanner#2456) Properly track if an ignore entry has been used
• [Bug #2450](google/osv-scanner#2450) Performance: Avoid loading the entire advisory unless it will actually be used
• [Bug #2445](google/osv-scanner#2445) Performance: Don't read the entire zip into memory
• [Bug #2433](google/osv-scanner#2433) Allow specifying user agent in v2 osvscanner package

Misc:

• [Misc #2453](google/osv-scanner#2453) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
• [Misc #2447](google/osv-scanner#2447) Include bun.lock as a supported lockfile
• [Misc #2444](google/osv-scanner#2444) Document GoVersionOverride in configuration.md

... (truncated)

Commits

• 9a49870 Update unified workflow example to point to v2.3.8 reusable workflows
• 3adb4b1 Update reusable workflows to point to v2.3.8 actions
• 8dc0919 "Update actions to use v2.3.8 osv-scanner image"
• 43f380b Merge pull request #125 from google/update-to-v2.3.6
• dcf4ddd Update unified workflow example to point to v2.3.6 reusable workflows
• b9dbb7e Update reusable workflows to point to v2.3.6 actions
• fe54858 "Update actions to use v2.3.6 osv-scanner image"
• eb5b619 Merge pull request #100 from thomasleplus/main
• 9517144 feat: output results in reusable workflow
• f17cd09 Merge branch 'main' into main
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Labels

The following labels could not be found: dependencies, github-actions. Please create them before Dependabot can add them to a pull request.

Please fix the above issues or remove invalid values from dependabot.yml.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Free

Run ID: 09ab5950-dcf5-48cb-aa70-ca088b0be830

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.