Bump google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 1.7.1 to 2.3.2 in /.github/workflows

[dependabot]

Bumps google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml from 1.7.1 to 2.3.2.

Release notes

Sourced from google/osv-scanner-action/.github/workflows/osv-scanner-reusable-pr.yml's releases.

v2.3.2

This updates OSV-Scanner to v2.3.2

This release includes performance improvements for local scanning, reducing memory usage and avoiding unnecessary advisory loading. It also fixes issues with MCP's get_vulnerability_details tool, git queries in osv-scanner.json, and ignore entry tracking, along with documentation updates.

Fixes:

• [Bug #2415](google/osv-scanner#2415) Add more PURL-to-ecosystem mappings
• [Bug #2422](google/osv-scanner#2422) MCP error for get_vulnerability_id because type definition is incorrect.
• [Bug #2460](google/osv-scanner#2460) Enable osv-scanner.json git queries
• [Bug #2456](google/osv-scanner#2456) Properly track if an ignore entry has been used
• [Bug #2450](google/osv-scanner#2450) Performance: Avoid loading the entire advisory unless it will actually be used
• [Bug #2445](google/osv-scanner#2445) Performance: Don't read the entire zip into memory
• [Bug #2433](google/osv-scanner#2433) Allow specifying user agent in v2 osvscanner package

Misc:

• [Misc #2453](google/osv-scanner#2453) Switch from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3
• [Misc #2447](google/osv-scanner#2447) Include bun.lock as a supported lockfile
• [Misc #2444](google/osv-scanner#2444) Document GoVersionOverride in configuration.md

Full Changelog: google/osv-scanner@v2.3.1...v2.3.2

v2.3.1

What's Changed

• chore(deps): update workflows (major) by @​renovate-bot in google/osv-scanner-action#105
• chore(deps): update github/codeql-action action to v4.31.7 by @​renovate-bot in google/osv-scanner-action#108
• chore: more specific name for uploaded artifact by @​marcusburghardt in google/osv-scanner-action#111
• Update to v2.3.1 by @​cuixq in google/osv-scanner-action#112

New Contributors

• @​marcusburghardt made their first contribution in google/osv-scanner-action#111

Full Changelog: google/osv-scanner-action@v2.3.0...v2.3.1

v2.3.0

What's Changed

• chore(deps): update workflows by @​renovate-bot in google/osv-scanner-action#104
• Add gemini config.yaml file by @​michaelkedar in google/osv-scanner-action#107
• Update to v2.3.0 by @​michaelkedar in google/osv-scanner-action#106

Full Changelog: google/osv-scanner-action@v2.2.4...v2.3.0

v2.2.4

What's Changed

• chore(deps): update github/codeql-action action to v4 by @​renovate-bot in google/osv-scanner-action#102
• Update to v2.2.4 by @​another-rex in google/osv-scanner-action#103

... (truncated)

Commits

• 2a387ed Merge pull request #116 from google/update-to-v2.3.2
• f75042f Update unified workflow example to point to v2.3.2 reusable workflows
• 17ad728 Update reusable workflows to point to v2.3.2 actions
• 9eebeae "Update actions to use v2.3.2 osv-scanner image"
• dcf7b89 Merge pull request #114 from renovate-bot/renovate/major-workflows
• 6bcc4fa Merge pull request #113 from renovate-bot/renovate/workflows
• 70f7395 chore(deps): update github/codeql-action action to v4.31.9
• 7c3c2a7 chore(deps): update workflows
• a239d86 Merge pull request #109 from renovate-bot/renovate/major-workflows
• 375a0e8 Merge pull request #112 from google/update-to-v2.3.1
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[codacy-production]

Codacy's Analysis Summary

0 new issue (≤ 0 issue)
0 new security issue

Review Pull Request in Codacy →

✨ AI Reviewer available: add the codacy-review label to get contextual insights without leaving GitHub.

[HackingRepo]

for supply chain reasons, that cannot be fixed, github workflows immutable.

[dependabot]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.