chore(deps): bump github.com/google/osv-scanner from 1.7.4 to 1.9.0

[dependabot[bot]]

Bumps github.com/google/osv-scanner from 1.7.4 to 1.9.0.

Release notes

Sourced from github.com/google/osv-scanner's releases.

v1.9.0

What's Changed

Features:

• [Feature #1243](google/osv-scanner#1243) Allow explicitly ignoring the license of a package in config with license.ignore = true.
• [Feature #1249](google/osv-scanner#1249) Error if configuration file has unknown properties.
• [Feature #1271](google/osv-scanner#1271) Assume .txt files with "requirements" in their name are requirements.txt files

Fixes:

• [Bug #1242](google/osv-scanner#1242) Announce when a config file is invalid and exit with a non-zero code.
• [Bug #1241](google/osv-scanner#1241) Display (no reason given) when there is no reason in the override config.
• [Bug #1252](google/osv-scanner#1252) Don't allow LoadPath to be set via config file.
• [Bug #1279](google/osv-scanner#1279) Report all ecosystems without local databases in one single line.
• [Bug #1283](google/osv-scanner#1283) Output invalid PURLs when scanning SBOMs.
• [Bug #1278](google/osv-scanner#1278) Apply go version override to all instances of the stdlib.

Misc:

• #1253 Deprecate ParseX() functions in pkg/lockfile in favor of their Extract equivalents.
• #1290 Bump maximum number of concurrent requests to the OSV.dev API.

Full Changelog: https://github.com/google/osv-scanner/compare/v1.8.5...v1.9.0

v1.8.5

What's Changed

Features:

• [Feature #1160](google/osv-scanner#1160) Support fetching snapshot versions from a Maven registry.
• [Feature #1177](google/osv-scanner#1177) Support composite-based package overrides. This allows for ignoring entire manifests when scanning.
• [Feature #1210](google/osv-scanner#1210) Add FIXED-VULN-IDS to guided remediation non-interactive output.

Fixes:

• [Bug #1220](google/osv-scanner#1220) Fix govulncheck calls on C code.
• [Bug #1236](google/osv-scanner#1236) Alpine package scanning now falls back to latest release version if no release version can be found.

Full Changelog: https://github.com/google/osv-scanner/compare/v1.8.4...v1.8.5

v1.8.4

What's Changed

Features:

• [Feature #1177](google/osv-scanner#1177) Adds --upgrade-config flag for configuring allowed upgrades on a per-package basis. Also hide & deprecate previous --disallow-major-upgrades and --disallow-package-upgrades flags.

Fixes:

... (truncated)

Changelog

Sourced from github.com/google/osv-scanner's changelog.

v1.9.0

Features:

• [Feature #1243](google/osv-scanner#1243) Allow explicitly ignoring the license of a package in config with license.ignore = true.
• [Feature #1249](google/osv-scanner#1249) Error if configuration file has unknown properties.
• [Feature #1271](google/osv-scanner#1271) Assume .txt files with "requirements" in their name are requirements.txt files

Fixes:

• [Bug #1242](google/osv-scanner#1242) Announce when a config file is invalid and exit with a non-zero code.
• [Bug #1241](google/osv-scanner#1241) Display (no reason given) when there is no reason in the override config.
• [Bug #1252](google/osv-scanner#1252) Don't allow LoadPath to be set via config file.
• [Bug #1279](google/osv-scanner#1279) Report all ecosystems without local databases in one single line.
• [Bug #1283](google/osv-scanner#1283) Output invalid PURLs when scanning SBOMs.
• [Bug #1278](google/osv-scanner#1278) Apply go version override to all instances of the stdlib.

Misc:

• #1253 Deprecate ParseX() functions in pkg/lockfile in favor of their Extract equivalents.
• #1290 Bump maximum number of concurrent requests to the OSV.dev API.

v1.8.5:

Features:

• [Feature #1160](google/osv-scanner#1160) Support fetching snapshot versions from a Maven registry.
• [Feature #1177](google/osv-scanner#1177) Support composite-based package overrides. This allows for ignoring entire manifests when scanning.
• [Feature #1210](google/osv-scanner#1210) Add FIXED-VULN-IDS to guided remediation non-interactive output.

Fixes:

• [Bug #1220](google/osv-scanner#1220) Fix govulncheck calls on C code.
• [Bug #1236](google/osv-scanner#1236) Alpine package scanning now falls back to latest release version if no release version can be found.

v1.8.4:

Features:

• [Feature #1177](google/osv-scanner#1177) Adds --upgrade-config flag for configuring allowed upgrades on a per-package basis. Also hide & deprecate previous --disallow-major-upgrades and --disallow-package-upgrades flags.

Fixes:

• [Bug #1123](google/osv-scanner#1123) Issue when running osv-scanner on project running with golang 1.22 #1123

Misc:

• [Feature #638](google/osv-scanner#638) Update go policy to use stable go version for builds (updated to go 1.23)

v1.8.3:

... (truncated)

Commits

• 1386406 chore(release): changelog for v1.9.0 (#1292)
• ba02cd4 chore(deps): update workflows (#1281)
• 1d67d7a chore(deps): lock file maintenance (#1282)
• c080496 fix: bump osv max concurrent requests (#1290)
• a20e520 fix: apply go version override to all instances of the stdlib (#1278)
• 3591365 fix: output invalid PURLs when scanning sboms (#1283)
• 866b3e0 fix(offline): report all ecosystems without local databases in one single lin...
• ce76735 test: update snapshot (#1284)
• 259b6d4 chore(deps): update workflows (#1264)
• 3b074f7 fix(deps): update osv-scanner minor (#1265)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

Looks like github.com/google/osv-scanner is up-to-date now, so this is no longer needed.