Skip to content

refactor: use guidedremediation from osv-scalibr for version updates#2719

Merged
cuixq merged 3 commits intogoogle:mainfrom
cuixq:migrate
Apr 14, 2026
Merged

refactor: use guidedremediation from osv-scalibr for version updates#2719
cuixq merged 3 commits intogoogle:mainfrom
cuixq:migrate

Conversation

@cuixq
Copy link
Copy Markdown
Contributor

@cuixq cuixq commented Apr 13, 2026

#2675

This PR refactors the update command to use the guidedremediation package from github.com/google/osv-scalibr to handle dependency updates.

  • Migrated to osv-scalibr: Replaced internal remediation/suggest and upgrade logic with guidedremediation.Update.
  • Updated Snapshots: Updated the test snapshots to reflect the slightly adjusted output messages and the behavior of the suggester which prefers stable package versions.

@cuixq cuixq marked this pull request as ready for review April 13, 2026 06:27
@cuixq cuixq requested a review from michaelkedar April 13, 2026 06:28
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 13, 2026

Codecov Report

❌ Patch coverage is 83.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.47%. Comparing base (800145f) to head (3de67e3).

Files with missing lines Patch % Lines
cmd/osv-scanner/update/command.go 83.33% 2 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2719      +/-   ##
==========================================
- Coverage   71.60%   71.47%   -0.13%     
==========================================
  Files         164      164              
  Lines       12090    12075      -15     
==========================================
- Hits         8657     8631      -26     
- Misses       2805     2827      +22     
+ Partials      628      617      -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copy link
Copy Markdown
Member

@michaelkedar michaelkedar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

nice!

@cuixq cuixq merged commit f6c921c into google:main Apr 14, 2026
17 checks passed
@cuixq cuixq deleted the migrate branch April 14, 2026 01:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants