Repository: google/osv-scanner
Pull request #490 (2023-08-15 06:40:56)

Fix some vulns and ignore others
Ignore the two new go vulns in the go test project

Update docs rubygems dependency to resolve vulnerability.

Also fix issue with output I accidentally introduced in an earlier PR today.


Patch:
diff --git a/cmd/osv-scanner/main.go b/cmd/osv-scanner/main.go
index 5591448..a924c41 100644
--- a/cmd/osv-scanner/main.go
+++ b/cmd/osv-scanner/main.go
@@ -148,7 +148,7 @@ func run(args []string, stdout, stderr io.Writer) int {
 				}
 			}
 
-			if r, err = reporter.New(format, context.App.Writer, context.App.ErrWriter, termWidth); err != nil {
+			if r, err = reporter.New(format, stdout, stderr, termWidth); err != nil {
 				return err
 			}
 
diff --git a/docs/Gemfile.lock b/docs/Gemfile.lock
index 1e299d7..ea74909 100644
--- a/docs/Gemfile.lock
+++ b/docs/Gemfile.lock
@@ -1,22 +1,22 @@
 GEM
   remote: https://rubygems.org/
   specs:
-    activesupport (7.0.4.3)
+    activesupport (7.0.7)
       concurrent-ruby (~> 1.0, >= 1.0.2)
       i18n (>= 1.6, < 2)
       minitest (>= 5.1)
       tzinfo (~> 2.0)
-    addressable (2.8.4)
+    addressable (2.8.5)
       public_suffix (>= 2.0.2, < 6.0)
     coffee-script (2.4.1)
       coffee-script-source
       execjs
     coffee-script-source (1.11.1)
     colorator (1.1.0)
-    commonmarker (0.23.9)
+    commonmarker (0.23.10)
     concurrent-ruby (1.2.2)
-    dnsruby (1.61.9)
-      simpleidn (~> 0.1)
+    dnsruby (1.70.0)
+      simpleidn (~> 0.2.1)
     em-websocket (0.5.3)
       eventmachine (>= 0.12.9)
       http_parser.rb (~> 0)
@@ -24,7 +24,7 @@ GEM
       ffi (>= 1.15.0)
     eventmachine (1.2.7)
     execjs (2.8.1)
-    faraday (2.7.4)
+    faraday (2.7.10)
       faraday-net_http (>= 2.0, < 3.1)
       ruby2_keywords (>= 0.0.4)
     faraday-net_http (3.0.2)
@@ -209,8 +209,8 @@ GEM
       jekyll (>= 3.5, < 5.0)
       jekyll-feed (~> 0.9)
       jekyll-seo-tag (~> 2.1)
-    minitest (5.18.0)
-    nokogiri (1.14.3-x86_64-linux)
+    minitest (5.19.0)
+    nokogiri (1.15.4-x86_64-linux)
       racc (~> 1.4)
     octokit (4.25.1)
       faraday (>= 1, < 3)
@@ -218,11 +218,11 @@ GEM
     pathutil (0.16.2)
       forwardable-extended (~> 2.6)
     public_suffix (4.0.7)
-    racc (1.6.2)
+    racc (1.7.1)
     rb-fsevent (0.11.2)
     rb-inotify (0.10.1)
       ffi (~> 1.0)
-    rexml (3.2.5)
+    rexml (3.2.6)
     rouge (3.26.0)
     ruby2_keywords (0.0.5)
     rubyzip (2.3.2)


Test patch:
diff --git a/internal/sourceanalysis/integration/fixtures-go/test-project/osv-scanner.toml b/internal/sourceanalysis/integration/fixtures-go/test-project/osv-scanner.toml
index 08e8d37..4acb3a9 100644
--- a/internal/sourceanalysis/integration/fixtures-go/test-project/osv-scanner.toml
+++ b/internal/sourceanalysis/integration/fixtures-go/test-project/osv-scanner.toml
@@ -11,4 +11,14 @@ reason = "This is a intentionally vulnerable test project"
 [[IgnoredVulns]]
 id = "GO-2023-1572"
 # ignoreUntil = n/a
-reason = "This is a intentionally vulnerable test project"
\ No newline at end of file
+reason = "This is a intentionally vulnerable test project"
+
+[[IgnoredVulns]]
+id = "GO-2023-1989"
+# ignoreUntil = n/a
+reason = "This is a intentionally vulnerable test project"
+
+[[IgnoredVulns]]
+id = "GO-2023-1990"
+# ignoreUntil = n/a
+reason = "This is a intentionally vulnerable test project"