Skip to content

refactor: use guidedremediation from osv-scalibr for version updates#2719

Open
cuixq wants to merge 3 commits intogoogle:mainfrom
cuixq:migrate
Open

refactor: use guidedremediation from osv-scalibr for version updates#2719
cuixq wants to merge 3 commits intogoogle:mainfrom
cuixq:migrate

Conversation

@cuixq
Copy link
Copy Markdown
Contributor

@cuixq cuixq commented Apr 13, 2026

#2675

This PR refactors the update command to use the guidedremediation package from github.com/google/osv-scalibr to handle dependency updates.

  • Migrated to osv-scalibr: Replaced internal remediation/suggest and upgrade logic with guidedremediation.Update.
  • Updated Snapshots: Updated the test snapshots to reflect the slightly adjusted output messages and the behavior of the suggester which prefers stable package versions.

@cuixq cuixq marked this pull request as ready for review April 13, 2026 06:27
@cuixq cuixq requested a review from michaelkedar April 13, 2026 06:28
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 13, 2026

Codecov Report

❌ Patch coverage is 83.33333% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.47%. Comparing base (800145f) to head (3de67e3).

Files with missing lines Patch % Lines
cmd/osv-scanner/update/command.go 83.33% 2 Missing and 2 partials ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #2719      +/-   ##
==========================================
- Coverage   71.60%   71.47%   -0.13%     
==========================================
  Files         164      164              
  Lines       12090    12075      -15     
==========================================
- Hits         8657     8631      -26     
- Misses       2805     2827      +22     
+ Partials      628      617      -11     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants