← Back to issue list

Golang osv scanner is outdated

View original Github issue

Metadata

Project
starflow
Number
#54
Type
issue
State
open
Author
cmatsuoka
Labels
—
Created
Updated
Closed
—

Current evaluation

Golang OSV scanner snap is outdated and cannot handle go.mod toolchain entries. Upstream snap fix exists in edge channel but workflow still installs stable. Unlabelled, no assignee, inactive 410 days.

Suggested action: needs triage

Reason: Filed by maintainer cmatsuoka but has no labels, no assignee, and no committed action plan. Comments from @lengau and @upils confirm the upstream snap is fixed and available in the edge channel, and @lengau suggested using edge, but no maintainer has followed through. The workflow at .github/workflows/scan-golang.yaml still runs 'sudo snap install osv-scanner' without a channel, so the problem persists.

Impact: 40 Quick Win: 35.2 Staleness: 72 Complexity: 12 Confidence: 78 Support Request: 5

Issue body

Newer versions of the osv scanner are needed to handle the toolchain entry in go.mod.

Evaluation history

Date Model Scores Action Summary
qwen/qwen3.8-27b
Impact: 40
Quick Win: 35.2
Staleness: 72
Complexity: 12
Confidence: 78
Support Request: 5
needs triage Golang OSV scanner snap is outdated and cannot handle go.mod toolchain entries. Upstream snap fix exists in edge channel but workflow still installs stable. Unlabelled, no assignee, inactive 410 days.
qwen/qwen3.6-35b-a3b
Staleness: 85
Complexity: 15
Confidence: 80
Support Request: 10
needs triage Request to update osv-scanner snap for Go toolchain support. A fix exists in the edge channel, but the issue remains unlabelled and inactive for over a year.
qwen3.6-35b-a3b-mtp-q6
Staleness: 90
Complexity: 20
Confidence: 80
Support Request: 10
close stale Unresolved request to update the osv-scanner snap to handle Go toolchain entries. Issue has been inactive for over a year with no maintainer action or configuration changes applied.
qwen3.6-35b-a3b-mtp-q6
Staleness: 85
Complexity: 15
Confidence: 75
Support Request: 10
close stale Golang osv-scanner needs updating to support go.mod toolchain entries. The snap package is fixed and the new version is on the edge channel. The team is evaluating whether to adopt the edge release for the nonce. Awaiting implementation decision.

Update history

No update history recorded yet.

Related work

  • Blocked By: iosifache/osv-scanner-snap#2 (confidence 85%)

    Referenced in issue comments as the upstream request to release a newer osv-scanner snap version; @upils confirmed it is now fixed but only in the edge channel.

Related issues

No related issues found above the similarity threshold.