chore(deps): update module osv-scanner to v2.5.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
osv-scanner	v2.4.0 → v2.5.1

---

Release Notes

google/osv-scanner (osv-scanner)

v2.5.1

Compare Source

Fixes:

• Preserve package namespaces when querying osv.dev API (fixes #​2978).
• Re-add support for the OSV_SCANNER_LOCAL_DB_CACHE_DIRECTORY environment variable (fixes #​2983).
• Fix local vulnerability matching (--offline-vulnerabilities) not working when network capability is NetworkOnline.

v2.5.0

Compare Source

Features & Refactors:

• Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#​2935).

• New extractors and ecosystem support via osv-scalibr:

  • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
  • Extend ecosystem mapping for:
    • SUSE
    • Azure Linux / Mariner
    • Alpaquita
    • Mageia
    • openSUSE Leap
    • Debian and Ubuntu PURL

• PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

• Bug #​2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
• Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #​2940, #​2931)
• Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.