chore(ocm-kit): update ocm-kit tooling

[ocmbot]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/google/osv-scanner/v2/cmd/osv-scanner	v2.4.0 → v2.5.0
ocm.software/open-component-model/cli	v0.11.0 → v0.13.0

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

google/osv-scanner (github.com/google/osv-scanner/v2/cmd/osv-scanner)

v2.5.0

Compare Source

Features & Refactors:

• Full OSV-Scalibr pipeline: Migrated scanning, filtering, and matching in osv-scanner to use osv-scalibr end-to-end, so most plugins that's supported in osv-scalibr should be supported via the --experimental-plugins flag (#​2935).

• New extractors and ecosystem support via osv-scalibr:

  • Add javascript/vsix extractor to support scanning VS Code extension (.vsix) packages.
  • Extend ecosystem mapping for:
    • SUSE
    • Azure Linux / Mariner
    • Alpaquita
    • Mageia
    • openSUSE Leap
    • Debian and Ubuntu PURL

• PURL Type Resolution: Updated osvscannerjson extractor to map ecosystem names to valid PURL types (golang, gem, cargo, npm, etc.).

Fixes:

• Bug #​2915 Fix issue where osv-scanner reported already-fixed advisories as unfixed for RHEL-family RPM packages (Red Hat, AlmaLinux, Rocky Linux) with epochs by sending epoch-qualified versions.
• Fix Python requirements.txt extractor in osv-scalibr, specifically regular expressions used to extract package names and per-requirement options (Fixes #​2940, #​2931)
• Fix NPM and Composer PURL generation in osv-scalibr, separating package namespace (scope) from package name

open-component-model/open-component-model (ocm.software/open-component-model/cli)

v0.13.0: OCM 0.13.0

Compare Source

[0.13.0] - promoted from [0.13.0-rc.1] on 2026-08-11

🚀 Features

• (transfer) Add multi-version discovery to transfer cv (#​2665)
• Wget transfer cli integration test (#​3137)

🐛 Bug Fixes

• Adjust FlatMap merging logic (#​3118)

📚 Dependencies

• (deps) Update gcr.io/distroless/static:nonroot docker digest to f7f8f72 (#​3125)
• (deps) Update ocm monorepo go module dependencies (#​3126)
• (deps) Update ocm monorepo go module dependencies to e023dbc (#​3132)
• (deps) Update ocm monorepo go module dependencies to 3b46fe9 (#​3140)
• (deps) Update kubernetes controller dependencies (non-major) (#​3147)
• (deps) Update ghcr.io/open-component-model/kubernetes/controller:latest docker digest to ac7753c (#​3146)
• (deps) Update module github.com/cloudflare/circl to v1.6.4 (#​3148)
• (deps) Update module go.yaml.in/yaml/v4 to v4.0.0-rc.6 (#​3150)
• (deps) Update module github.com/shirou/gopsutil/v4 to v4.26.6 (#​3149)
• (deps) Update module helm.sh/helm/v4 to v4.2.2 (#​3151)
• (deps) Update module github.com/cyphar/filepath-securejoin to v0.7.0 (#​3153)
• (deps) Update module github.com/moby/moby/api to v1.55.0 (#​3154)
• (deps) Update testcontainers-go monorepo to v0.43.0 (#​3158)
• (deps) Update module github.com/moby/moby/client to v0.5.0 (#​3155)
• (deps) Update kubernetes controller dependencies (non-major) (#​3152)
• (deps) Update module github.com/coreos/go-oidc/v3 to v3.19.0 (#​3157)
• (deps) Update github.com/lufia/plan9stats digest to 477a660 (#​3187)
• (deps) Update module github.com/go-openapi/jsonpointer to v0.23.2 (#​3189)
• (deps) Update module github.com/moby/sys/user to v0.4.1 (#​3190)
• (deps) Update kubernetes controller dependencies (non-major) (#​3191)
• (deps) Update ocm monorepo go module dependencies to 379f239 (#​3145)
• (deps) Update github.com/opencontainers/go-digest digest to e5208fd (#​3188)
• (deps) Update kubernetes controller dependencies (non-major) (#​3192)
• (deps) Update module github.com/google/cel-go to v0.29.0 [security] (#​3209)

📚 Documentation

• (docs) Add example for resource download with extra identity (#​3174)

Get This Release

Install the OCM CLI

curl -sfL https://ocm.software/install-cli.sh | OCM_VERSION=0.13.0-rc.1 bash

For alternative installation options, see the installation guide.

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:0.13.0-rc.1 --help

See the container image guide for more details.

Deploy the OCM Controller

Install into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--version 0.13.0-rc.1 \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for full configuration options.

OCM Component Distribution (for existing OCM users)

Every OCM release is published as OCM component versions to ghcr.io/open-component-model - the same distribution mechanism OCM enables for your own software. Components in this release:

Component	Contents
ocm.software/ocm:0.13.0-rc.1	Product wrapper referencing CLI + controller
ocm.software/cli:0.13.0-rc.1	CLI binaries and OCI image
ocm.software/kubernetes/controller:0.13.0-rc.1	Controller image and Helm chart

Inspect the full product component:

ocm get component-version ghcr.io/open-component-model//ocm.software/ocm:0.13.0-rc.1 -o yaml

Download a CLI binary directly via OCM (requires OCM CLI already installed; replace os and architecture as needed — e.g. linux/amd64, darwin/arm64):

ocm download resource ghcr.io/open-component-model//ocm.software/cli:0.13.0-rc.1 \
--identity os=linux,architecture=amd64

Community & Contributors

This release we had a total of 5 contributors!
If you want to engage with us, check our community page!

v0.12.0: OCM 0.12.0

Compare Source

[0.12.0] - promoted from [0.12.0-rc.1] on 2026-07-28

🚀 Features

• Register wget in cli (#​3089)

🐛 Bug Fixes

• Config discovery within .config folders (#​3070)

📚 Dependencies

• (deps) Update ocm monorepo go module dependencies (#​3005)
• (deps) Add renovate rules for grouping kubernetes/controller and ocm v1 hacks cli doc creation (#​2991)
• (deps) Update go module directive to v1.26.4 (fixes #​3010) (#​3014)
• (deps) Update ocm monorepo go module dependencies to 7e7276f (#​3008)
• (deps) Update ocm monorepo go module dependencies to c9a42a6 (#​3019)
• (deps) Update module oras.land/oras-go/v2 to v2.6.1 (#​3024)
• (deps) Update ocm monorepo go module dependencies (#​3020)
• (deps) Update github.com/google/pprof digest to 7023385 (#​3035)
• (deps) Update ghcr.io/open-component-model/kubernetes/controller:latest docker digest to 67c781b (#​3034)
• (deps) Update module github.com/go-openapi/jsonreference to v0.21.6 (#​3037)
• (deps) Update module github.com/prometheus/common to v0.68.1 (#​3038)
• (deps) Update module github.com/jedib0t/go-pretty/v6 to v6.8.0 (#​3043)
• (deps) Update module github.com/moby/sys/sequential to v0.7.0 (#​3042)
• (deps) Update module golang.org/x/sync to v0.21.0 (#​3044)
• (deps) Update ocm monorepo go module dependencies (#​3033)
• (deps) Update ocm monorepo go module dependencies (#​3055)
• (deps) Update ocm monorepo go module dependencies (#​3057)
• (deps) Update ocm monorepo go module dependencies to cb422b7 (#​3065)
• (deps) Update ocm monorepo go module dependencies to 1f13254 (#​3076)
• (deps) Update gcr.io/distroless/static:nonroot docker digest to d29e660 (#​3074)
• (deps) Update ocm monorepo go module dependencies (#​3081)
• (deps) Update kubernetes dependencies to v0.36.2 (#​3096)
• (deps) Update kubernetes controller dependencies (non-major) (#​3095)
• (deps) Update module go.yaml.in/yaml/v4 to v4.0.0-rc.5 (#​3097)
• (deps) Update module github.com/jedib0t/go-pretty/v6 to v6.8.1 (#​3099)
• (deps) Update module github.com/felixge/httpsnoop to v1.1.0 (#​3101)
• (deps) Update module github.com/onsi/ginkgo/v2 to v2.30.0 (#​3103)
• (deps) Update ocm monorepo go module dependencies to eb59f50 (#​3084)
• (deps) Update module helm.sh/helm/v4 to v4.2.1 (#​3100)
• (deps) Update golang x repositories (#​3102)
• (deps) Update debian:bookworm-slim docker digest to 7b140f3 (#​3109)
• (deps) Oras-go 2.6.2 (#​3106)
• (deps) Update ocm monorepo go module dependencies (#​3111)

Quick installation and usage guide

CLI

Install the latest version of the OCM CLI:

curl -sfL https://ocm.software/install-cli.sh | bash

(For more installation options, see the installation guide.)

You can also run the OCM CLI in a container without installing it:

docker run --rm -t ghcr.io/open-component-model/cli:latest --help

See the container image guide for more details.

Controller

Install the latest version of the OCM Controllers into a Kubernetes cluster via Helm:

helm install ocm-k8s-toolkit oci://ghcr.io/open-component-model/kubernetes/controller/chart \
--namespace ocm-k8s-toolkit-system \
--create-namespace

See the controller setup guide for more details.

Community & Contributors

This release we had a total of 4 contributors!
If you want to engage with us, check our community page!

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.