feat: update osv-scalibr (#2461)

This updates `osv-scalibr` to
google/osv-scalibr@98eab4f

---------

Co-authored-by: Gareth Jones <[email protected]>

Author: osv-robot

cmd/osv-scanner/__snapshots__/main_test.snap

@@ -47,7 +47,7 @@ OPTIONS:
 
 [Test_run/version - 1]
 osv-scanner version: 2.3.2
-osv-scalibr version: 0.4.1
+osv-scalibr version: 0.4.2
 commit: n/a
 built at: n/a
 

go.mod

@@ -18,7 +18,7 @@ require (
 	github.com/go-git/go-git/v5 v5.16.4
 	github.com/goccy/go-yaml v1.19.2
 	github.com/google/go-cmp v0.7.0
-	github.com/google/osv-scalibr v0.4.2-0.20260109123902-cf20290d7624
+	github.com/google/osv-scalibr v0.4.3-0.20260115232414-98eab4f26cf2
 	github.com/ianlancetaylor/demangle v0.0.0-20251118225945-96ee0021ea0f
 	github.com/jedib0t/go-pretty/v6 v6.7.8
 	github.com/modelcontextprotocol/go-sdk v1.2.0

go.sum

@@ -256,8 +256,8 @@ github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEE
 github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y=
 github.com/google/jsonschema-go v0.3.0 h1:6AH2TxVNtk3IlvkkhjrtbUc4S8AvO0Xii0DxIygDg+Q=
 github.com/google/jsonschema-go v0.3.0/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE=
-github.com/google/osv-scalibr v0.4.2-0.20260109123902-cf20290d7624 h1:LYMB45ouwdc5ZtUE9qhdn17CWizATSq/uLnsdIjRnA4=
-github.com/google/osv-scalibr v0.4.2-0.20260109123902-cf20290d7624/go.mod h1:3O4zXBBTy4lbryN1YZXpt/8r+AUJJMnsi5s0+oRFwJo=
+github.com/google/osv-scalibr v0.4.3-0.20260115232414-98eab4f26cf2 h1:g6ZUqmyLdQvuhMvONTJqMOuYDx8w5iAuV/Gav+WUm5A=
+github.com/google/osv-scalibr v0.4.3-0.20260115232414-98eab4f26cf2/go.mod h1:3O4zXBBTy4lbryN1YZXpt/8r+AUJJMnsi5s0+oRFwJo=
 github.com/google/pprof v0.0.0-20250403155104-27863c87afa6 h1:BHT72Gu3keYf3ZEu2J0b1vyeLSOYI8bm5wbJM/8yDe8=
 github.com/google/pprof v0.0.0-20250403155104-27863c87afa6/go.mod h1:boTsfXsheKC2y+lKOCMpSfarhxDeIzfZG1jqGcPl3cA=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=

internal/scalibrplugin/presets.go

@@ -123,9 +123,9 @@ var ExtractorPresets = map[string]extractors.InitMap{
 		// --- OS "lockfiles" ---
 		// These have very strict FileRequired paths, so we can safely enable them for source scanning as well.
 		// Alpine
-		apk.Name: {noCFG(apk.NewDefault)},
+		apk.Name: {apk.New},
 		// Debian
-		dpkg.Name: {noCFG(dpkg.NewDefault)},
+		dpkg.Name: {dpkg.New},
 	},
 	"directory": {
 		gitrepo.Name:  {noCFG(gitrepo.New)},
@@ -146,9 +146,9 @@ var ExtractorPresets = map[string]extractors.InitMap{
 
 		// --- OS packages ---
 		// Alpine
-		apk.Name: {noCFG(apk.NewDefault)},
+		apk.Name: {apk.New},
 		// Debian
-		dpkg.Name: {noCFG(dpkg.NewDefault)},
+		dpkg.Name: {dpkg.New},
 	},
 }