chore: bump osv scanner to 1.9.2

[zhaohuabing]

Fixes: google/osv-scanner#1453 (comment)
Related: #4945

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 66.69%. Comparing base (c6d5a54) to head (47d9574).
Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4956      +/-   ##
==========================================
- Coverage   66.76%   66.69%   -0.08%     
==========================================
  Files         209      209              
  Lines       32052    32052              
==========================================
- Hits        21399    21376      -23     
- Misses       9380     9394      +14     
- Partials     1273     1282       +9     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[shahar-h]

@zhaohuabing you can uncomment this now.

[shahar-h]

@zhaohuabing license scan fails because github.com/docker/[email protected]+incompatible license is not identified. I opened an issue in deps.dev. For now you can add license override in license-scan-config.toml:

[[PackageOverrides]]
name = "github.com/docker/cli"
version = "v27.4.0+incompatible"
ecosystem = "Go"
license.override = ["Apache-2.0"]
reason = "Unidentified license, remove once https://github.com/google/deps.dev/issues/146 is resolved"

[zirain]

+-------------------+-----------+-------------------------------------------------------------------+-----------------------------------+--------+
| LICENSE VIOLATION | ECOSYSTEM | PACKAGE                                                           | VERSION                           | SOURCE |
+-------------------+-----------+-------------------------------------------------------------------+-----------------------------------+--------+
| UNKNOWN           | Go        | github.com/docker/cli                                             | 27.4.0+incompatible               | go.mod |
| UNKNOWN           | Go        | github.com/docker/docker                                          | 27.4.1+incompatible               | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel                                          | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/exporters/prometheus                     | 0.55.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/exporters/stdout/stdoutmetric            | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/metric                                   | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/sdk                                      | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/sdk/metric                               | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | go.opentelemetry.io/otel/trace                                    | 1.33.0                            | go.mod |
| UNKNOWN           | Go        | google.golang.org/genproto/googleapis/api                         | 0.0.0-202[41](https://github.com/envoyproxy/gateway/actions/runs/12478808774/job/34826939541#step:4:42)209162323-e6fa225c2576 | go.mod |
| UNKNOWN           | Go        | google.golang.org/genproto/googleapis/rpc                         | 0.0.0-20241209162323-e6fa225c2576 | go.mod |
| UNKNOWN           | Go        | helm.sh/helm/v3                                                   | 3.16.4                            | go.mod |
+-------------------+-----------+-------------------------------------------------------------------+-----------------------------------+--------+

[zirain]

we can not ignore them all one by one.

[shahar-h]

we can not ignore them all one by one.

Wow! I'll open an issue in deps.dev regarding all of these go packages old data and update here.
For now we can add continue-on-error: true to avoid failing on license violations:

gateway/.github/workflows/license-scan.yml

Line 27 in e5f8630

continue-on-error: true # TODO remove once all issues are resolved