fix(spdx): bound recursion depth when parsing license expressions - #3032

osv-scanner 2.6.0

Created-by: HarmonybrewBot
Commit-by: HarmonybrewBot
Merged-by: HarmonybrewBot
Description: Created by `brew bump`

---

Created with `brew bump-formula-pr`.<details>
  <summary>release notes</summary>
  <pre>### Features:

- [Feature #2888](google/osv-scanner#2888) Publish multi-arch (`linux/arm64`) image for `osv-scanner-action`.
- [Feature #3066](google/osv-scanner#3066) Configure retry policy with exponential backoff for transient gRPC errors in scalibr plugins.
- **Dependency scanning & lockfile improvements via `osv-scalibr`**:
  - Extract Git repository URLs and support local OSV tag matching for Git-based dependencies in JavaScript lockfiles (`package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`, `bun.lock`).
  - Assign `pkg:git` PURL type to Git commit-pinned dependencies across JS and Cargo lockfiles to avoid false positives against registry packages ([#2863](google/osv-scanner#2863)).
  - Retain packages without a version or PURL in SPDX output ([google/osv-scalibr#2375](google/osv-scalibr#2375)) and merge related packages based on lineage relationships.
- **New extractors and plugin support via `osv-scalibr`**:
  - Many additional filetypes are supported. These are not enabled by default yet, so if you need a particular new filetype, use `--experimental-plugins` flag. See ["Supported Inventory Types"](https://github.com/google/osv-scalibr/blob/3f6473abebb329f3e0dc7e9e0d9c91e0c6e51277/docs/supported_inventory_types.md) for the extractor name.

### Fixes:

- [Bug #3075](google/osv-scanner#3075) Ensure `results` property in JSON output is an empty array `[]` instead of `null` when scanning with `--allow-no-lockfiles` and no lockfiles are found.
- [Bug #3071](google/osv-scanner#3071) Preserve valid UTF-8 sequences when truncating multibyte text in vertical output.
- [Bug #2919](google/osv-scanner#2919) Add filter to show packages with license violations but no vulnerabilities in the HTML report.
- [Bug #3049](google/osv-scanner#3049) Keep filter dropdown checklist open when clicking options in the HTML report.
- [Bug #3023](google/osv-scanner#3023) Guard against panic on empty or whitespace-only license expressions in SPDX license evaluation.
- [Bug #3032](google/osv-scanner#3032) Bound recursion depth when parsing SPDX license expressions to prevent stack overflow on deeply nested expressions.
- [Bug #3061](google/osv-scanner#3061) Remove purl caching in scan filtering to avoid dropping SBOM packages without purls.
- [Bug #3063](google/osv-scanner#3063) Log plugin and enricher errors during container scans instead of failing silently.
- [Bug #2977](google/osv-scanner#2977) Return an error instead of aborting the process (`log.Fatalf`) when an `rlib` archive has no object file during Rust source analysis.
- [Bug #3083](google/osv-scanner#3083) Return a descriptive error from `DoContainerScan` when `ScannerActions.Image` is empty instead of panicking.
- **Fixes via `osv-scalibr`**:
  - Fix false-positive Go standard library matches for packages with module paths ending in `/go` (e.g. `pkg:golang/github.com/json-iterator/go`) ([#3017](google/osv-scanner#3017)).
  - Secure guided remediation file operations with `os.Root` to prevent path traversal attacks ([google/osv-scalibr#2363](google/osv-scalibr#2363)).
  - Prevent OOM and disk exhaustion issues with tar bombs during archive extraction.
  - Strip platform suffix from RubyGems versions in CycloneDX ([google/osv-scalibr#2313](google/osv-scalibr#2313)).
  - Ignore `.deps.json` files that don't have an object as their root in `dotnet/depsjson` extractor ([google/osv-scalibr#2423](google/osv-scalibr#2423)).

### Misc:

- Update `osv-scalibr` to `v0.5.3-0.20260911142458-3090dbb7aaa2` ([#3079](google/osv-scanner#3079)).
- Update Go to v1.27 and `golangci-lint` to v2.13 ([#3046](google/osv-scanner#3046)).
  - This now supports call analysis on go v1.27 projects.
- Update `google.golang.org/grpc` to v1.83.2 ([#3062](google/osv-scanner#3062)).

## New Contributors
* @summerpan688 made their first contribution in google/osv-scanner#2919
* @BenkiNew made their first contribution in google/osv-scanner#3038
* @Amey-Thakur made their first contribution in google/osv-scanner#3032
* @sl4x0 made their first contribution in google/osv-scanner#3023
* @shubhransh-gupta made their first contribution in google/osv-scanner#3049
* @kobihikri made their first contribution in google/osv-scanner#2977
* @skialpine made their first contribution in google/osv-scanner#2888
* @keeltrace made their first contribution in google/osv-scanner#3071
* @Muszic made their first contribution in google/osv-scanner#3083
* @knQzx made their first contribution in google/osv-scalibr#2313
* @micrictor made their first contribution in google/osv-scalibr#2047
* @srossross made their first contribution in google/osv-scalibr#2375

**Full Changelog**: https://github.com/google/osv-scanner/compare/v2.5.1...v2.6.0</pre>
  <p>View the full release notes at <a href="https://github.com/google/osv-scanner/releases/tag/v2.6.0">https://github.com/google/osv-scanner/releases/tag/v2.6.0</a>.</p>
</details>
<hr>

See merge request: Harmonybrew/homebrew-core!20195