deps: update module github.com/anchore/syft to v1.41.2 #571

[!Important]
This release bumps github.com/containerd/containerd to v2, which will cause compiler errors if used alongside other dependencies that use v1 of containerd. See anchore/stereoscope#495 for a detailed discussion.

Bug Fixes

mongodb binary not detected manual/source install [#4540 #4541 @rezmoss]

(Full Changelog)

`v1.40.0`

Compare Source

Added Features

Exclude development or test dependencies for PNPM Package type [#4430 #4487 @rezmoss]
Catalog istio binary (pilot-discovery, pilot-agent) [#4508 #4521 @witchcraze]
Catalog envoy binary [#4506 #4530 @witchcraze]
Catalog grafana binary [#4505 #4516 @witchcraze]
Add a binary classifier for valkey [#3400 #4509 @witchcraze]

Bug Fixes

old bitnami images without spdx files arent getting picked up correctly in the catalog [#4529 #4532 @rezmoss]
wrong traefik rc versions at binary detection [#3535 #4499 @rezmoss]
FromPOSIX() in internals\windows\path.go assumes that all Windows root paths must have a colon terminator [#4070 #4075 @luissantosHCIT]
binary cataloger is picking up the go version instead of the actual binary version in traefik experimental images [#4498 #4499 @rezmoss]

(Full Changelog)

`v1.39.0`

Compare Source

Added Features

add support for Gemfile.next.lock [#4457 @HatiCode]
Command output to give more information on what catalogers look for and what they can find [#4155 #4317 @wagoodman]
Support reading lzma compressed .go.buildinfo sections with upx [#4411 #4480 @wagoodman]
Specify specific snap revision to pull [#4389 #4439 @VictorHuu]
Cannot detect embedded deps.json metadata in single-file .NET binaries [#4344 #4375 @rezmoss]
ELF note cataloger does not pick up OS field, but should [#4384 #4438 @VictorHuu]

Bug Fixes

remove debug print statement in dependency parser [#4412 @cgreeno]
dotnet-deps cataloger should skip project references with type "project" when building the sbom [#4423 #4436 @rezmoss]
File digests not computed when using --base-path [#4410 #4478 @wagoodman]
Syft should not define subpaths by default in PURLs [#4394 #4395 @rezmoss]
go: valid purl but incorrect name [#1737 #4395 @rezmoss]
Incorrect Go module PURL generation when module path contains /vN (e.g. /v5) [#4316 #4395 @rezmoss]
Failing to convert npm repository information correctly to SPDX [#4362 #4390 @kendrickm]

(Full Changelog)

`v1.38.2`

Compare Source

Bug Fixes

drop cpe from gguf [#4383 @spiffcs]
emit lua rockspec dependencies in metadata [#4376 @willmurphyscode]
Invalid SBOMs are created when GO replace directive is used [#4415 #4419 @VictorHuu]
Incorrect CPE for Vercel's Next js [#4443 #4450 @willmurphyscode]
v1.38.0 generates empty sbom for tgz sources [#4416 #4421 @VictorHuu]
Syft: The dependency graph does not include all Requires-Dist relationships defined in the package’s METADATA file [#4401 #4408 @willmurphyscode]

(Full Changelog)

`v1.38.1`

Compare Source

`v1.38.0`

Compare Source

Added Features

add support for cataloging GGUF models [#4184 #4279 @spiffcs]
Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]

Bug Fixes

Support extras statements in Python PDM cataloger [#4352 @wagoodman]
Preserve --from argument order [#4350 @wagoodman]
SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
empty PURL output in dependency snapshot format breaks sbom-action [#4311]
Interface includes constraint elements, can only be used in type parameters [#4346]
Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
Upgrade to Golang 1.25.4 [#4341]

Additional Changes

migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
Add license enrichment from pypi to python packages [#4295 @timols]
license file search [#4327 @kzantow]

(Full Changelog)

`v1.37.0`

Compare Source

Added Features

Refactor fileresolver to not require base path [#4298 @Rupikz]
Describe cataloger capabilities via test observations [#4318 @wagoodman]
Support Java resource adapter extension .far as a Java archive [#4183 #4193 @kyounghunJang]
Add Java resource adapter extension ".rar" as supported Java archive [#4136 #4137 @thomassui]

Bug Fixes

fix empty PURL Github format [#4312 @rezmoss]
Canonicalize Ghostscript CPE/PURL for ghostscript packages from PE Binaries [#4308 @kdt523]
Respect "rpmmod" PURL qualifier [#4314 @willmurphyscode]
fix dpkg packages that are in deinstalled state should not be in SBOM [#3063 #4231 @rkirk-nos]

(Full Changelog)

`v1.36.0`

Compare Source

Added Features

Add the ability to fetch remote licenses for pnpm-lock.yaml files [#4286 @timols]
support universal (fat) mach-o binary files [#4278 @JoeyShapiro]
pdm support [#2709 #4234 @paulslaby]

Bug Fixes

Remove duplicate image source providers [#4289 @Rupikz]
syft can't extract go module information from executables on Windows [#4271 #4285 @JoeyShapiro]

(Full Changelog)

`v1.35.0`

Compare Source

`v1.34.2`

Compare Source

Bug Fixes

Extract zip archive with multiple entries [#4283 @Rupikz]
panic while resolving maven properties in archive parser [#4288 #4290 @kzantow]

(Full Changelog)

`v1.34.1`

Compare Source

Added Features

feat: enhance setup.py parser to handle unquoted dependencies [#4255 @HalaAli198]
feat: support for identifying ffmpeg/libav libraries [#4227 @popey]
feat: PNPM latest lockfile (version 9.0) [#3927 #4256 @bernardoamc]
Add Windows ARM64 releases [#4179 #4237 @compnerd]

Bug Fixes

fix: SBOM CPE mismatch for Qt5 causes Grype to miss CVE matches [#4036 #4093 @hawkaii]
fix: use of manifest files present in Snap packages when generating SBOMs [#4147 #4151 @popey]
fix: Pom xml only archive parser [#4272 @douglasclarke]

(Full Changelog)

`v1.34.0`

Compare Source

`v1.33.0`

Compare Source

Added Features

Modify RpmDBEntry to include modularityLabel for cyclonedx [#4212 @sfc-gh-rmaj]
Add locations onto packages read from Java native image SBOMs [#4186 @rudsberg]

(Full Changelog)

`v1.32.0`

Compare Source

Added Features

Catalog entire build list for Go projects, not just packages listed in go.mod [#432 #4127 @spiffcs]
package.json authors keyword parsing [#2250 #4003 @popey]
Conda ecosystem support (basic) [#4002 @SimeonStoykovQC]

Bug Fixes

When scanning the FFmpeg binary with Syft a new package is now added [#3988 #3994 @popey]
Warn loudly if SQLite driver is not present when needed [#3234 #4150 @kzantow]

Additional Changes

Update dependencies to use go.yaml.in/yaml [#4157 @n-bes]

(Full Changelog)

`v1.31.0`

Compare Source

Added Features

Option to set PackageSupplier in root of SPDX document generated by CLI [#3098 #4131 @spiffcs]

Bug Fixes

closed reader during java binary detection [#4129 @kzantow]
support multiple letters in openssl patch version [#4106 @honigbot]
Can not have license ID [#1964 #4132 @spiffcs]
Syft sometimes reports URL for license value when scanning JARs with a URL in Bundle-License field of manifest [#3186]

(Full Changelog)

`v1.30.0`

Compare Source

Added Features

add binary classifier for hashicorp vault [#4121 @willmurphyscode]

Bug Fixes

fix: update nondeterministic Java archive cataloging and improve groupID [#3521 #4118 @kzantow]

(Full Changelog)

`v1.29.1`

Compare Source

Bug Fixes

Missing license information for tzdata [#4102]
Improve JVM Scan Accuracy for JDK and JRE Detection [#4071 #4046 @kzantow]
Azul JDK classified as Oracle JRE [#3893 #4046 @kzantow]

(Full Changelog)

`v1.29.0`

Compare Source

Added Features

Catalog python uv.lock files [#3268 #3763 @jkugler]

Additional Changes

Pkg Metadata type unmarshal bug [#4043 @houdini91]

(Full Changelog)

`v1.28.0`

Compare Source

Added Features

add native support for snap packages [#1088 #3929 @wagoodman]

Additional Changes

upgrade tablewriter dependency to use new API [#3990 @cpanato]

(Full Changelog)

`v1.27.1`

Compare Source

Bug Fixes

Allow decoding of enterprise-modified anchorectl json files [#3997 @wagoodman]
Allow decoding of anchorectl json files [#3973 @wagoodman]

Additional Changes

provide separate nonroot image [#3998 @kzantow]

(Full Changelog)

`v1.27.0`

Compare Source

Added Features

add syft schema version to version command [#3949 @spiffcs]

Bug Fixes

Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#3967 @jayvdb]
Remove CPE product candidates for opentelemetry and redis Rust crates [#3962 @jayvdb]
Harden Container Runtime with Non-Root User [#3941 @MikeTheCyberGuy]
terraform provider lock entries should not require constraints [#3934 @ghouscht]
sbom cataloger returning upstream package [#3662 #3981 @kzantow]
Syft missing md5 sums and list data for dpkg packages under status.d/ [#3912]
Failure to detect dependency relationships between Python packages [#3958 #3965 @christoph-blessing]
Heavy memory consumption when directory scanning deb source [#3928 #3953 @kzantow]
In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#3942 #3944 @kzantow]
Syft incorrectly reports multiple APKs as parents of symlinked files [#3847 #3923 @luhring]

(Full Changelog)

A HUGE thank you to @rezmoss for his help identifying and solving an issue causing excessive time and memory consumption with large numbers of symlinks! ❤️

`v1.26.1`

Compare Source

Bug Fixes

Dotnet deps binary cataloger hangs [#3919 #3930 @kzantow]

(Full Changelog)

`v1.26.0`

Compare Source

Added Features

Read version resources from non-.NET DLLs and executables [#3842 #3911 @wagoodman]

Bug Fixes

pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#3922 @wagoodman]
syft 1.24.0 debug container - wget fails TLS [#3891 #3915 @spiffcs]

(Full Changelog)

`v1.25.1`

Compare Source

Additional Changes

remove go-rpmdb replace directive [#3908 @wagoodman]

(Full Changelog)

`v1.25.0`

Compare Source

Added Features

Add PHP interpreter + extensions cataloger [#2585 @LaurentGoderre]

Bug Fixes

update license content filtering default case to be 'none' for no content [#3903 @spiffcs]
Distinguish openjdk vs jdk when using file source [#3895 @adammcclenaghan]
Make it discoverable if Native Image contains no embedded SBOM [#3731 #3805 @sathiya06]

(Full Changelog)

`v1.24.0`

Compare Source

Added Features

Add cataloger for Dart pubspec [#3292 @LaurentGoderre]
Translate Portage license strings to SPDX expressions [#1763 @wagoodman]
Use package ID from decoded SBOMs when provided [#1872 @jneate]
Annotate visible/hidden paths when all-layers scope [#3855 @wagoodman]
Add support for PHP Pear [#2775 @LaurentGoderre]
Detect whether full license text or a license name has been provided [#3088 #3876 @spiffcs #3450 @spiffcs]
Add Cataloger for Homebrew on macOS [#3632 #3724 @rezmoss]
Provide a way to get the LayerID the package was first found in [#435 #3858 @wagoodman #3138 @tomersein]
Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#3324 #3873 @wagoodman]
Upgrade base Docker image to gcr.io/distroless/static-debian12 [#3840 #3862 @bgoareguer]
Return full license string instead of SHA256 hash when license string exceeds 64 characters [#3780 #3844 @spiffcs]
Detect nix dependencies [#3814 #3837 @wagoodman]

Bug Fixes

update license sort to be stable with contents field [#3860 @spiffcs]
Improve detection of erlang binary in alpine Linux [#3839 @avodotiiets]
Do not search for main module versions within binary contents by default [#3874 @wagoodman]
dpkg license improvement for non SPDX licenses [#3090 #3888 @spiffcs]
CycloneDX group field not symmetrically handled by encoder/decoders [#2981 #3853 @kzantow]
Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#3872 #3875 @wagoodman]
Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#3864]
.NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#3866 #3869 @wagoodman]
Propagate error in FileSourceProvider instead of warn log [#3831 #3845 @Rupikz]
Update github.com/Masterminds/semver package [#3829 #3836 @popey]
go-module-file-cataloger fails if symlinks in path [#3614 #3783 @VictorHuu]
Support fluent-bit some versions of arm/s390x images [#3793 #3817 @VictorHuu]

Additional Changes

update rust test fixtures to latest [#3852 @spiffcs]

(Full Changelog)

`v1.23.1`

Compare Source

Additional Changes

Resolve owned file paths when searching for overlaps [#3828 @wagoodman]

(Full Changelog)

`v1.23.0`

Compare Source

Added Features

Support skipping archive extraction with file source [#3795 @adammcclenaghan]
Use the R cataloger in directory scans [#3774 @spiffcs]
Add support for detecting javascript assets in .NET projects using libman [#3825 @wagoodman]
Parse GitHub actions comments [#3776 @wagoodman]
Support chrome binary detection [#3174 #3136 @lem-onade]
Add support for detecting undeclared license files scanning from python installations [#2624 #3779 @wagoodman]

Bug Fixes

.NET cataloger should consider compile target paths from deps.json [#3821 @wagoodman]
Skip license scanner injection [#3796 @adammcclenaghan]
Delete collection name/type key entries when empty [#3797 @adammcclenaghan]
Use module name over relative paths in go.mod replace directives [#3812 @VictorHuu]
Correct variable names for Conan lock parsing version handling [#3802 @musangk]
Consider DLL claims for dependencies of .NET packages from deps.json [#3822 @wagoodman]
Empty source during decoding an SBOM document should not be fatal [#3791 @wagoodman]
Dpkg are not detected when scanning a directory [#3726 #3820 @VictorHuu]
Support golang tip image [#3681 #3757 @VictorHuu]
syft cataloger list should flatten options [#3801 #3804 @kzantow]
Unable to generate a correct SBOM for C++ project [#3755]

(Full Changelog)

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2025-04-25T22:32:03Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

63 additional dependencies were updated

Details:

Package	Change
`github.com/anchore/stereoscope`	`v0.1.3` -> `v0.1.13`
`github.com/sirupsen/logrus`	`v1.9.3` -> `v1.9.4-0.20230606125235-dd1b4c2e81af`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.1`
`github.com/stretchr/testify`	`v1.10.0` -> `v1.11.1`
`github.com/Masterminds/semver/v3`	`v3.3.1` -> `v3.4.0`
`github.com/STARRY-S/zip`	`v0.2.2` -> `v0.2.3`
`github.com/anchore/go-collections`	`v0.0.0-20241211140901-567f400e9a46` -> `v0.0.0-20251016125210-a3c352120e8c`
`github.com/bodgit/sevenzip`	`v1.6.0` -> `v1.6.1`
`github.com/charmbracelet/x/ansi`	`v0.8.0` -> `v0.10.1`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.6.0`
`github.com/github/go-spdx/v2`	`v2.3.2` -> `v2.3.4`
`github.com/go-viper/mapstructure/v2`	`v2.2.1` -> `v2.4.0`
`github.com/gohugoio/hashstructure`	`v0.5.0` -> `v0.6.0`
`github.com/gookit/color`	`v1.5.4` -> `v1.6.0`
`github.com/hashicorp/hcl/v2`	`v2.23.0` -> `v2.24.0`
`github.com/mattn/go-runewidth`	`v0.0.16` -> `v0.0.19`
`github.com/mholt/archives`	`v0.1.1` -> `v0.1.5`
`github.com/minio/minlz`	`v1.0.0` -> `v1.0.1`
`github.com/nwaples/rardecode/v2`	`v2.1.1` -> `v2.2.0`
`github.com/opencontainers/selinux`	`v1.12.0` -> `v1.13.0`
`github.com/sorairolake/lzip-go`	`v0.3.7` -> `v0.3.8`
`github.com/zclconf/go-cty`	`v1.16.2` -> `v1.16.3`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.60.0` -> `v0.61.0`
`go.opentelemetry.io/otel`	`v1.35.0` -> `v1.36.0`
`go.opentelemetry.io/otel/metric`	`v1.35.0` -> `v1.36.0`
`go.opentelemetry.io/otel/sdk`	`v1.35.0` -> `v1.36.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.35.0` -> `v1.36.0`
`go.opentelemetry.io/otel/trace`	`v1.35.0` -> `v1.36.0`
`golang.org/x/exp`	`v0.0.0-20250305212735-054e65f0b394` -> `v0.0.0-20250620022241-b7579e27df2b`
`golang.org/x/tools`	`v0.31.0` -> `v0.39.0`
`cloud.google.com/go/compute/metadata`	`v0.6.0` -> `v0.7.0`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.2` -> `v0.9.3`
`github.com/ProtonMail/go-crypto`	`v1.1.6` -> `v1.3.0`
`github.com/andybalholm/brotli`	`v1.1.1` -> `v1.2.0`
`github.com/bmatcuk/doublestar/v4`	`v4.8.1` -> `v4.9.1`
`github.com/cloudflare/circl`	`v1.6.0` -> `v1.6.1`
`github.com/containerd/containerd`	`v1.7.27` -> `v1.7.29`
`github.com/docker/cli`	`v28.0.4+incompatible` -> `v28.5.2+incompatible`
`github.com/docker/docker`	`v28.0.4+incompatible` -> `v28.5.2+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.9.3` -> `v0.9.4`
`github.com/docker/go-connections`	`v0.5.0` -> `v0.6.0`
`github.com/gabriel-vasile/mimetype`	`v1.4.8` -> `v1.4.11`
`github.com/go-logr/logr`	`v1.4.2` -> `v1.4.3`
`github.com/google/go-containerregistry`	`v0.20.3` -> `v0.20.6`
`github.com/sergi/go-diff`	`v1.3.2-0.20230802210424-5b0b94c5c0d3` -> `v1.4.0`
`github.com/sylabs/sif/v2`	`v2.21.1` -> `v2.22.0`
`github.com/ulikunitz/xz`	`v0.5.12` -> `v0.5.15`
`github.com/vbatts/go-mtree`	`v0.5.4` -> `v0.6.0`
`golang.org/x/crypto`	`v0.36.0` -> `v0.44.0`
`golang.org/x/mod`	`v0.24.0` -> `v0.30.0`
`golang.org/x/net`	`v0.38.0` -> `v0.47.0`
`golang.org/x/oauth2`	`v0.29.0` -> `v0.30.0`
`golang.org/x/sync`	`v0.13.0` -> `v0.18.0`
`golang.org/x/term`	`v0.31.0` -> `v0.37.0`
`golang.org/x/time`	`v0.11.0` -> `v0.14.0`
`modernc.org/libc`	`v1.62.1` -> `v1.66.10`
`modernc.org/memory`	`v1.9.1` -> `v1.11.0`
`modernc.org/sqlite`	`v1.37.0` -> `v1.40.0`
`github.com/go-git/go-git/v5`	`v5.14.0` -> `v5.16.3`
`github.com/spf13/afero`	`v1.14.0` -> `v1.15.0`
`github.com/spf13/pflag`	`v1.0.6` -> `v1.0.9`
`golang.org/x/sys`	`v0.32.0` -> `v0.38.0`
`golang.org/x/text`	`v0.24.0` -> `v0.31.0`

renovate · 2025-12-13T02:51:46Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

108 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.24.1` -> `1.24.6`
`github.com/anchore/stereoscope`	`v0.1.3` -> `v0.1.19`
`github.com/prometheus/client_golang`	`v1.22.0` -> `v1.23.2`
`github.com/sirupsen/logrus`	`v1.9.3` -> `v1.9.4-0.20230606125235-dd1b4c2e81af`
`github.com/spf13/cobra`	`v1.9.1` -> `v1.10.2`
`github.com/stretchr/testify`	`v1.10.0` -> `v1.11.1`
`k8s.io/api`	`v0.32.3` -> `v0.34.1`
`k8s.io/apimachinery`	`v0.32.3` -> `v0.34.1`
`k8s.io/client-go`	`v0.32.3` -> `v0.34.1`
`cel.dev/expr`	`v0.23.1` -> `v0.24.0`
`cloud.google.com/go/auth`	`v0.15.0` -> `v0.17.0`
`cloud.google.com/go/monitoring`	`v1.24.1` -> `v1.24.2`
`dario.cat/mergo`	`v1.0.1` -> `v1.0.2`
`github.com/BurntSushi/toml`	`v1.5.0` -> `v1.6.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.27.0` -> `v1.29.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric`	`v0.51.0` -> `v0.54.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping`	`v0.51.0` -> `v0.54.0`
`github.com/Masterminds/semver/v3`	`v3.3.1` -> `v3.4.0`
`github.com/Microsoft/hcsshim`	`v0.12.9` -> `v0.14.0-rc.1`
`github.com/STARRY-S/zip`	`v0.2.2` -> `v0.2.3`
`github.com/anchore/go-collections`	`v0.0.0-20241211140901-567f400e9a46` -> `v0.0.0-20251016125210-a3c352120e8c`
`github.com/bodgit/sevenzip`	`v1.6.0` -> `v1.6.1`
`github.com/charmbracelet/x/ansi`	`v0.8.0` -> `v0.10.1`
`github.com/containerd/platforms`	`v0.2.1` -> `v1.0.0-rc.2`
`github.com/cyphar/filepath-securejoin`	`v0.4.1` -> `v0.6.0`
`github.com/fxamacker/cbor/v2`	`v2.8.0` -> `v2.9.0`
`github.com/github/go-spdx/v2`	`v2.3.2` -> `v2.3.6`
`github.com/go-viper/mapstructure/v2`	`v2.2.1` -> `v2.5.0`
`github.com/gohugoio/hashstructure`	`v0.5.0` -> `v0.6.0`
`github.com/google/gnostic-models`	`v0.6.9` -> `v0.7.0`
`github.com/gookit/color`	`v1.5.4` -> `v1.6.0`
`github.com/hashicorp/hcl/v2`	`v2.23.0` -> `v2.24.0`
`github.com/mattn/go-runewidth`	`v0.0.16` -> `v0.0.19`
`github.com/mholt/archives`	`v0.1.1` -> `v0.1.5`
`github.com/minio/minlz`	`v1.0.0` -> `v1.0.1`
`github.com/ncruces/go-strftime`	`v0.1.9` -> `v1.0.0`
`github.com/nwaples/rardecode/v2`	`v2.1.1` -> `v2.2.0`
`github.com/pelletier/go-toml/v2`	`v2.2.3` -> `v2.2.4`
`github.com/sorairolake/lzip-go`	`v0.3.7` -> `v0.3.8`
`github.com/zclconf/go-cty`	`v1.16.2` -> `v1.16.3`
`go.opentelemetry.io/auto/sdk`	`v1.1.0` -> `v1.2.1`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.35.0` -> `v1.36.0`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.60.0` -> `v0.63.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.60.0` -> `v0.61.0`
`go.opentelemetry.io/otel`	`v1.35.0` -> `v1.39.0`
`go.opentelemetry.io/otel/metric`	`v1.35.0` -> `v1.39.0`
`go.opentelemetry.io/otel/sdk`	`v1.35.0` -> `v1.39.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.35.0` -> `v1.39.0`
`go.opentelemetry.io/otel/trace`	`v1.35.0` -> `v1.39.0`
`golang.org/x/exp`	`v0.0.0-20250305212735-054e65f0b394` -> `v0.0.0-20251023183803-a4bb9ffd2546`
`golang.org/x/tools`	`v0.31.0` -> `v0.41.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20250404141209-ee84b53bf3d0` -> `v0.0.0-20251111163417-95abcf5c77ba`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20250404141209-ee84b53bf3d0` -> `v0.0.0-20251111163417-95abcf5c77ba`
`cloud.google.com/go`	`v0.120.0` -> `v0.123.0`
`cloud.google.com/go/compute/metadata`	`v0.6.0` -> `v0.9.0`
`cloud.google.com/go/iam`	`v1.5.0` -> `v1.5.3`
`cloud.google.com/go/storage`	`v1.51.0` -> `v1.58.0`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.2` -> `v0.9.3`
`github.com/ProtonMail/go-crypto`	`v1.1.6` -> `v1.3.0`
`github.com/anchore/go-struct-converter`	`v0.0.0-20250211213226-cce56d595160` -> `v0.1.0`
`github.com/andybalholm/brotli`	`v1.1.1` -> `v1.2.0`
`github.com/bmatcuk/doublestar/v4`	`v4.8.1` -> `v4.9.2`
`github.com/cloudflare/circl`	`v1.6.0` -> `v1.6.1`
`github.com/containerd/stargz-snapshotter/estargz`	`v0.16.3` -> `v0.18.1`
`github.com/docker/cli`	`v28.0.4+incompatible` -> `v29.1.5+incompatible`
`github.com/docker/docker`	`v28.0.4+incompatible` -> `v28.5.2+incompatible`
`github.com/docker/docker-credential-helpers`	`v0.9.3` -> `v0.9.4`
`github.com/docker/go-connections`	`v0.5.0` -> `v0.6.0`
`github.com/emicklei/go-restful/v3`	`v3.12.2` -> `v3.13.0`
`github.com/gabriel-vasile/mimetype`	`v1.4.8` -> `v1.4.12`
`github.com/go-git/go-billy/v5`	`v5.6.2` -> `v5.7.0`
`github.com/go-logr/logr`	`v1.4.2` -> `v1.4.3`
`github.com/google/go-containerregistry`	`v0.20.3` -> `v0.20.7`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.6` -> `v0.3.7`
`github.com/googleapis/gax-go/v2`	`v2.14.1` -> `v2.15.0`
`github.com/hashicorp/go-version`	`v1.7.0` -> `v1.8.0`
`github.com/klauspost/compress`	`v1.18.0` -> `v1.18.2`
`github.com/modern-go/reflect2`	`v1.0.2` -> `v1.0.3-0.20250322232337-35a7c28c31ee`
`github.com/prometheus/client_model`	`v0.6.1` -> `v0.6.2`
`github.com/prometheus/common`	`v0.63.0` -> `v0.66.1`
`github.com/prometheus/procfs`	`v0.16.0` -> `v0.16.1`
`github.com/sergi/go-diff`	`v1.3.2-0.20230802210424-5b0b94c5c0d3` -> `v1.4.0`
`github.com/spdx/tools-golang`	`v0.5.5` -> `v0.5.7`
`github.com/sylabs/sif/v2`	`v2.21.1` -> `v2.22.0`
`github.com/ulikunitz/xz`	`v0.5.12` -> `v0.5.15`
`github.com/vbatts/go-mtree`	`v0.5.4` -> `v0.7.0`
`github.com/vbatts/tar-split`	`v0.12.1` -> `v0.12.2`
`golang.org/x/crypto`	`v0.36.0` -> `v0.47.0`
`golang.org/x/mod`	`v0.24.0` -> `v0.32.0`
`golang.org/x/net`	`v0.38.0` -> `v0.49.0`
`golang.org/x/oauth2`	`v0.29.0` -> `v0.33.0`
`golang.org/x/sync`	`v0.13.0` -> `v0.19.0`
`golang.org/x/term`	`v0.31.0` -> `v0.39.0`
`golang.org/x/time`	`v0.11.0` -> `v0.14.0`
`google.golang.org/api`	`v0.228.0` -> `v0.256.0`
`google.golang.org/genproto`	`v0.0.0-20250404141209-ee84b53bf3d0` -> `v0.0.0-20250922171735-9219d122eba9`
`google.golang.org/grpc`	`v1.71.1` -> `v1.76.0`
`google.golang.org/protobuf`	`v1.36.6` -> `v1.36.10`
`k8s.io/kube-openapi`	`v0.0.0-20250318190949-c8a335a9a2ff` -> `v0.0.0-20250710124328-f3f2b991d03b`
`k8s.io/utils`	`v0.0.0-20250321185631-1f6e0b77f77e` -> `v0.0.0-20250604170112-4c0f3b243397`
`modernc.org/libc`	`v1.62.1` -> `v1.67.6`
`modernc.org/memory`	`v1.9.1` -> `v1.11.0`
`modernc.org/sqlite`	`v1.37.0` -> `v1.44.3`
`sigs.k8s.io/yaml`	`v1.4.0` -> `v1.6.0`
`github.com/go-git/go-git/v5`	`v5.14.0` -> `v5.16.4`
`github.com/spf13/afero`	`v1.14.0` -> `v1.15.0`
`github.com/spf13/pflag`	`v1.0.6` -> `v1.0.9`
`golang.org/x/sys`	`v0.32.0` -> `v0.40.0`
`golang.org/x/text`	`v0.24.0` -> `v0.33.0`

renovate bot added the kind/dependencies Pull requests that update a dependency file label Apr 25, 2025

github-actions bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Apr 25, 2025

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.23.1~~ deps: update module github.com/anchore/syft to v1.25.1 May 16, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from a926558 to 7bc49d6 Compare May 16, 2025 23:26

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.25.1~~ deps: update module github.com/anchore/syft to v1.26.1 May 23, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 7bc49d6 to 9a9f3bb Compare May 23, 2025 23:23

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 9a9f3bb to 4d8627b Compare June 13, 2025 23:03

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.26.1~~ deps: update module github.com/anchore/syft to v1.27.1 Jun 13, 2025

github-actions bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Jun 13, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 4d8627b to c93065d Compare July 5, 2025 02:39

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.27.1~~ deps: update module github.com/anchore/syft to v1.28.0 Jul 5, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from c93065d to 09fdc4f Compare July 26, 2025 02:10

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.28.0~~ deps: update module github.com/anchore/syft to v1.29.0 Jul 26, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 09fdc4f to f2829d0 Compare August 1, 2025 23:03

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.29.0~~ deps: update module github.com/anchore/syft to v1.29.1 Aug 1, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from f2829d0 to 94e0115 Compare August 9, 2025 00:45

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.29.1~~ deps: update module github.com/anchore/syft to v1.30.0 Aug 9, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 94e0115 to bc66fe1 Compare August 16, 2025 01:24

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.30.0~~ deps: update module github.com/anchore/syft to v1.31.0 Aug 16, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from bc66fe1 to 7b84970 Compare August 31, 2025 10:29

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.31.0~~ deps: update module github.com/anchore/syft to v1.32.0 Aug 31, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 7b84970 to fd7425a Compare September 20, 2025 01:27

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.32.0~~ deps: update module github.com/anchore/syft to v1.33.0 Sep 20, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from fd7425a to 8beb0de Compare October 18, 2025 03:06

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.33.0~~ deps: update module github.com/anchore/syft to v1.34.2 Oct 18, 2025

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.34.2~~ deps: update module github.com/anchore/syft to v1.36.0 Oct 24, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 8beb0de to 01502d5 Compare October 25, 2025 00:01

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 01502d5 to c41120a Compare November 8, 2025 00:52

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.36.0~~ deps: update module github.com/anchore/syft to v1.37.0 Nov 8, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from c41120a to 8d5c584 Compare November 22, 2025 00:29

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.37.0~~ deps: update module github.com/anchore/syft to v1.38.0 Nov 22, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 8d5c584 to 4273454 Compare December 13, 2025 02:51

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.38.0~~ deps: update module github.com/anchore/syft to v1.38.2 Dec 13, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 4273454 to faeb015 Compare December 27, 2025 01:12

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.38.2~~ deps: update module github.com/anchore/syft to v1.39.0 Dec 27, 2025

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from faeb015 to b7ec972 Compare January 10, 2026 01:47

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.39.0~~ deps: update module github.com/anchore/syft to v1.40.0 Jan 10, 2026

github-actions bot added size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. and removed size/L Denotes a PR that changes 100-499 lines, ignoring generated files. labels Jan 10, 2026

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from b7ec972 to 227ab1c Compare January 17, 2026 00:53

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.40.0~~ deps: update module github.com/anchore/syft to v1.40.1 Jan 17, 2026

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 227ab1c to 672015a Compare January 31, 2026 01:46

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.40.1~~ deps: update module github.com/anchore/syft to v1.41.1 Jan 31, 2026

deps: update module github.com/anchore/syft to v1.41.2

48e212d

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 672015a to 48e212d Compare February 7, 2026 00:51

renovate bot changed the title ~~deps: update module github.com/anchore/syft to v1.41.1~~ deps: update module github.com/anchore/syft to v1.41.2 Feb 7, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps: update module github.com/anchore/syft to v1.41.2 #571

deps: update module github.com/anchore/syft to v1.41.2 #571

Uh oh!

renovate bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

renovate bot commented Apr 25, 2025 •

edited

Loading

Uh oh!

renovate bot commented Dec 13, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

deps: update module github.com/anchore/syft to v1.41.2 #571

Are you sure you want to change the base?

deps: update module github.com/anchore/syft to v1.41.2 #571

Uh oh!

Conversation

renovate bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Added Features

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Additional Changes

Added Features

Additional Changes

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Additional Changes

Added Features

Bug Fixes

Configuration

Uh oh!

renovate bot commented Apr 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ Artifact update notice

File name: go.mod

Uh oh!

renovate bot commented Dec 13, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Apr 25, 2025 •

edited

Loading

renovate bot commented Apr 25, 2025 •

edited

Loading

renovate bot commented Dec 13, 2025 •

edited

Loading