chore(deps): update dependency anchore/syft to v1.51.1 #269

Merged

CSRBot merged 1 commits from renovate/anchore-syft-1.x into master 2026-08-27 20:09:28 +02:00

Conversation 0 Commits 1 Files Changed 1

+1 -1

CSRBot commented 2026-08-27 20:06:36 +02:00

Collaborator

Copy Link

Copy Source

This PR contains the following updates:

Package	Update	Change
anchore/syft	patch	1.51.0 → 1.51.1

---

Release Notes

anchore/syft (anchore/syft)

v1.51.1

Compare Source

Bug Fixes

• detect multi-arch ingress-nginx [PR #​5179 @​CAOShurong]
• keep the epoch when parsing RPM manifest packages [PR #​5201 @​sueun-dev]
• correct Apache Derby group ID in purl generation [PR #​5090 @​Ankush-Pathak]
• move image hardlink handling upstream during image indexing [PR #​5196 @​wagoodman]
• keep epoch-pinned requirements in the SBOM [PR #​5161 @​sueun-dev]
• Prevent unnecessary allocations when parsing compressed ELF sections [PR #​5187 @​wagoodman]
• honor the io.ReaderAt contract in readerAtAdapter [PR #​5186 @​wagoodman]
• Support grafana binary various version [Issue #​5059] [PR #​5213 @​pujitha24]
• Excluded paths are still scanned and cause syft to crash [Issue #​3258]
• Dotnet: Incorrect relationship graph in case of using package locks [Issue #​5125] [PR #​5143 @​pujitha24]
• Survive indexing not accessible files [Issue #​3286] [PR #​5170 @​addielaruee]
• CPE target_sw not being set consistency for Rust crates [Issue #​3956] [PR #​5167 @​Xenira]
• panic: nil pointer dereference in squashfs.(*File).Read when scanning snap (regression from 1.44.0) [Issue #​4989] [PR #​5119 @​kzantow]
• golang remote license search attempts to resolve stdlib modules [Issue #​3149] [PR #​5192 @​luantaraschi]

Additional Changes

• gzip binary classifier reports false-positive GNU gzip from BusyBox multicall binary via applet symlink [Issue #​5171] [PR #​5202 @​spiffcs]
• pnpm v5 lockfile: underscore peer-dep suffixes are not stripped from package versions [Issue #​5174] [PR #​5175 @​codeAnqiang-ma]
• pnpm cataloger reads only the first YAML document: SBOM contains pnpm's own binaries and no project dependencies [Issue #​5168] [PR #​5188 @​hamodywe]

Dependencies

72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.

🟢 Remediated (3)

• GO-2026-5158 (Medium) — go.opentelemetry.io/otel
• GO-2026-6179 (High) — golang.org/x/mod
• GO-2026-6180 (High) — golang.org/x/mod

Updated (70 packages)

• cel.dev/expr v0.25.1 → v0.25.2
• cloud.google.com/go/auth v0.18.2 → v0.22.0
• cloud.google.com/go/iam v1.5.3 → v1.11.0
• cloud.google.com/go/logging v1.13.1 → v1.18.0
• cloud.google.com/go/longrunning v0.8.0 → v1.2.0
• cloud.google.com/go/monitoring v1.24.3 → v1.29.0
• cloud.google.com/go/storage v1.61.3 → v1.64.0
• cloud.google.com/go/trace v1.11.7 → v1.16.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 → v1.33.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 → v0.57.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 → v0.57.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 → v0.57.0
• github.com/anchore/stereoscope v0.3.0 → v0.3.1
• github.com/aws/aws-sdk-go-v2 v1.41.5 → v1.43.4
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 → v1.7.16
• github.com/aws/aws-sdk-go-v2/config v1.32.12 → v1.32.35
• github.com/aws/aws-sdk-go-v2/credentials v1.19.12 → v1.19.34
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 → v1.18.35
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 → v1.4.35
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 → v2.7.35
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 → v1.4.36
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 → v1.13.15
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 → v1.9.28
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 → v1.13.35
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 → v1.19.36
• github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 → v1.106.5
• github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 → v1.5.4
• github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 → v1.33.4
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 → v1.38.4
• github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 → v1.45.4
• github.com/aws/smithy-go v1.24.2 → v1.27.6
• github.com/containerd/containerd/v2 v2.3.3 → v2.3.4
• github.com/containerd/platforms v1.0.0-rc.4 → v1.0.0-rc.5
• github.com/docker/cli v29.6.1+incompatible → v29.7.2+incompatible
• github.com/docker/go-connections v0.7.0 → v0.8.1
• github.com/fatih/color v1.18.0 → v1.19.0
• github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15
• github.com/google/go-containerregistry v0.21.7 → v0.21.9
• github.com/google/pprof v0.0.0-a4b03ec → v0.0.0-ef3492d
• github.com/googleapis/enterprise-certificate-proxy v0.3.14 → v0.3.19
• github.com/googleapis/gax-go/v2 v2.17.0 → v2.23.0
• github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 → v2.0.0-beta.74
• github.com/hashicorp/go-getter v1.8.6 → v1.8.8
• github.com/hashicorp/go-version v1.8.0 → v1.9.0
• github.com/klauspost/compress v1.19.1 → v1.19.2
• github.com/mattn/go-isatty v0.0.20 → v0.0.24
• github.com/moby/moby/client v0.5.0 → v0.5.1
• github.com/spiffe/go-spiffe/v2 v2.6.0 → v2.7.0
• github.com/stretchr/objx v0.5.2 → v0.5.3
• github.com/stretchr/testify v1.11.1 → v1.12.1
• go.opentelemetry.io/contrib/detectors/gcp v1.43.0 → v1.44.0
• go.opentelemetry.io/otel v1.43.0 → v1.44.0 (🟢 remediated GO-2026-5158)
• go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 → v1.44.0
• go.opentelemetry.io/otel/metric v1.43.0 → v1.44.0
• go.opentelemetry.io/otel/sdk v1.43.0 → v1.44.0
• go.opentelemetry.io/otel/sdk/metric v1.43.0 → v1.44.0
• go.opentelemetry.io/otel/trace v1.43.0 → v1.44.0
• golang.org/x/crypto v0.54.0 → v0.55.0
• golang.org/x/mod v0.38.0 → v0.40.0 (🟢 remediated GO-2026-6179, GO-2026-6180)
• golang.org/x/net v0.57.0 → v0.58.0
• golang.org/x/text v0.40.0 → v0.41.0
• golang.org/x/tools v0.48.0 → v0.49.0
• google.golang.org/api v0.271.0 → v0.292.0
• google.golang.org/genproto v0.0.0-8636f87 → v0.0.0-aa98bba
• google.golang.org/genproto/googleapis/api v0.0.0-afd174a → v0.0.0-925bb5d
• google.golang.org/genproto/googleapis/rpc v0.0.0-afd174a → v0.0.0-6ac0973
• google.golang.org/grpc v1.82.1 → v1.83.0
• modernc.org/cc/v4 v4.29.0 → v4.29.1
• modernc.org/libc v1.74.1 → v1.74.4
• modernc.org/sqlite v1.55.0 → v1.56.0

Added (1 package)

• go.opentelemetry.io/otel/metric/x v0.66.0

Removed (1 package)

• github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | patch | `1.51.0` → `1.51.1` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.51.1`](https://github.com/anchore/syft/releases/tag/v1.51.1) [Compare Source](https://github.com/anchore/syft/compare/v1.51.0...v1.51.1) ##### Bug Fixes - detect multi-arch ingress-nginx \[PR [#&#8203;5179](https://github.com/anchore/syft/pull/5179) [@&#8203;CAOShurong](https://github.com/CAOShurong)] - keep the epoch when parsing RPM manifest packages \[PR [#&#8203;5201](https://github.com/anchore/syft/pull/5201) [@&#8203;sueun-dev](https://github.com/sueun-dev)] - correct Apache Derby group ID in purl generation \[PR [#&#8203;5090](https://github.com/anchore/syft/pull/5090) [@&#8203;Ankush-Pathak](https://github.com/Ankush-Pathak)] - move image hardlink handling upstream during image indexing \[PR [#&#8203;5196](https://github.com/anchore/syft/pull/5196) [@&#8203;wagoodman](https://github.com/wagoodman)] - keep epoch-pinned requirements in the SBOM \[PR [#&#8203;5161](https://github.com/anchore/syft/pull/5161) [@&#8203;sueun-dev](https://github.com/sueun-dev)] - Prevent unnecessary allocations when parsing compressed ELF sections \[PR [#&#8203;5187](https://github.com/anchore/syft/pull/5187) [@&#8203;wagoodman](https://github.com/wagoodman)] - honor the io.ReaderAt contract in readerAtAdapter \[PR [#&#8203;5186](https://github.com/anchore/syft/pull/5186) [@&#8203;wagoodman](https://github.com/wagoodman)] - Support grafana binary various version \[Issue [#&#8203;5059](https://github.com/anchore/syft/issues/5059)] \[PR [#&#8203;5213](https://github.com/anchore/syft/pull/5213) [@&#8203;pujitha24](https://github.com/pujitha24)] - Excluded paths are still scanned and cause syft to crash \[Issue [#&#8203;3258](https://github.com/anchore/syft/issues/3258)] - Dotnet: Incorrect relationship graph in case of using package locks \[Issue [#&#8203;5125](https://github.com/anchore/syft/issues/5125)] \[PR [#&#8203;5143](https://github.com/anchore/syft/pull/5143) [@&#8203;pujitha24](https://github.com/pujitha24)] - Survive indexing not accessible files \[Issue [#&#8203;3286](https://github.com/anchore/syft/issues/3286)] \[PR [#&#8203;5170](https://github.com/anchore/syft/pull/5170) [@&#8203;addielaruee](https://github.com/addielaruee)] - CPE target\_sw not being set consistency for Rust crates \[Issue [#&#8203;3956](https://github.com/anchore/syft/issues/3956)] \[PR [#&#8203;5167](https://github.com/anchore/syft/pull/5167) [@&#8203;Xenira](https://github.com/Xenira)] - panic: nil pointer dereference in squashfs.(\*File).Read when scanning snap (regression from 1.44.0) \[Issue [#&#8203;4989](https://github.com/anchore/syft/issues/4989)] \[PR [#&#8203;5119](https://github.com/anchore/syft/pull/5119) [@&#8203;kzantow](https://github.com/kzantow)] - golang remote license search attempts to resolve stdlib modules \[Issue [#&#8203;3149](https://github.com/anchore/syft/issues/3149)] \[PR [#&#8203;5192](https://github.com/anchore/syft/pull/5192) [@&#8203;luantaraschi](https://github.com/luantaraschi)] ##### Additional Changes - gzip binary classifier reports false-positive GNU gzip from BusyBox multicall binary via applet symlink \[Issue [#&#8203;5171](https://github.com/anchore/syft/issues/5171)] \[PR [#&#8203;5202](https://github.com/anchore/syft/pull/5202) [@&#8203;spiffcs](https://github.com/spiffcs)] - pnpm v5 lockfile: underscore peer-dep suffixes are not stripped from package versions \[Issue [#&#8203;5174](https://github.com/anchore/syft/issues/5174)] \[PR [#&#8203;5175](https://github.com/anchore/syft/pull/5175) [@&#8203;codeAnqiang-ma](https://github.com/codeAnqiang-ma)] - pnpm cataloger reads only the first YAML document: SBOM contains pnpm's own binaries and no project dependencies \[Issue [#&#8203;5168](https://github.com/anchore/syft/issues/5168)] \[PR [#&#8203;5188](https://github.com/anchore/syft/pull/5188) [@&#8203;hamodywe](https://github.com/hamodywe)] ##### Dependencies 72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated. **🟢 Remediated (3)** - [GO-2026-5158](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835) (Medium) — go.opentelemetry.io/otel - [GO-2026-6179](https://go.dev/issue/80744) (High) — golang.org/x/mod - [GO-2026-6180](https://go.dev/issue/80745) (High) — golang.org/x/mod <details> <summary>Updated (70 packages)</summary> - cel.dev/expr `v0.25.1` → `v0.25.2` - cloud.google.com/go/auth `v0.18.2` → `v0.22.0` - cloud.google.com/go/iam `v1.5.3` → `v1.11.0` - cloud.google.com/go/logging `v1.13.1` → `v1.18.0` - cloud.google.com/go/longrunning `v0.8.0` → `v1.2.0` - cloud.google.com/go/monitoring `v1.24.3` → `v1.29.0` - cloud.google.com/go/storage `v1.61.3` → `v1.64.0` - cloud.google.com/go/trace `v1.11.7` → `v1.16.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp `v1.32.0` → `v1.33.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric `v0.55.0` → `v0.57.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock `v0.55.0` → `v0.57.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping `v0.55.0` → `v0.57.0` - github.com/anchore/stereoscope `v0.3.0` → `v0.3.1` - github.com/aws/aws-sdk-go-v2 `v1.41.5` → `v1.43.4` - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream `v1.7.8` → `v1.7.16` - github.com/aws/aws-sdk-go-v2/config `v1.32.12` → `v1.32.35` - github.com/aws/aws-sdk-go-v2/credentials `v1.19.12` → `v1.19.34` - github.com/aws/aws-sdk-go-v2/feature/ec2/imds `v1.18.20` → `v1.18.35` - github.com/aws/aws-sdk-go-v2/internal/configsources `v1.4.21` → `v1.4.35` - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 `v2.7.21` → `v2.7.35` - github.com/aws/aws-sdk-go-v2/internal/v4a `v1.4.22` → `v1.4.36` - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding `v1.13.7` → `v1.13.15` - github.com/aws/aws-sdk-go-v2/service/internal/checksum `v1.9.13` → `v1.9.28` - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url `v1.13.21` → `v1.13.35` - github.com/aws/aws-sdk-go-v2/service/internal/s3shared `v1.19.21` → `v1.19.36` - github.com/aws/aws-sdk-go-v2/service/s3 `v1.97.3` → `v1.106.5` - github.com/aws/aws-sdk-go-v2/service/signin `v1.0.8` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/service/sso `v1.30.13` → `v1.33.4` - github.com/aws/aws-sdk-go-v2/service/ssooidc `v1.35.17` → `v1.38.4` - github.com/aws/aws-sdk-go-v2/service/sts `v1.41.9` → `v1.45.4` - github.com/aws/smithy-go `v1.24.2` → `v1.27.6` - github.com/containerd/containerd/v2 `v2.3.3` → `v2.3.4` - github.com/containerd/platforms `v1.0.0-rc.4` → `v1.0.0-rc.5` - github.com/docker/cli `v29.6.1+incompatible` → `v29.7.2+incompatible` - github.com/docker/go-connections `v0.7.0` → `v0.8.1` - github.com/fatih/color `v1.18.0` → `v1.19.0` - github.com/gabriel-vasile/mimetype `v1.4.13` → `v1.4.15` - github.com/google/go-containerregistry `v0.21.7` → `v0.21.9` - github.com/google/pprof `v0.0.0-a4b03ec` → `v0.0.0-ef3492d` - github.com/googleapis/enterprise-certificate-proxy `v0.3.14` → `v0.3.19` - github.com/googleapis/gax-go/v2 `v2.17.0` → `v2.23.0` - github.com/hashicorp/aws-sdk-go-base/v2 `v2.0.0-beta.72` → `v2.0.0-beta.74` - github.com/hashicorp/go-getter `v1.8.6` → `v1.8.8` - github.com/hashicorp/go-version `v1.8.0` → `v1.9.0` - github.com/klauspost/compress `v1.19.1` → `v1.19.2` - github.com/mattn/go-isatty `v0.0.20` → `v0.0.24` - github.com/moby/moby/client `v0.5.0` → `v0.5.1` - github.com/spiffe/go-spiffe/v2 `v2.6.0` → `v2.7.0` - github.com/stretchr/objx `v0.5.2` → `v0.5.3` - github.com/stretchr/testify `v1.11.1` → `v1.12.1` - go.opentelemetry.io/contrib/detectors/gcp `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel `v1.43.0` → `v1.44.0` **(🟢 remediated [GO-2026-5158](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835))** - go.opentelemetry.io/otel/exporters/stdout/stdoutmetric `v1.40.0` → `v1.44.0` - go.opentelemetry.io/otel/metric `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel/sdk `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel/sdk/metric `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel/trace `v1.43.0` → `v1.44.0` - golang.org/x/crypto `v0.54.0` → `v0.55.0` - golang.org/x/mod `v0.38.0` → `v0.40.0` **(🟢 remediated [GO-2026-6179](https://go.dev/issue/80744), [GO-2026-6180](https://go.dev/issue/80745))** - golang.org/x/net `v0.57.0` → `v0.58.0` - golang.org/x/text `v0.40.0` → `v0.41.0` - golang.org/x/tools `v0.48.0` → `v0.49.0` - google.golang.org/api `v0.271.0` → `v0.292.0` - google.golang.org/genproto `v0.0.0-8636f87` → `v0.0.0-aa98bba` - google.golang.org/genproto/googleapis/api `v0.0.0-afd174a` → `v0.0.0-925bb5d` - google.golang.org/genproto/googleapis/rpc `v0.0.0-afd174a` → `v0.0.0-6ac0973` - google.golang.org/grpc `v1.82.1` → `v1.83.0` - modernc.org/cc/v4 `v4.29.0` → `v4.29.1` - modernc.org/libc `v1.74.1` → `v1.74.4` - modernc.org/sqlite `v1.55.0` → `v1.56.0` </details> <details> <summary>Added (1 package)</summary> - go.opentelemetry.io/otel/metric/x `v0.66.0` </details> <details> <summary>Removed (1 package)</summary> - github.com/aws/aws-sdk-go-v2/internal/ini `v1.8.6` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.51.0...v1.51.1)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40Ni4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJyZW5vdmF0ZS9hdXRvbWVyZ2UiLCJyZW5vdmF0ZS9naXRodWItYWN0aW9uIl19-->

CSRBot added 1 commit 2026-08-27 20:06:37 +02:00

chore(deps): update dependency anchore/syft to v1.51.1 11b33b9f1d

CSRBot scheduled this pull request to auto merge when all checks succeed 2026-08-27 20:06:42 +02:00

CSRBot merged commit d3a4a4501f into master 2026-08-27 20:09:28 +02:00

CSRBot deleted branch renovate/anchore-syft-1.x 2026-08-27 20:09:29 +02:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

bug

Something is not working

duplicate

This issue or pull request already exists

enhancement

New feature

help wanted

Need some help

invalid

Something is wrong

question

More information is needed

renovate/rebase

Rebase branch on base branch via renovate

wontfix

This won't be fixed

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

CSRBot (CSRBot) volker.raschek (Markus Pesch)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/db-wait#269