volker.raschek/dcmerge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

chore(deps): update dependency anchore/syft to v1.51.0 #202

Merged
CSRBot merged 1 commits from renovate/anchore-syft-1.x into master 2026-08-10 17:10:50 +02:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-08-10 17:05:35 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
anchore/syft minor 1.50.0 → 1.51.0

Release Notes

anchore/syft (anchore/syft)

v1.51.0

Compare Source

Added Features
Bug Fixes
  • Cleanup snap temporary directories [PR #​5117 @​spiffcs]
  • add correct CPE vendor/product candidates for Git for Windows PE binary [PR #​5156 @​westonsteimel]
  • javascript-package-cataloger creates phantom <name>@unknown packages for subpath or export-map stub package.json files [Issue #​5118]
  • Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #​4598] [PR #​5146 @​ankit090701]
  • When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #​5019] [PR #​5029 @​wagoodman]
  • Support deno binary latest and some old versions [Issue #​5057] [PR #​5084 @​ychampion]
  • Update install methods in README.md [Issue #​3198]
Dependencies

9 dependency changes (9 updated). 2 vulnerabilities remediated.

🟢 Remediated (2)

Updated (9 packages)
  • github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
  • github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
  • github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)
  • github.com/jedib0t/go-pretty/v6 v6.8.1 → v6.8.3
  • github.com/klauspost/compress v1.19.0 → v1.19.1
  • github.com/magiconair/properties v1.8.10 → v1.18.11
  • github.com/ulikunitz/xz v0.5.15 → v0.5.16
  • go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
  • modernc.org/sqlite v1.54.0 → v1.55.0

(Full Changelog)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | minor | `1.50.0` → `1.51.0` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.51.0`](https://github.com/anchore/syft/releases/tag/v1.51.0) [Compare Source](https://github.com/anchore/syft/compare/v1.50.0...v1.51.0) ##### Added Features - detect native Go FIPS 140 mode in binaries \[PR [#&#8203;5155](https://github.com/anchore/syft/pull/5155) [@&#8203;gunnypatel](https://github.com/gunnypatel)] - add extended-stdlib scope and module patterns for symbol capture \[PR [#&#8203;5154](https://github.com/anchore/syft/pull/5154) [@&#8203;wagoodman](https://github.com/wagoodman)] ##### Bug Fixes - Cleanup snap temporary directories \[PR [#&#8203;5117](https://github.com/anchore/syft/pull/5117) [@&#8203;spiffcs](https://github.com/spiffcs)] - add correct CPE vendor/product candidates for Git for Windows PE binary \[PR [#&#8203;5156](https://github.com/anchore/syft/pull/5156) [@&#8203;westonsteimel](https://github.com/westonsteimel)] - javascript-package-cataloger creates phantom `<name>@unknown` packages for subpath or export-map stub package.json files \[Issue [#&#8203;5118](https://github.com/anchore/syft/issues/5118)] - Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives \[Issue [#&#8203;4598](https://github.com/anchore/syft/issues/4598)] \[PR [#&#8203;5146](https://github.com/anchore/syft/pull/5146) [@&#8203;ankit090701](https://github.com/ankit090701)] - When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode \[Issue [#&#8203;5019](https://github.com/anchore/syft/issues/5019)] \[PR [#&#8203;5029](https://github.com/anchore/syft/pull/5029) [@&#8203;wagoodman](https://github.com/wagoodman)] - Support deno binary latest and some old versions \[Issue [#&#8203;5057](https://github.com/anchore/syft/issues/5057)] \[PR [#&#8203;5084](https://github.com/anchore/syft/pull/5084) [@&#8203;ychampion](https://github.com/ychampion)] - Update install methods in README.md \[Issue [#&#8203;3198](https://github.com/anchore/syft/issues/3198)] ##### Dependencies 9 dependency changes (9 updated). 2 vulnerabilities remediated. **🟢 Remediated (2)** - [GHSA-hc8v-wwc9-vgxm](https://github.com/advisories/GHSA-hc8v-wwc9-vgxm) (High) — github.com/go-git/go-git/v5 - [GHSA-qgq7-7hm3-q39j](https://github.com/advisories/GHSA-qgq7-7hm3-q39j) (Medium) — github.com/go-git/go-git/v5 <details> <summary>Updated (9 packages)</summary> - github.com/diskfs/go-diskfs `v1.9.3` → `v1.9.4` - github.com/go-git/go-billy/v5 `v5.9.0` → `v5.9.1` - github.com/go-git/go-git/v5 `v5.19.1` → `v5.19.2` **(🟢 remediated [GHSA-hc8v-wwc9-vgxm](https://github.com/advisories/GHSA-hc8v-wwc9-vgxm), [GHSA-qgq7-7hm3-q39j](https://github.com/advisories/GHSA-qgq7-7hm3-q39j))** - github.com/jedib0t/go-pretty/v6 `v6.8.1` → `v6.8.3` - github.com/klauspost/compress `v1.19.0` → `v1.19.1` - github.com/magiconair/properties `v1.8.10` → `v1.18.11` - github.com/ulikunitz/xz `v0.5.15` → `v0.5.16` - go.yaml.in/yaml/v3 `v3.0.4` → `v3.0.5` - modernc.org/sqlite `v1.54.0` → `v1.55.0` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.50.0...v1.51.0)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xNy4wIiwidXBkYXRlZEluVmVyIjoiNDQuMTcuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJyZW5vdmF0ZS9hdXRvbWVyZ2UiLCJyZW5vdmF0ZS9naXRodWItYWN0aW9uIl19-->
CSRBot added 1 commit 2026-08-10 17:05:36 +02:00
chore(deps): update dependency anchore/syft to v1.51.0
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 1m51s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 23s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 2m32s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 28s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 26s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 32s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 1m0s
Details
Lint Markdown files / Run markdown linter (pull_request) Successful in 7s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 59s
Details
da9eda6c4f
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-08-10 17:05:38 +02:00
CSRBot merged commit aa973401e3 into master 2026-08-10 17:10:50 +02:00
CSRBot deleted branch renovate/anchore-syft-1.x 2026-08-10 17:10:51 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#202