volker.raschek/dcmerge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

chore(deps): update dependency anchore/syft to v1.52.0 #219

Merged
CSRBot merged 1 commits from renovate/anchore-syft-1.x into master 2026-09-17 18:21:14 +02:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-09-17 18:15:52 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
anchore/syft minor 1.51.1 → 1.52.0

Release Notes

anchore/syft (anchore/syft)

v1.52.0

Compare Source

Added Features
Bug Fixes
Dependencies

52 dependency changes (52 updated). 6 vulnerabilities remediated.

🟢 Remediated (6)

Updated (52 packages)
  • cloud.google.com/go/auth v0.22.0 → v0.23.2
  • cloud.google.com/go/iam v1.11.0 → v1.12.0
  • cloud.google.com/go/logging v1.18.0 → v1.19.0
  • cloud.google.com/go/monitoring v1.29.0 → v1.30.0
  • cloud.google.com/go/storage v1.64.0 → v1.65.1
  • github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0
  • github.com/anchore/go-sync v0.1.1 → v0.1.2
  • github.com/anchore/stereoscope v0.3.1 → v0.3.2
  • github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0
  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20
  • github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40
  • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41
  • github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41
  • github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0
  • github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0
  • github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0
  • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0
  • github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0
  • github.com/aws/smithy-go v1.27.6 → v1.28.1
  • github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv)
  • github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible
  • github.com/google/go-containerregistry v0.21.9 → v0.22.1
  • github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20
  • github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0
  • github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3
  • github.com/hashicorp/go-getter v1.8.8 → v1.8.9
  • github.com/klauspost/compress v1.19.2 → v1.20.0
  • github.com/moby/moby/api v1.55.0 → v1.56.0
  • github.com/moby/moby/client v0.5.1 → v0.6.0
  • github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8
  • golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355)
  • golang.org/x/mod v0.40.0 → v0.41.0
  • golang.org/x/time v0.15.0 → v0.16.0
  • google.golang.org/api v0.292.0 → v0.294.0
  • google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1
  • google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1
  • google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42
  • google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc)
  • google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12
  • modernc.org/cc/v4 v4.29.1 → v4.29.2
  • modernc.org/ccgo/v4 v4.34.6 → v4.35.0
  • modernc.org/gc/v3 v3.1.4 → v3.1.5
  • modernc.org/libc v1.74.4 → v1.75.6
  • modernc.org/memory v1.11.0 → v1.12.1
  • modernc.org/sqlite v1.56.0 → v1.58.0

(Full Changelog)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | minor | `1.51.1` → `1.52.0` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.52.0`](https://github.com/anchore/syft/releases/tag/v1.52.0) [Compare Source](https://github.com/anchore/syft/compare/v1.51.1...v1.52.0) ##### Added Features - passthrough-exact-format copies matching syft-json input unchanged \[PR [#&#8203;5279](https://github.com/anchore/syft/pull/5279) [@&#8203;juanjsebgarcia](https://github.com/juanjsebgarcia)] ##### Bug Fixes - bound what a compressed kernel module expands to \[PR [#&#8203;5294](https://github.com/anchore/syft/pull/5294) [@&#8203;wagoodman](https://github.com/wagoodman)] - bound the decompressed members of a .deb archive \[PR [#&#8203;5293](https://github.com/anchore/syft/pull/5293) [@&#8203;wagoodman](https://github.com/wagoodman)] - alpm mtree gzip unbounded processing \[PR [#&#8203;5292](https://github.com/anchore/syft/pull/5292) [@&#8203;wagoodman](https://github.com/wagoodman)] - graalvm unbounded allocation \[PR [#&#8203;5291](https://github.com/anchore/syft/pull/5291) [@&#8203;wagoodman](https://github.com/wagoodman)] - harden .NET PE/ELF parsing against malformed binaries \[PR [#&#8203;5267](https://github.com/anchore/syft/pull/5267) [@&#8203;wagoodman](https://github.com/wagoodman)] - bound allocations from UPX-packed binary headers \[PR [#&#8203;5195](https://github.com/anchore/syft/pull/5195) [@&#8203;wagoodman](https://github.com/wagoodman)] - Syft rpm-db-cataloger reports stale libssh version from a single-layer Rocky Linux 10 image \[Issue [#&#8203;5247](https://github.com/anchore/syft/issues/5247)] - java-archive-cataloger returns unknown ver for uber-jars \[Issue [#&#8203;5163](https://github.com/anchore/syft/issues/5163)] \[PR [#&#8203;5164](https://github.com/anchore/syft/pull/5164) [@&#8203;rezmoss](https://github.com/rezmoss)] ##### Dependencies 52 dependency changes (52 updated). 6 vulnerabilities remediated. **🟢 Remediated (6)** - [GHSA-2v4p-qf9q-27wj](https://github.com/advisories/GHSA-2v4p-qf9q-27wj) (High) — google.golang.org/grpc - [GHSA-7jxh-36q5-gcqv](https://github.com/advisories/GHSA-7jxh-36q5-gcqv) (Medium) — github.com/containerd/containerd/v2 - [GHSA-qc2q-p7wx-3px3](https://github.com/advisories/GHSA-qc2q-p7wx-3px3) (Medium) — google.golang.org/grpc - [GHSA-vp52-pcj8-j9qc](https://github.com/advisories/GHSA-vp52-pcj8-j9qc) (High) — google.golang.org/grpc - [GO-2026-6354](https://go.dev/issue/81316) (High) — golang.org/x/crypto - [GO-2026-6355](https://go.dev/issue/81317) (High) — golang.org/x/crypto <details> <summary>Updated (52 packages)</summary> - cloud.google.com/go/auth `v0.22.0` → `v0.23.2` - cloud.google.com/go/iam `v1.11.0` → `v1.12.0` - cloud.google.com/go/logging `v1.18.0` → `v1.19.0` - cloud.google.com/go/monitoring `v1.29.0` → `v1.30.0` - cloud.google.com/go/storage `v1.64.0` → `v1.65.1` - github.com/CycloneDX/cyclonedx-go `v0.11.0` → `v0.12.0` - github.com/anchore/go-sync `v0.1.1` → `v0.1.2` - github.com/anchore/stereoscope `v0.3.1` → `v0.3.2` - github.com/aws/aws-sdk-go-v2 `v1.43.4` → `v1.44.0` - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream `v1.7.16` → `v1.7.20` - github.com/aws/aws-sdk-go-v2/config `v1.32.35` → `v1.32.40` - github.com/aws/aws-sdk-go-v2/credentials `v1.19.34` → `v1.19.39` - github.com/aws/aws-sdk-go-v2/feature/ec2/imds `v1.18.35` → `v1.18.40` - github.com/aws/aws-sdk-go-v2/internal/configsources `v1.4.35` → `v1.4.40` - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 `v2.7.35` → `v2.7.40` - github.com/aws/aws-sdk-go-v2/internal/v4a `v1.4.36` → `v1.4.41` - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding `v1.13.15` → `v1.13.19` - github.com/aws/aws-sdk-go-v2/service/internal/checksum `v1.9.28` → `v1.10.0` - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url `v1.13.35` → `v1.13.40` - github.com/aws/aws-sdk-go-v2/service/internal/s3shared `v1.19.36` → `v1.19.41` - github.com/aws/aws-sdk-go-v2/service/s3 `v1.106.5` → `v1.108.0` - github.com/aws/aws-sdk-go-v2/service/signin `v1.5.4` → `v1.6.0` - github.com/aws/aws-sdk-go-v2/service/sso `v1.33.4` → `v1.34.0` - github.com/aws/aws-sdk-go-v2/service/ssooidc `v1.38.4` → `v1.39.0` - github.com/aws/aws-sdk-go-v2/service/sts `v1.45.4` → `v1.46.0` - github.com/aws/smithy-go `v1.27.6` → `v1.28.1` - github.com/containerd/containerd/v2 `v2.3.4` → `v2.3.5` **(🟢 remediated [GHSA-7jxh-36q5-gcqv](https://github.com/advisories/GHSA-7jxh-36q5-gcqv))** - github.com/docker/cli `v29.7.2+incompatible` → `v29.8.0+incompatible` - github.com/google/go-containerregistry `v0.21.9` → `v0.22.1` - github.com/googleapis/enterprise-certificate-proxy `v0.3.19` → `v0.3.20` - github.com/googleapis/gax-go/v2 `v2.23.0` → `v2.24.0` - github.com/gpustack/gguf-parser-go `v0.25.0` → `v0.26.3` - github.com/hashicorp/go-getter `v1.8.8` → `v1.8.9` - github.com/klauspost/compress `v1.19.2` → `v1.20.0` - github.com/moby/moby/api `v1.55.0` → `v1.56.0` - github.com/moby/moby/client `v0.5.1` → `v0.6.0` - github.com/terminalstatic/go-xsd-validate `v0.1.6` → `v0.1.8` - golang.org/x/crypto `v0.55.0` → `v0.56.0` **(🟢 remediated [GO-2026-6354](https://go.dev/issue/81316), [GO-2026-6355](https://go.dev/issue/81317))** - golang.org/x/mod `v0.40.0` → `v0.41.0` - golang.org/x/time `v0.15.0` → `v0.16.0` - google.golang.org/api `v0.292.0` → `v0.294.0` - google.golang.org/genproto `v0.0.0-aa98bba` → `v0.0.0-e75dac1` - google.golang.org/genproto/googleapis/api `v0.0.0-925bb5d` → `v0.0.0-e75dac1` - google.golang.org/genproto/googleapis/rpc `v0.0.0-6ac0973` → `v0.0.0-08b0e42` - google.golang.org/grpc `v1.83.0` → `v1.83.2` **(🟢 remediated [GHSA-2v4p-qf9q-27wj](https://github.com/advisories/GHSA-2v4p-qf9q-27wj), [GHSA-qc2q-p7wx-3px3](https://github.com/advisories/GHSA-qc2q-p7wx-3px3), [GHSA-vp52-pcj8-j9qc](https://github.com/advisories/GHSA-vp52-pcj8-j9qc))** - google.golang.org/protobuf `v1.36.12-0.f2248ac` → `v1.36.12` - modernc.org/cc/v4 `v4.29.1` → `v4.29.2` - modernc.org/ccgo/v4 `v4.34.6` → `v4.35.0` - modernc.org/gc/v3 `v3.1.4` → `v3.1.5` - modernc.org/libc `v1.74.4` → `v1.75.6` - modernc.org/memory `v1.11.0` → `v1.12.1` - modernc.org/sqlite `v1.56.0` → `v1.58.0` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.51.1...v1.52.0)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC45My40IiwidXBkYXRlZEluVmVyIjoiNDQuOTMuNCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJyZW5vdmF0ZS9hdXRvbWVyZ2UiLCJyZW5vdmF0ZS9naXRodWItYWN0aW9uIl19-->
CSRBot added 1 commit 2026-09-17 18:15:55 +02:00
chore(deps): update dependency anchore/syft to v1.52.0
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 18s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 19s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 32s
Details
Lint Markdown files / Run markdown linter (pull_request) Successful in 7s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 25s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 28s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 29s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 59s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 1m1s
Details
2de672d5bf
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-09-17 18:16:09 +02:00
CSRBot merged commit 8a863466bc into master 2026-09-17 18:21:14 +02:00
CSRBot deleted branch renovate/anchore-syft-1.x 2026-09-17 18:21:15 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#219