chore(deps): update dependency anchore/syft to v1.54.0 #222

2026-10-03T18:09:42+02:00

CSRBot commented

2026-10-03 18:09:42 +02:00

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	`1.52.0` → `1.54.0`

Release Notes

anchore/syft (anchore/syft)

`v1.54.0`

Compare Source

Added Features

report the perl interpreter as a cpan package [PR #5132 @wagoodman]
Add package cataloger for perl ecosystem [Issue #1906] [PR #5131 @wagoodman]
Analyze with Non-Daemon podman [Issue #1173]

Bug Fixes

write a name for the root package when the source has none [PR #5349 @DrVelvetFog]
match opensource.org license URLs across SPDX URL forms [PR #5361 @willmurphyscode]
Account for malformed GGUF and safetensors parameter counts [PR #5343 @wagoodman]
don't panic on a root file without a supplier or null entries [PR #5326 @DrVelvetFog]
do not panic on a stack.yaml rev pin [PR #5310 @arpitjain099]
report scanner errors and raise the line cap in metadata parsers [PR #5353 @wagoodman]
Harden cataloger parsers against truncated input (do not panic) [PR #5355 @wagoodman]
bound CPE candidate generation for pathological package metadata [PR #5356 @wagoodman]
account for UPX's loader padding when unpacking Go binaries [PR #5347 @huuyafwww]
handle malformed GGUF headers without panicking [PR #5345 @wagoodman]
bound model companion file reads and validate their contents [PR #5344 @wagoodman]
don't fail the whole SBOM when a cataloger panics on one file [PR #5342 @wagoodman]
release package collection lock in Ubuntu ESM detection [PR #5336 @sverrirsig]
render TUI log lines on their own rows, with colors and a small header [PR #5324 @wagoodman]
uv.lock: dependents are linked to every locked version of a dependency [Issue #5340] [PR #5351 @devtechedge]
java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy [Issue #5311] [PR #5313 @texasich]
Support traefik binary various versions [Issue #4980] [PR #5281 @mayanksekhar]
File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support [Issue #5325] [PR #5341 @wagoodman]
not showing expat CVEs from syft generated sbom [Issue #4771] [PR #5259 @KR-Ravindra]
PHP extensions are cataloged as upstream products using the PHP version [Issue #5014] [PR #5102 @pujitha24]
Panic during scanning with gguf-cataloger/safetensors-cataloger [Issue #5327] [PR #5328 @tk1475]
github-actions cataloger emits an invalid PURL for docker:// use statements [Issue #5299] [PR #5302 @yunaremaia]
Crash when running syft on a directory that is the root file system of a Yocto build [Issue #5320] [PR #5321 @somaz94]
Invalid PURLs when cataloging instrumentation classes/jars [Issue #2596]

Dependencies

79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated.

🟢 Remediated (2)

GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/sdk
GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2

Toolchains (1)

Go minimum version: 1.26.3 → 1.26.8

Updated (48 packages)

github.com/Microsoft/hcsshim v0.15.0-rc.1 → v0.15.0-rc.4
github.com/anchore/bubbly v0.2.1 → v0.2.2
github.com/anchore/go-logger v0.1.1 → v0.2.0
github.com/anchore/stereoscope v0.3.2 → v0.3.3
github.com/bmatcuk/doublestar/v4 v4.10.0 → v4.10.2
github.com/containerd/containerd/api v1.11.1 → v1.12.0
github.com/containerd/containerd/v2 v2.3.5 → v2.4.1 (🟢 remediated GHSA-pg57-6jwg-q645)
github.com/containerd/log v0.1.0 → v0.2.0
github.com/containerd/ttrpc v1.2.8 → v1.2.9
github.com/containerd/typeurl/v2 v2.2.3 → v2.3.0
github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
github.com/docker/cli v29.8.0+incompatible → v29.8.1+incompatible
github.com/docker/docker-credential-helpers v0.9.5 → v0.9.8
github.com/dustin/go-humanize v1.0.1 → v1.1.0
github.com/erofs/go-erofs v0.3.0 → v0.3.1
github.com/felixge/httpsnoop v1.0.4 → v1.1.0
github.com/fsnotify/fsnotify v1.9.0 → v1.10.1
github.com/go-jose/go-jose/v4 v4.1.4 → v4.1.5
github.com/go-logr/logr v1.4.3 → v1.4.4
github.com/hashicorp/hcl/v2 v2.24.0 → v2.25.0
github.com/magiconair/properties v1.18.11 → v1.18.12
github.com/mattn/go-runewidth v0.0.21 → v0.0.27
github.com/moby/sys/user v0.4.0 → v0.4.1
github.com/moby/sys/userns v0.1.0 → v0.2.1
github.com/nwaples/rardecode/v2 v2.2.0 → v2.4.1
github.com/olekukonko/tablewriter v1.1.4 → v1.1.5
github.com/sirupsen/logrus v1.9.4 → v1.10.2
github.com/ulikunitz/xz v0.5.16 → v0.5.17
github.com/zclconf/go-cty v1.16.3 → v1.19.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 → v0.71.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 → v0.71.0
go.opentelemetry.io/otel v1.44.0 → v1.46.0
go.opentelemetry.io/otel/metric v1.44.0 → v1.46.0
go.opentelemetry.io/otel/metric/x v0.66.0 → v0.68.0
go.opentelemetry.io/otel/sdk v1.44.0 → v1.46.0 (🟢 remediated GHSA-8wmf-6v46-5gfg)
go.opentelemetry.io/otel/sdk/metric v1.44.0 → v1.46.0
go.opentelemetry.io/otel/trace v1.44.0 → v1.46.0
golang.org/x/crypto v0.56.0 → v0.57.0
golang.org/x/net v0.58.0 → v0.59.0
golang.org/x/sync v0.22.0 → v0.23.0
golang.org/x/sys v0.47.0 → v0.48.0
golang.org/x/term v0.45.0 → v0.46.0
golang.org/x/text v0.41.0 → v0.42.0
golang.org/x/tools v0.49.0 → v0.50.0
google.golang.org/genproto/googleapis/api v0.0.0-e75dac1 → v0.0.0-da73d73
google.golang.org/genproto/googleapis/rpc v0.0.0-08b0e42 → v0.0.0-da73d73
modernc.org/libc v1.75.6 → v1.75.7
modernc.org/sqlite v1.58.0 → v1.59.0

Added (28 packages)

cyphar.com/go-pathrs v0.2.5
github.com/VividCortex/ewma v1.2.0
github.com/apparentlymart/go-textseg/v17 v17.0.1
github.com/containerd/log/otel v0.1.0
github.com/containerd/stargz-snapshotter/estargz v0.18.2
github.com/containers/libtrust v0.0.0-c1716e8
github.com/containers/ocicrypt v1.3.2
github.com/cyberphone/json-canonicalization v0.0.0-19d51d7
github.com/google/go-intervals v0.0.2
github.com/mattn/go-sqlite3 v1.14.48
github.com/miekg/pkcs11 v1.1.2
github.com/mistifyio/go-zfs/v4 v4.0.0
github.com/moby/sys/capability v0.4.0
github.com/opencontainers/selinux v1.15.1
github.com/proglottis/gpgme v0.1.6
github.com/secure-systems-lab/go-securesystemslib v0.11.0
github.com/sigstore/fulcio v1.8.7
github.com/sigstore/protobuf-specs v0.5.1
github.com/sigstore/sigstore v1.10.8
github.com/smallstep/pkcs7 v0.2.1
github.com/stefanberger/go-pkcs11uri v0.0.0-7828495
github.com/tchap/go-patricia/v2 v2.3.3
github.com/vbatts/tar-split v0.12.3
github.com/vbauerster/cupwriter v0.0.4
github.com/vbauerster/mpb/v8 v8.14.0
github.com/youmark/pkcs8 v0.0.0-a2c0da2
go.podman.io/image/v5 v5.41.2
go.podman.io/storage v1.64.1

Removed (3 packages)

github.com/gogo/protobuf v1.3.2
github.com/moby/sys/sequential v0.6.0
go.opencensus.io v0.24.0

(Full Changelog)

Configuration

📅 Schedule: (UTC)

Branch creation
- At any time (no schedule defined)
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | minor | `1.52.0` → `1.54.0` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.54.0`](https://github.com/anchore/syft/releases/tag/v1.54.0) [Compare Source](https://github.com/anchore/syft/compare/v1.52.0...v1.54.0) ##### Added Features - report the perl interpreter as a cpan package \[PR [#5132](https://github.com/anchore/syft/pull/5132) [@wagoodman](https://github.com/wagoodman)] - Add package cataloger for perl ecosystem \[Issue [#1906](https://github.com/anchore/syft/issues/1906)] \[PR [#5131](https://github.com/anchore/syft/pull/5131) [@wagoodman](https://github.com/wagoodman)] - Analyze with Non-Daemon podman \[Issue [#1173](https://github.com/anchore/syft/issues/1173)] ##### Bug Fixes - write a name for the root package when the source has none \[PR [#5349](https://github.com/anchore/syft/pull/5349) [@DrVelvetFog](https://github.com/DrVelvetFog)] - match opensource.org license URLs across SPDX URL forms \[PR [#5361](https://github.com/anchore/syft/pull/5361) [@willmurphyscode](https://github.com/willmurphyscode)] - Account for malformed GGUF and safetensors parameter counts \[PR [#5343](https://github.com/anchore/syft/pull/5343) [@wagoodman](https://github.com/wagoodman)] - don't panic on a root file without a supplier or null entries \[PR [#5326](https://github.com/anchore/syft/pull/5326) [@DrVelvetFog](https://github.com/DrVelvetFog)] - do not panic on a stack.yaml rev pin \[PR [#5310](https://github.com/anchore/syft/pull/5310) [@arpitjain099](https://github.com/arpitjain099)] - report scanner errors and raise the line cap in metadata parsers \[PR [#5353](https://github.com/anchore/syft/pull/5353) [@wagoodman](https://github.com/wagoodman)] - Harden cataloger parsers against truncated input (do not panic) \[PR [#5355](https://github.com/anchore/syft/pull/5355) [@wagoodman](https://github.com/wagoodman)] - bound CPE candidate generation for pathological package metadata \[PR [#5356](https://github.com/anchore/syft/pull/5356) [@wagoodman](https://github.com/wagoodman)] - account for UPX's loader padding when unpacking Go binaries \[PR [#5347](https://github.com/anchore/syft/pull/5347) [@huuyafwww](https://github.com/huuyafwww)] - handle malformed GGUF headers without panicking \[PR [#5345](https://github.com/anchore/syft/pull/5345) [@wagoodman](https://github.com/wagoodman)] - bound model companion file reads and validate their contents \[PR [#5344](https://github.com/anchore/syft/pull/5344) [@wagoodman](https://github.com/wagoodman)] - don't fail the whole SBOM when a cataloger panics on one file \[PR [#5342](https://github.com/anchore/syft/pull/5342) [@wagoodman](https://github.com/wagoodman)] - release package collection lock in Ubuntu ESM detection \[PR [#5336](https://github.com/anchore/syft/pull/5336) [@sverrirsig](https://github.com/sverrirsig)] - render TUI log lines on their own rows, with colors and a small header \[PR [#5324](https://github.com/anchore/syft/pull/5324) [@wagoodman](https://github.com/wagoodman)] - uv.lock: dependents are linked to every locked version of a dependency \[Issue [#5340](https://github.com/anchore/syft/issues/5340)] \[PR [#5351](https://github.com/anchore/syft/pull/5351) [@devtechedge](https://github.com/devtechedge)] - java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy \[Issue [#5311](https://github.com/anchore/syft/issues/5311)] \[PR [#5313](https://github.com/anchore/syft/pull/5313) [@texasich](https://github.com/texasich)] - Support traefik binary various versions \[Issue [#4980](https://github.com/anchore/syft/issues/4980)] \[PR [#5281](https://github.com/anchore/syft/pull/5281) [@mayanksekhar](https://github.com/mayanksekhar)] - File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support \[Issue [#5325](https://github.com/anchore/syft/issues/5325)] \[PR [#5341](https://github.com/anchore/syft/pull/5341) [@wagoodman](https://github.com/wagoodman)] - not showing expat CVEs from syft generated sbom \[Issue [#4771](https://github.com/anchore/syft/issues/4771)] \[PR [#5259](https://github.com/anchore/syft/pull/5259) [@KR-Ravindra](https://github.com/KR-Ravindra)] - PHP extensions are cataloged as upstream products using the PHP version \[Issue [#5014](https://github.com/anchore/syft/issues/5014)] \[PR [#5102](https://github.com/anchore/syft/pull/5102) [@pujitha24](https://github.com/pujitha24)] - Panic during scanning with gguf-cataloger/safetensors-cataloger \[Issue [#5327](https://github.com/anchore/syft/issues/5327)] \[PR [#5328](https://github.com/anchore/syft/pull/5328) [@tk1475](https://github.com/tk1475)] - github-actions cataloger emits an invalid PURL for docker:// use statements \[Issue [#5299](https://github.com/anchore/syft/issues/5299)] \[PR [#5302](https://github.com/anchore/syft/pull/5302) [@yunaremaia](https://github.com/yunaremaia)] - Crash when running syft on a directory that is the root file system of a Yocto build \[Issue [#5320](https://github.com/anchore/syft/issues/5320)] \[PR [#5321](https://github.com/anchore/syft/pull/5321) [@somaz94](https://github.com/somaz94)] - Invalid PURLs when cataloging instrumentation classes/jars \[Issue [#2596](https://github.com/anchore/syft/issues/2596)] ##### Dependencies 79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated. **🟢 Remediated (2)** - [GHSA-8wmf-6v46-5gfg](https://github.com/advisories/GHSA-8wmf-6v46-5gfg) (Low) — go.opentelemetry.io/otel/sdk - [GHSA-pg57-6jwg-q645](https://github.com/advisories/GHSA-pg57-6jwg-q645) (Medium) — github.com/containerd/containerd/v2 **Toolchains (1)** - Go minimum version: `1.26.3` → `1.26.8` <details> <summary>Updated (48 packages)</summary> - github.com/Microsoft/hcsshim `v0.15.0-rc.1` → `v0.15.0-rc.4` - github.com/anchore/bubbly `v0.2.1` → `v0.2.2` - github.com/anchore/go-logger `v0.1.1` → `v0.2.0` - github.com/anchore/stereoscope `v0.3.2` → `v0.3.3` - github.com/bmatcuk/doublestar/v4 `v4.10.0` → `v4.10.2` - github.com/containerd/containerd/api `v1.11.1` → `v1.12.0` - github.com/containerd/containerd/v2 `v2.3.5` → `v2.4.1` **(🟢 remediated [GHSA-pg57-6jwg-q645](https://github.com/advisories/GHSA-pg57-6jwg-q645))** - github.com/containerd/log `v0.1.0` → `v0.2.0` - github.com/containerd/ttrpc `v1.2.8` → `v1.2.9` - github.com/containerd/typeurl/v2 `v2.2.3` → `v2.3.0` - github.com/cyphar/filepath-securejoin `v0.6.1` → `v0.7.0` - github.com/docker/cli `v29.8.0+incompatible` → `v29.8.1+incompatible` - github.com/docker/docker-credential-helpers `v0.9.5` → `v0.9.8` - github.com/dustin/go-humanize `v1.0.1` → `v1.1.0` - github.com/erofs/go-erofs `v0.3.0` → `v0.3.1` - github.com/felixge/httpsnoop `v1.0.4` → `v1.1.0` - github.com/fsnotify/fsnotify `v1.9.0` → `v1.10.1` - github.com/go-jose/go-jose/v4 `v4.1.4` → `v4.1.5` - github.com/go-logr/logr `v1.4.3` → `v1.4.4` - github.com/hashicorp/hcl/v2 `v2.24.0` → `v2.25.0` - github.com/magiconair/properties `v1.18.11` → `v1.18.12` - github.com/mattn/go-runewidth `v0.0.21` → `v0.0.27` - github.com/moby/sys/user `v0.4.0` → `v0.4.1` - github.com/moby/sys/userns `v0.1.0` → `v0.2.1` - github.com/nwaples/rardecode/v2 `v2.2.0` → `v2.4.1` - github.com/olekukonko/tablewriter `v1.1.4` → `v1.1.5` - github.com/sirupsen/logrus `v1.9.4` → `v1.10.2` - github.com/ulikunitz/xz `v0.5.16` → `v0.5.17` - github.com/zclconf/go-cty `v1.16.3` → `v1.19.0` - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc `v0.68.0` → `v0.71.0` - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp `v0.68.0` → `v0.71.0` - go.opentelemetry.io/otel `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/metric `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/metric/x `v0.66.0` → `v0.68.0` - go.opentelemetry.io/otel/sdk `v1.44.0` → `v1.46.0` **(🟢 remediated [GHSA-8wmf-6v46-5gfg](https://github.com/advisories/GHSA-8wmf-6v46-5gfg))** - go.opentelemetry.io/otel/sdk/metric `v1.44.0` → `v1.46.0` - go.opentelemetry.io/otel/trace `v1.44.0` → `v1.46.0` - golang.org/x/crypto `v0.56.0` → `v0.57.0` - golang.org/x/net `v0.58.0` → `v0.59.0` - golang.org/x/sync `v0.22.0` → `v0.23.0` - golang.org/x/sys `v0.47.0` → `v0.48.0` - golang.org/x/term `v0.45.0` → `v0.46.0` - golang.org/x/text `v0.41.0` → `v0.42.0` - golang.org/x/tools `v0.49.0` → `v0.50.0` - google.golang.org/genproto/googleapis/api `v0.0.0-e75dac1` → `v0.0.0-da73d73` - google.golang.org/genproto/googleapis/rpc `v0.0.0-08b0e42` → `v0.0.0-da73d73` - modernc.org/libc `v1.75.6` → `v1.75.7` - modernc.org/sqlite `v1.58.0` → `v1.59.0` </details> <details> <summary>Added (28 packages)</summary> - cyphar.com/go-pathrs `v0.2.5` - github.com/VividCortex/ewma `v1.2.0` - github.com/apparentlymart/go-textseg/v17 `v17.0.1` - github.com/containerd/log/otel `v0.1.0` - github.com/containerd/stargz-snapshotter/estargz `v0.18.2` - github.com/containers/libtrust `v0.0.0-c1716e8` - github.com/containers/ocicrypt `v1.3.2` - github.com/cyberphone/json-canonicalization `v0.0.0-19d51d7` - github.com/google/go-intervals `v0.0.2` - github.com/mattn/go-sqlite3 `v1.14.48` - github.com/miekg/pkcs11 `v1.1.2` - github.com/mistifyio/go-zfs/v4 `v4.0.0` - github.com/moby/sys/capability `v0.4.0` - github.com/opencontainers/selinux `v1.15.1` - github.com/proglottis/gpgme `v0.1.6` - github.com/secure-systems-lab/go-securesystemslib `v0.11.0` - github.com/sigstore/fulcio `v1.8.7` - github.com/sigstore/protobuf-specs `v0.5.1` - github.com/sigstore/sigstore `v1.10.8` - github.com/smallstep/pkcs7 `v0.2.1` - github.com/stefanberger/go-pkcs11uri `v0.0.0-7828495` - github.com/tchap/go-patricia/v2 `v2.3.3` - github.com/vbatts/tar-split `v0.12.3` - github.com/vbauerster/cupwriter `v0.0.4` - github.com/vbauerster/mpb/v8 `v8.14.0` - github.com/youmark/pkcs8 `v0.0.0-a2c0da2` - go.podman.io/image/v5 `v5.41.2` - go.podman.io/storage `v1.64.1` </details> <details> <summary>Removed (3 packages)</summary> - github.com/gogo/protobuf `v1.3.2` - github.com/moby/sys/sequential `v0.6.0` - go.opencensus.io `v0.24.0` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.52.0...v1.54.0)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).

CSRBot added 1 commit 2026-10-03 18:09:43 +02:00

chore(deps): update dependency anchore/syft to v1.54.0

Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 25s

Details

Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 42s

Details

Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 26s

Details

Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 18s

Details

Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 25s

Details

Lint Markdown files / Run markdown linter (pull_request) Successful in 6s

Details

Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 1m0s

Details

Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 29s

Details

Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 1m2s

Details

20f497fa04

CSRBot scheduled this pull request to auto merge when all checks succeed 2026-10-03 18:09:45 +02:00

CSRBot merged commit b8a79eba0f into master

2026-10-03 18:13:08 +02:00

CSRBot deleted branch renovate/anchore-syft-1.x

2026-10-03 18:13:09 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#222