volker.raschek/dcmerge
1
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

chore(deps): update dependency anchore/syft to v1.51.1 #209

Merged
CSRBot merged 1 commits from renovate/anchore-syft-1.x into master 2026-08-27 20:12:42 +02:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-08-27 20:06:40 +02:00
Collaborator
Copy Link
Copy Source

This PR contains the following updates:

Package Update Change
anchore/syft patch 1.51.0 → 1.51.1

Release Notes

anchore/syft (anchore/syft)

v1.51.1

Compare Source

Bug Fixes
Additional Changes
Dependencies

72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.

🟢 Remediated (3)

Updated (70 packages)
  • cel.dev/expr v0.25.1 → v0.25.2
  • cloud.google.com/go/auth v0.18.2 → v0.22.0
  • cloud.google.com/go/iam v1.5.3 → v1.11.0
  • cloud.google.com/go/logging v1.13.1 → v1.18.0
  • cloud.google.com/go/longrunning v0.8.0 → v1.2.0
  • cloud.google.com/go/monitoring v1.24.3 → v1.29.0
  • cloud.google.com/go/storage v1.61.3 → v1.64.0
  • cloud.google.com/go/trace v1.11.7 → v1.16.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 → v1.33.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 → v0.57.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 → v0.57.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 → v0.57.0
  • github.com/anchore/stereoscope v0.3.0 → v0.3.1
  • github.com/aws/aws-sdk-go-v2 v1.41.5 → v1.43.4
  • github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 → v1.7.16
  • github.com/aws/aws-sdk-go-v2/config v1.32.12 → v1.32.35
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.12 → v1.19.34
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 → v1.18.35
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 → v1.4.35
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 → v2.7.35
  • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 → v1.4.36
  • github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 → v1.13.15
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 → v1.9.28
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 → v1.13.35
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 → v1.19.36
  • github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 → v1.106.5
  • github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 → v1.33.4
  • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 → v1.38.4
  • github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 → v1.45.4
  • github.com/aws/smithy-go v1.24.2 → v1.27.6
  • github.com/containerd/containerd/v2 v2.3.3 → v2.3.4
  • github.com/containerd/platforms v1.0.0-rc.4 → v1.0.0-rc.5
  • github.com/docker/cli v29.6.1+incompatible → v29.7.2+incompatible
  • github.com/docker/go-connections v0.7.0 → v0.8.1
  • github.com/fatih/color v1.18.0 → v1.19.0
  • github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15
  • github.com/google/go-containerregistry v0.21.7 → v0.21.9
  • github.com/google/pprof v0.0.0-a4b03ec → v0.0.0-ef3492d
  • github.com/googleapis/enterprise-certificate-proxy v0.3.14 → v0.3.19
  • github.com/googleapis/gax-go/v2 v2.17.0 → v2.23.0
  • github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 → v2.0.0-beta.74
  • github.com/hashicorp/go-getter v1.8.6 → v1.8.8
  • github.com/hashicorp/go-version v1.8.0 → v1.9.0
  • github.com/klauspost/compress v1.19.1 → v1.19.2
  • github.com/mattn/go-isatty v0.0.20 → v0.0.24
  • github.com/moby/moby/client v0.5.0 → v0.5.1
  • github.com/spiffe/go-spiffe/v2 v2.6.0 → v2.7.0
  • github.com/stretchr/objx v0.5.2 → v0.5.3
  • github.com/stretchr/testify v1.11.1 → v1.12.1
  • go.opentelemetry.io/contrib/detectors/gcp v1.43.0 → v1.44.0
  • go.opentelemetry.io/otel v1.43.0 → v1.44.0 (🟢 remediated GO-2026-5158)
  • go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 → v1.44.0
  • go.opentelemetry.io/otel/metric v1.43.0 → v1.44.0
  • go.opentelemetry.io/otel/sdk v1.43.0 → v1.44.0
  • go.opentelemetry.io/otel/sdk/metric v1.43.0 → v1.44.0
  • go.opentelemetry.io/otel/trace v1.43.0 → v1.44.0
  • golang.org/x/crypto v0.54.0 → v0.55.0
  • golang.org/x/mod v0.38.0 → v0.40.0 (🟢 remediated GO-2026-6179, GO-2026-6180)
  • golang.org/x/net v0.57.0 → v0.58.0
  • golang.org/x/text v0.40.0 → v0.41.0
  • golang.org/x/tools v0.48.0 → v0.49.0
  • google.golang.org/api v0.271.0 → v0.292.0
  • google.golang.org/genproto v0.0.0-8636f87 → v0.0.0-aa98bba
  • google.golang.org/genproto/googleapis/api v0.0.0-afd174a → v0.0.0-925bb5d
  • google.golang.org/genproto/googleapis/rpc v0.0.0-afd174a → v0.0.0-6ac0973
  • google.golang.org/grpc v1.82.1 → v1.83.0
  • modernc.org/cc/v4 v4.29.0 → v4.29.1
  • modernc.org/libc v1.74.1 → v1.74.4
  • modernc.org/sqlite v1.55.0 → v1.56.0
Added (1 package)
  • go.opentelemetry.io/otel/metric/x v0.66.0
Removed (1 package)
  • github.com/aws/aws-sdk-go-v2/internal/ini v1.8.6

(Full Changelog)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | patch | `1.51.0` → `1.51.1` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.51.1`](https://github.com/anchore/syft/releases/tag/v1.51.1) [Compare Source](https://github.com/anchore/syft/compare/v1.51.0...v1.51.1) ##### Bug Fixes - detect multi-arch ingress-nginx \[PR [#&#8203;5179](https://github.com/anchore/syft/pull/5179) [@&#8203;CAOShurong](https://github.com/CAOShurong)] - keep the epoch when parsing RPM manifest packages \[PR [#&#8203;5201](https://github.com/anchore/syft/pull/5201) [@&#8203;sueun-dev](https://github.com/sueun-dev)] - correct Apache Derby group ID in purl generation \[PR [#&#8203;5090](https://github.com/anchore/syft/pull/5090) [@&#8203;Ankush-Pathak](https://github.com/Ankush-Pathak)] - move image hardlink handling upstream during image indexing \[PR [#&#8203;5196](https://github.com/anchore/syft/pull/5196) [@&#8203;wagoodman](https://github.com/wagoodman)] - keep epoch-pinned requirements in the SBOM \[PR [#&#8203;5161](https://github.com/anchore/syft/pull/5161) [@&#8203;sueun-dev](https://github.com/sueun-dev)] - Prevent unnecessary allocations when parsing compressed ELF sections \[PR [#&#8203;5187](https://github.com/anchore/syft/pull/5187) [@&#8203;wagoodman](https://github.com/wagoodman)] - honor the io.ReaderAt contract in readerAtAdapter \[PR [#&#8203;5186](https://github.com/anchore/syft/pull/5186) [@&#8203;wagoodman](https://github.com/wagoodman)] - Support grafana binary various version \[Issue [#&#8203;5059](https://github.com/anchore/syft/issues/5059)] \[PR [#&#8203;5213](https://github.com/anchore/syft/pull/5213) [@&#8203;pujitha24](https://github.com/pujitha24)] - Excluded paths are still scanned and cause syft to crash \[Issue [#&#8203;3258](https://github.com/anchore/syft/issues/3258)] - Dotnet: Incorrect relationship graph in case of using package locks \[Issue [#&#8203;5125](https://github.com/anchore/syft/issues/5125)] \[PR [#&#8203;5143](https://github.com/anchore/syft/pull/5143) [@&#8203;pujitha24](https://github.com/pujitha24)] - Survive indexing not accessible files \[Issue [#&#8203;3286](https://github.com/anchore/syft/issues/3286)] \[PR [#&#8203;5170](https://github.com/anchore/syft/pull/5170) [@&#8203;addielaruee](https://github.com/addielaruee)] - CPE target\_sw not being set consistency for Rust crates \[Issue [#&#8203;3956](https://github.com/anchore/syft/issues/3956)] \[PR [#&#8203;5167](https://github.com/anchore/syft/pull/5167) [@&#8203;Xenira](https://github.com/Xenira)] - panic: nil pointer dereference in squashfs.(\*File).Read when scanning snap (regression from 1.44.0) \[Issue [#&#8203;4989](https://github.com/anchore/syft/issues/4989)] \[PR [#&#8203;5119](https://github.com/anchore/syft/pull/5119) [@&#8203;kzantow](https://github.com/kzantow)] - golang remote license search attempts to resolve stdlib modules \[Issue [#&#8203;3149](https://github.com/anchore/syft/issues/3149)] \[PR [#&#8203;5192](https://github.com/anchore/syft/pull/5192) [@&#8203;luantaraschi](https://github.com/luantaraschi)] ##### Additional Changes - gzip binary classifier reports false-positive GNU gzip from BusyBox multicall binary via applet symlink \[Issue [#&#8203;5171](https://github.com/anchore/syft/issues/5171)] \[PR [#&#8203;5202](https://github.com/anchore/syft/pull/5202) [@&#8203;spiffcs](https://github.com/spiffcs)] - pnpm v5 lockfile: underscore peer-dep suffixes are not stripped from package versions \[Issue [#&#8203;5174](https://github.com/anchore/syft/issues/5174)] \[PR [#&#8203;5175](https://github.com/anchore/syft/pull/5175) [@&#8203;codeAnqiang-ma](https://github.com/codeAnqiang-ma)] - pnpm cataloger reads only the first YAML document: SBOM contains pnpm's own binaries and no project dependencies \[Issue [#&#8203;5168](https://github.com/anchore/syft/issues/5168)] \[PR [#&#8203;5188](https://github.com/anchore/syft/pull/5188) [@&#8203;hamodywe](https://github.com/hamodywe)] ##### Dependencies 72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated. **🟢 Remediated (3)** - [GO-2026-5158](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835) (Medium) — go.opentelemetry.io/otel - [GO-2026-6179](https://go.dev/issue/80744) (High) — golang.org/x/mod - [GO-2026-6180](https://go.dev/issue/80745) (High) — golang.org/x/mod <details> <summary>Updated (70 packages)</summary> - cel.dev/expr `v0.25.1` → `v0.25.2` - cloud.google.com/go/auth `v0.18.2` → `v0.22.0` - cloud.google.com/go/iam `v1.5.3` → `v1.11.0` - cloud.google.com/go/logging `v1.13.1` → `v1.18.0` - cloud.google.com/go/longrunning `v0.8.0` → `v1.2.0` - cloud.google.com/go/monitoring `v1.24.3` → `v1.29.0` - cloud.google.com/go/storage `v1.61.3` → `v1.64.0` - cloud.google.com/go/trace `v1.11.7` → `v1.16.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp `v1.32.0` → `v1.33.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric `v0.55.0` → `v0.57.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock `v0.55.0` → `v0.57.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping `v0.55.0` → `v0.57.0` - github.com/anchore/stereoscope `v0.3.0` → `v0.3.1` - github.com/aws/aws-sdk-go-v2 `v1.41.5` → `v1.43.4` - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream `v1.7.8` → `v1.7.16` - github.com/aws/aws-sdk-go-v2/config `v1.32.12` → `v1.32.35` - github.com/aws/aws-sdk-go-v2/credentials `v1.19.12` → `v1.19.34` - github.com/aws/aws-sdk-go-v2/feature/ec2/imds `v1.18.20` → `v1.18.35` - github.com/aws/aws-sdk-go-v2/internal/configsources `v1.4.21` → `v1.4.35` - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 `v2.7.21` → `v2.7.35` - github.com/aws/aws-sdk-go-v2/internal/v4a `v1.4.22` → `v1.4.36` - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding `v1.13.7` → `v1.13.15` - github.com/aws/aws-sdk-go-v2/service/internal/checksum `v1.9.13` → `v1.9.28` - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url `v1.13.21` → `v1.13.35` - github.com/aws/aws-sdk-go-v2/service/internal/s3shared `v1.19.21` → `v1.19.36` - github.com/aws/aws-sdk-go-v2/service/s3 `v1.97.3` → `v1.106.5` - github.com/aws/aws-sdk-go-v2/service/signin `v1.0.8` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/service/sso `v1.30.13` → `v1.33.4` - github.com/aws/aws-sdk-go-v2/service/ssooidc `v1.35.17` → `v1.38.4` - github.com/aws/aws-sdk-go-v2/service/sts `v1.41.9` → `v1.45.4` - github.com/aws/smithy-go `v1.24.2` → `v1.27.6` - github.com/containerd/containerd/v2 `v2.3.3` → `v2.3.4` - github.com/containerd/platforms `v1.0.0-rc.4` → `v1.0.0-rc.5` - github.com/docker/cli `v29.6.1+incompatible` → `v29.7.2+incompatible` - github.com/docker/go-connections `v0.7.0` → `v0.8.1` - github.com/fatih/color `v1.18.0` → `v1.19.0` - github.com/gabriel-vasile/mimetype `v1.4.13` → `v1.4.15` - github.com/google/go-containerregistry `v0.21.7` → `v0.21.9` - github.com/google/pprof `v0.0.0-a4b03ec` → `v0.0.0-ef3492d` - github.com/googleapis/enterprise-certificate-proxy `v0.3.14` → `v0.3.19` - github.com/googleapis/gax-go/v2 `v2.17.0` → `v2.23.0` - github.com/hashicorp/aws-sdk-go-base/v2 `v2.0.0-beta.72` → `v2.0.0-beta.74` - github.com/hashicorp/go-getter `v1.8.6` → `v1.8.8` - github.com/hashicorp/go-version `v1.8.0` → `v1.9.0` - github.com/klauspost/compress `v1.19.1` → `v1.19.2` - github.com/mattn/go-isatty `v0.0.20` → `v0.0.24` - github.com/moby/moby/client `v0.5.0` → `v0.5.1` - github.com/spiffe/go-spiffe/v2 `v2.6.0` → `v2.7.0` - github.com/stretchr/objx `v0.5.2` → `v0.5.3` - github.com/stretchr/testify `v1.11.1` → `v1.12.1` - go.opentelemetry.io/contrib/detectors/gcp `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel `v1.43.0` → `v1.44.0` **(🟢 remediated [GO-2026-5158](https://github.com/open-telemetry/opentelemetry-go/security/advisories/GHSA-5wrp-cwcj-q835))** - go.opentelemetry.io/otel/exporters/stdout/stdoutmetric `v1.40.0` → `v1.44.0` - go.opentelemetry.io/otel/metric `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel/sdk `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel/sdk/metric `v1.43.0` → `v1.44.0` - go.opentelemetry.io/otel/trace `v1.43.0` → `v1.44.0` - golang.org/x/crypto `v0.54.0` → `v0.55.0` - golang.org/x/mod `v0.38.0` → `v0.40.0` **(🟢 remediated [GO-2026-6179](https://go.dev/issue/80744), [GO-2026-6180](https://go.dev/issue/80745))** - golang.org/x/net `v0.57.0` → `v0.58.0` - golang.org/x/text `v0.40.0` → `v0.41.0` - golang.org/x/tools `v0.48.0` → `v0.49.0` - google.golang.org/api `v0.271.0` → `v0.292.0` - google.golang.org/genproto `v0.0.0-8636f87` → `v0.0.0-aa98bba` - google.golang.org/genproto/googleapis/api `v0.0.0-afd174a` → `v0.0.0-925bb5d` - google.golang.org/genproto/googleapis/rpc `v0.0.0-afd174a` → `v0.0.0-6ac0973` - google.golang.org/grpc `v1.82.1` → `v1.83.0` - modernc.org/cc/v4 `v4.29.0` → `v4.29.1` - modernc.org/libc `v1.74.1` → `v1.74.4` - modernc.org/sqlite `v1.55.0` → `v1.56.0` </details> <details> <summary>Added (1 package)</summary> - go.opentelemetry.io/otel/metric/x `v0.66.0` </details> <details> <summary>Removed (1 package)</summary> - github.com/aws/aws-sdk-go-v2/internal/ini `v1.8.6` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.51.0...v1.51.1)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC40Ni4wIiwidXBkYXRlZEluVmVyIjoiNDQuNDYuMCIsInRhcmdldEJyYW5jaCI6Im1hc3RlciIsImxhYmVscyI6WyJyZW5vdmF0ZS9hdXRvbWVyZ2UiLCJyZW5vdmF0ZS9naXRodWItYWN0aW9uIl19-->
CSRBot added 1 commit 2026-08-27 20:06:42 +02:00
chore(deps): update dependency anchore/syft to v1.51.1
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 25s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 38s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 24s
Details
Lint Markdown files / Run markdown linter (pull_request) Successful in 6s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 28s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 41s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 17s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 1m0s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 1m0s
Details
2664e658cc
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-08-27 20:06:46 +02:00
CSRBot merged commit 517b89d601 into master 2026-08-27 20:12:42 +02:00
CSRBot deleted branch renovate/anchore-syft-1.x 2026-08-27 20:12:42 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#209