volker.raschek/dcmerge
1
0 Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 11 Wiki Activity

chore(deps): update dependency anchore/syft to v1.55.0 #228

Merged
CSRBot merged 1 commits from renovate/anchore-syft-1.x into master 2026-10-19 21:29:46 +02:00
Conversation 0 Commits 1 Files Changed 1
+1 -1
CSRBot commented 2026-10-19 21:15:56 +02:00
Collaborator
Copy link
Copy source

This PR contains the following updates:

Package Update Change
anchore/syft minor 1.54.1 → 1.55.0

Release Notes

anchore/syft (anchore/syft)

v1.55.0

Compare Source

Added Features
  • Add support for scanning IPK packages using the deb-archive-cataloger [PR #​5111 @​skyhisi]
Bug Fixes
Additional Changes
Dependencies

49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

Updated (46 packages)
  • cloud.google.com/go/auth v0.23.2 → v0.23.3
  • cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
  • cloud.google.com/go/storage v1.65.1 → v1.68.0
  • github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
  • github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
  • github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
  • github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
  • github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
  • github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
  • github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
  • github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
  • github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
  • github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
  • github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
  • github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
  • github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
  • github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
  • github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
  • github.com/github/go-spdx/v2 v2.7.0 → v2.7.1
  • github.com/go-git/go-billy/v5 v5.9.1 → v5.9.2
  • github.com/go-git/go-git/v5 v5.19.2 → v5.19.3
  • github.com/google/s2a-go v0.1.9 → v0.1.10
  • github.com/googleapis/enterprise-certificate-proxy v0.3.20 → v0.3.22
  • github.com/googleapis/gax-go/v2 v2.24.0 → v2.24.1
  • github.com/gookit/color v1.6.1 → v1.6.2
  • github.com/gpustack/gguf-parser-go v0.26.3 → v0.26.4
  • github.com/hashicorp/go-getter v1.8.9 → v1.8.10
  • github.com/pb33f/ordered-map/v2 v2.3.1 → v2.3.2
  • github.com/pjbgf/sha1cd v0.6.0 → v0.7.0
  • github.com/spiffe/go-spiffe/v2 v2.7.0 → v2.8.1
  • golang.org/x/crypto v0.57.0 → v0.58.0
  • golang.org/x/net v0.59.0 → v0.61.0 (🟢 remediated GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617)
  • golang.org/x/oauth2 v0.36.0 → v0.37.0
  • golang.org/x/sync v0.23.0 → v0.24.0
  • golang.org/x/sys v0.48.0 → v0.49.0
  • golang.org/x/term v0.46.0 → v0.47.0
  • golang.org/x/text v0.42.0 → v0.43.0
  • golang.org/x/tools v0.50.0 → v0.51.0
  • google.golang.org/api v0.294.0 → v0.299.0
  • google.golang.org/genproto/googleapis/rpc v0.0.0-da73d73 → v0.0.0-b142276
  • google.golang.org/grpc v1.83.2 → v1.84.0
  • modernc.org/cc/v4 v4.29.2 → v4.29.7
  • modernc.org/ccgo/v4 v4.35.0 → v4.36.1
  • modernc.org/libc v1.75.7 → v1.77.1
  • modernc.org/sqlite v1.59.0 → v1.60.1
Added (1 package)
  • github.com/pb33f/go-yaml v0.1.0
Removed (2 packages)
  • github.com/klauspost/cpuid/v2 v2.3.0
  • go.yaml.in/yaml/v4 v4.0.0-rc.2

(Full Changelog)

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | minor | `1.54.1` → `1.55.0` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.55.0`](https://github.com/anchore/syft/releases/tag/v1.55.0) [Compare Source](https://github.com/anchore/syft/compare/v1.54.1...v1.55.0) ##### Added Features - Add support for scanning IPK packages using the deb-archive-cataloger \[PR [#&#8203;5111](https://github.com/anchore/syft/pull/5111) [@&#8203;skyhisi](https://github.com/skyhisi)] ##### Bug Fixes - Pin Gguff lib to prevent dropping packages \[PR [#&#8203;5447](https://github.com/anchore/syft/pull/5447) [@&#8203;spiffcs](https://github.com/spiffcs)] - Licensing: copyright holder missing, needed for Debian packaging \[Issue [#&#8203;5394](https://github.com/anchore/syft/issues/5394)] \[PR [#&#8203;5414](https://github.com/anchore/syft/pull/5414) [@&#8203;wagoodman](https://github.com/wagoodman)] - Syft cli.Command() panics when invoked multiple times \[Issue [#&#8203;2285](https://github.com/anchore/syft/issues/2285)] \[PR [#&#8203;5386](https://github.com/anchore/syft/pull/5386) [@&#8203;JasonMetal](https://github.com/JasonMetal)] ##### Additional Changes - bump go-make module and action together \[PR [#&#8203;5415](https://github.com/anchore/syft/pull/5415) [@&#8203;wagoodman](https://github.com/wagoodman)] ##### Dependencies 49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated. **🟢 Remediated (5)** - [GO-2026-6603](https://go.dev/cl/847185) (High) — golang.org/x/net - [GO-2026-6610](https://go.dev/cl/835145) (High) — golang.org/x/net - [GO-2026-6611](https://go.dev/cl/847186) (High) — golang.org/x/net - [GO-2026-6612](https://go.dev/cl/847187) (Critical) — golang.org/x/net - [GO-2026-6617](https://go.dev/cl/847188) (High) — golang.org/x/net <details> <summary>Updated (46 packages)</summary> - cloud.google.com/go/auth `v0.23.2` → `v0.23.3` - cloud.google.com/go/compute/metadata `v0.9.0` → `v0.9.1` - cloud.google.com/go/storage `v1.65.1` → `v1.68.0` - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp `v1.33.0` → `v1.34.0` - github.com/aws/aws-sdk-go-v2 `v1.44.0` → `v1.47.1` - github.com/aws/aws-sdk-go-v2/config `v1.32.40` → `v1.33.6` - github.com/aws/aws-sdk-go-v2/credentials `v1.19.39` → `v1.20.6` - github.com/aws/aws-sdk-go-v2/feature/ec2/imds `v1.18.40` → `v1.20.1` - github.com/aws/aws-sdk-go-v2/internal/configsources `v1.4.40` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 `v2.7.40` → `v2.8.4` - github.com/aws/aws-sdk-go-v2/internal/v4a `v1.4.41` → `v1.5.4` - github.com/aws/aws-sdk-go-v2/service/internal/checksum `v1.10.0` → `v1.11.5` - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url `v1.13.40` → `v1.14.4` - github.com/aws/aws-sdk-go-v2/service/internal/s3shared `v1.19.41` → `v1.20.4` - github.com/aws/aws-sdk-go-v2/service/s3 `v1.108.0` → `v1.114.0` - github.com/aws/aws-sdk-go-v2/service/signin `v1.6.0` → `v1.10.1` - github.com/aws/aws-sdk-go-v2/service/sso `v1.34.0` → `v1.38.1` - github.com/aws/aws-sdk-go-v2/service/ssooidc `v1.39.0` → `v1.43.1` - github.com/aws/aws-sdk-go-v2/service/sts `v1.46.0` → `v1.51.1` - github.com/github/go-spdx/v2 `v2.7.0` → `v2.7.1` - github.com/go-git/go-billy/v5 `v5.9.1` → `v5.9.2` - github.com/go-git/go-git/v5 `v5.19.2` → `v5.19.3` - github.com/google/s2a-go `v0.1.9` → `v0.1.10` - github.com/googleapis/enterprise-certificate-proxy `v0.3.20` → `v0.3.22` - github.com/googleapis/gax-go/v2 `v2.24.0` → `v2.24.1` - github.com/gookit/color `v1.6.1` → `v1.6.2` - github.com/gpustack/gguf-parser-go `v0.26.3` → `v0.26.4` - github.com/hashicorp/go-getter `v1.8.9` → `v1.8.10` - github.com/pb33f/ordered-map/v2 `v2.3.1` → `v2.3.2` - github.com/pjbgf/sha1cd `v0.6.0` → `v0.7.0` - github.com/spiffe/go-spiffe/v2 `v2.7.0` → `v2.8.1` - golang.org/x/crypto `v0.57.0` → `v0.58.0` - golang.org/x/net `v0.59.0` → `v0.61.0` **(🟢 remediated [GO-2026-6603](https://go.dev/cl/847185), [GO-2026-6610](https://go.dev/cl/835145), [GO-2026-6611](https://go.dev/cl/847186), [GO-2026-6612](https://go.dev/cl/847187), [GO-2026-6617](https://go.dev/cl/847188))** - golang.org/x/oauth2 `v0.36.0` → `v0.37.0` - golang.org/x/sync `v0.23.0` → `v0.24.0` - golang.org/x/sys `v0.48.0` → `v0.49.0` - golang.org/x/term `v0.46.0` → `v0.47.0` - golang.org/x/text `v0.42.0` → `v0.43.0` - golang.org/x/tools `v0.50.0` → `v0.51.0` - google.golang.org/api `v0.294.0` → `v0.299.0` - google.golang.org/genproto/googleapis/rpc `v0.0.0-da73d73` → `v0.0.0-b142276` - google.golang.org/grpc `v1.83.2` → `v1.84.0` - modernc.org/cc/v4 `v4.29.2` → `v4.29.7` - modernc.org/ccgo/v4 `v4.35.0` → `v4.36.1` - modernc.org/libc `v1.75.7` → `v1.77.1` - modernc.org/sqlite `v1.59.0` → `v1.60.1` </details> <details> <summary>Added (1 package)</summary> - github.com/pb33f/go-yaml `v0.1.0` </details> <details> <summary>Removed (2 packages)</summary> - github.com/klauspost/cpuid/v2 `v2.3.0` - go.yaml.in/yaml/v4 `v4.0.0-rc.2` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.54.1...v1.55.0)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->
CSRBot added 1 commit 2026-10-19 21:15:56 +02:00
chore(deps): update dependency anchore/syft to v1.55.0
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (push) Successful in 1m59s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-amd64) (pull_request) Successful in 2m0s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (push) Successful in 2m59s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (push) Successful in 1m26s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-amd64) (pull_request) Successful in 1m26s
Details
Lint Markdown files / Run markdown linter (pull_request) Successful in 8s
Details
Lint Golang files / Run golang CI linter (stable, ubuntu-latest-arm64) (pull_request) Successful in 2m58s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (push) Successful in 2m48s
Details
Run Golang tests / Run unit tests (stable, ubuntu-latest-arm64) (pull_request) Successful in 2m53s
Details
fbcc9a7918
CSRBot scheduled this pull request to auto merge when all checks succeed 2026-10-19 21:16:00 +02:00
CSRBot merged commit 5fb4d35679 into master 2026-10-19 21:29:46 +02:00
CSRBot deleted branch renovate/anchore-syft-1.x 2026-10-19 21:29:50 +02:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
CSRBot (CSRBot) volker.raschek (Markus Pesch)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#228