chore(deps): update dependency anchore/syft to v1.57.1 #234

Merged

CSRBot merged 1 commits from renovate/anchore-syft-1.x into master 2026-11-09 19:01:52 +01:00

Conversation 0 Commits 1 Files Changed 1

+1 -1

CSRBot commented 2026-11-09 18:16:40 +01:00

Collaborator

Copy link

Copy source

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	1.55.0 → 1.57.1

---

Release Notes

anchore/syft (anchore/syft)

v1.57.1

Compare Source

Dependencies

7 dependency changes (7 updated). 3 vulnerabilities remediated.

🟢 Remediated (3)

• GO-2026-6860 (High) — golang.org/x/net
• GO-2026-6866 (Medium) — golang.org/x/net
• GO-2026-6888 (Critical) — github.com/andybalholm/brotli

Updated (7 packages)

• github.com/andybalholm/brotli v1.2.0 → v1.2.8 (🟢 remediated GO-2026-6888)
• github.com/bmatcuk/doublestar/v4 v4.10.3 → v4.10.4
• github.com/gkampitakis/go-snaps v0.5.24 → v0.5.25
• github.com/gpustack/gguf-parser-go v0.27.0 → v0.28.1
• github.com/moby/sys/mountinfo v0.7.2 → v0.7.3
• go.yaml.in/yaml/v3 v3.0.5 → v3.0.6
• golang.org/x/net v0.61.0 → v0.62.0 (🟢 remediated GO-2026-6860, GO-2026-6866)

(Full Changelog)

v1.57.0

Compare Source

Added Features

• capture GNU ELF build IDs [PR #​5426 @​adityasaky]
• build lower layer squashes only when a scan reads them [PR #​5492 @​wagoodman]

Bug Fixes

• do not generate CPEs for msrc-kb packages [PR #​5510 @​juanjsebgarcia]
• Fix truncated pre-release versions in Go binaries' ldflags [PR #​5422 @​LemonCondor]
• generate NVD-style terraform_provider CPEs for terraform lock packages [PR #​5261 @​timols]
• OpenSSL-only SHA-256 fallback aborts installation [Issue #​5520] [PR #​5521 @​pujitha24]

Dependencies

1 dependency change (1 updated).

Updated (1 package)

• github.com/anchore/stereoscope v0.4.0 → v0.4.1

(Full Changelog)

v1.56.0

Compare Source

Added Features

• tighten source-distribution external refs [PR #​5493 @​wagoodman]
• output source PURL as external reference [PR #​5246 @​swadaptive]
• Full cataloging of archive contents [Issue #​246] [PR #​5260 @​kzantow]

Bug Fixes

• hash each file once in the file digest cataloger [PR #​5491 @​wagoodman]
• Support envoy binary various versions [Issue #​5470] [PR #​5476 @​pujitha24]
• Support istio binary various versions [Issue #​5060] [PR #​5121 @​hsdfat]
• CPE identifiers contain a wildcard in the CPE part field for packages discovered by the Bitnami cataloger [Issue #​5123] [PR #​5127 @​vigneshakaviki]

Additional Changes

• Gradle lockfile comment line is catalogued as a package [Issue #​5371] [PR #​5372 @​pujitha24]
• use correct error variable in package load [PR #​4983 @​idhyt]
• let go-make own the go version [PR #​5464 @​wagoodman]
• preserve semver build metadata in ffmpeg version [PR #​5452 @​akshaver]

Dependencies

40 dependency changes (38 updated, 1 added, 1 removed). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-mgcc-cww5-fp2q (High) — github.com/go-jose/go-jose/v4

Updated (38 packages)

• github.com/Microsoft/go-winio v0.6.3-0.ad3df93 → v0.6.3-0.f19d971
• github.com/ProtonMail/go-crypto v1.4.1 → v1.5.2
• github.com/anchore/clio v0.1.1 → v0.1.2
• github.com/anchore/stereoscope v0.3.4 → v0.4.0
• github.com/bmatcuk/doublestar/v4 v4.10.2 → v4.10.3
• github.com/containerd/containerd/v2 v2.4.1 → v2.4.2
• github.com/containerd/stargz-snapshotter/estargz v0.18.2 → v0.19.0
• github.com/deitch/magic v0.0.0-1ff89d7 → v1.0.0
• github.com/docker/cli v29.8.2+incompatible → v29.9.2+incompatible
• github.com/docker/docker-credential-helpers v0.9.8 → v0.9.10
• github.com/docker/go-connections v0.8.1 → v0.8.2
• github.com/gabriel-vasile/mimetype v1.4.15 → v1.4.16
• github.com/github/go-spdx/v2 v2.7.1 → v2.8.0
• github.com/gkampitakis/go-snaps v0.5.23 → v0.5.24
• github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 (🟢 remediated GHSA-mgcc-cww5-fp2q)
• github.com/go-test/deep v1.1.1 → v1.1.2
• github.com/google/pprof v0.0.0-ef3492d → v0.0.0-1facf8f
• github.com/gookit/color v1.6.2 → v1.6.3
• github.com/gpustack/gguf-parser-go v0.26.4 → v0.27.0
• github.com/klauspost/compress v1.20.1 → v1.20.3
• github.com/klauspost/pgzip v1.2.6 → v1.2.7
• github.com/mattn/go-runewidth v0.0.27 → v0.0.31
• github.com/mattn/go-sqlite3 v1.14.48 → v1.14.52
• github.com/moby/moby/api v1.56.0 → v1.56.1
• github.com/moby/moby/client v0.6.0 → v0.6.2
• github.com/ncruces/go-strftime v1.0.0 → v1.1.0
• github.com/sigstore/fulcio v1.8.7 → v1.8.8
• github.com/vbauerster/cupwriter v0.0.4 → v0.0.5
• github.com/vbauerster/mpb/v8 v8.14.0 → v8.16.2
• go.podman.io/image/v5 v5.41.2 → v5.42.0
• go.podman.io/storage v1.64.1 → v1.65.0
• golang.org/x/mod v0.41.0 → v0.42.0
• golang.org/x/tools v0.51.0 → v0.52.0
• modernc.org/cc/v4 v4.29.7 → v4.30.3
• modernc.org/ccgo/v4 v4.36.1 → v4.37.0
• modernc.org/gc/v3 v3.1.5 → v3.2.0
• modernc.org/libc v1.77.1 → v1.79.0
• modernc.org/sqlite v1.60.1 → v1.61.0

Added (1 package)

• github.com/varlink/go v0.4.1-0.c935be0

Removed (1 package)

• github.com/becheran/wildmatch-go v1.0.0

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

This PR contains the following updates: | Package | Update | Change | |---|---|---| | [anchore/syft](https://github.com/anchore/syft) | minor | `1.55.0` → `1.57.1` | --- ### Release Notes <details> <summary>anchore/syft (anchore/syft)</summary> ### [`v1.57.1`](https://github.com/anchore/syft/releases/tag/v1.57.1) [Compare Source](https://github.com/anchore/syft/compare/v1.57.0...v1.57.1) ##### Dependencies 7 dependency changes (7 updated). 3 vulnerabilities remediated. **🟢 Remediated (3)** - [GO-2026-6860](https://go.dev/cl/849365) (High) — golang.org/x/net - [GO-2026-6866](https://go.dev/cl/855121) (Medium) — golang.org/x/net - [GO-2026-6888](https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv) (Critical) — github.com/andybalholm/brotli <details> <summary>Updated (7 packages)</summary> - github.com/andybalholm/brotli `v1.2.0` → `v1.2.8` **(🟢 remediated [GO-2026-6888](https://github.com/andybalholm/brotli/security/advisories/GHSA-c9gr-gmg4-2vqv))** - github.com/bmatcuk/doublestar/v4 `v4.10.3` → `v4.10.4` - github.com/gkampitakis/go-snaps `v0.5.24` → `v0.5.25` - github.com/gpustack/gguf-parser-go `v0.27.0` → `v0.28.1` - github.com/moby/sys/mountinfo `v0.7.2` → `v0.7.3` - go.yaml.in/yaml/v3 `v3.0.5` → `v3.0.6` - golang.org/x/net `v0.61.0` → `v0.62.0` **(🟢 remediated [GO-2026-6860](https://go.dev/cl/849365), [GO-2026-6866](https://go.dev/cl/855121))** </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.57.0...v1.57.1)** ### [`v1.57.0`](https://github.com/anchore/syft/releases/tag/v1.57.0) [Compare Source](https://github.com/anchore/syft/compare/v1.56.0...v1.57.0) ##### Added Features - capture GNU ELF build IDs \[PR [#&#8203;5426](https://github.com/anchore/syft/pull/5426) [@&#8203;adityasaky](https://github.com/adityasaky)] - build lower layer squashes only when a scan reads them \[PR [#&#8203;5492](https://github.com/anchore/syft/pull/5492) [@&#8203;wagoodman](https://github.com/wagoodman)] ##### Bug Fixes - do not generate CPEs for msrc-kb packages \[PR [#&#8203;5510](https://github.com/anchore/syft/pull/5510) [@&#8203;juanjsebgarcia](https://github.com/juanjsebgarcia)] - Fix truncated pre-release versions in Go binaries' ldflags \[PR [#&#8203;5422](https://github.com/anchore/syft/pull/5422) [@&#8203;LemonCondor](https://github.com/LemonCondor)] - generate NVD-style terraform\_provider CPEs for terraform lock packages \[PR [#&#8203;5261](https://github.com/anchore/syft/pull/5261) [@&#8203;timols](https://github.com/timols)] - OpenSSL-only SHA-256 fallback aborts installation \[Issue [#&#8203;5520](https://github.com/anchore/syft/issues/5520)] \[PR [#&#8203;5521](https://github.com/anchore/syft/pull/5521) [@&#8203;pujitha24](https://github.com/pujitha24)] ##### Dependencies 1 dependency change (1 updated). <details> <summary>Updated (1 package)</summary> - github.com/anchore/stereoscope `v0.4.0` → `v0.4.1` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.56.0...v1.57.0)** ### [`v1.56.0`](https://github.com/anchore/syft/releases/tag/v1.56.0) [Compare Source](https://github.com/anchore/syft/compare/v1.55.0...v1.56.0) ##### Added Features - tighten source-distribution external refs \[PR [#&#8203;5493](https://github.com/anchore/syft/pull/5493) [@&#8203;wagoodman](https://github.com/wagoodman)] - output source PURL as external reference \[PR [#&#8203;5246](https://github.com/anchore/syft/pull/5246) [@&#8203;swadaptive](https://github.com/swadaptive)] - Full cataloging of archive contents \[Issue [#&#8203;246](https://github.com/anchore/syft/issues/246)] \[PR [#&#8203;5260](https://github.com/anchore/syft/pull/5260) [@&#8203;kzantow](https://github.com/kzantow)] ##### Bug Fixes - hash each file once in the file digest cataloger \[PR [#&#8203;5491](https://github.com/anchore/syft/pull/5491) [@&#8203;wagoodman](https://github.com/wagoodman)] - Support envoy binary various versions \[Issue [#&#8203;5470](https://github.com/anchore/syft/issues/5470)] \[PR [#&#8203;5476](https://github.com/anchore/syft/pull/5476) [@&#8203;pujitha24](https://github.com/pujitha24)] - Support istio binary various versions \[Issue [#&#8203;5060](https://github.com/anchore/syft/issues/5060)] \[PR [#&#8203;5121](https://github.com/anchore/syft/pull/5121) [@&#8203;hsdfat](https://github.com/hsdfat)] - CPE identifiers contain a wildcard in the CPE part field for packages discovered by the Bitnami cataloger \[Issue [#&#8203;5123](https://github.com/anchore/syft/issues/5123)] \[PR [#&#8203;5127](https://github.com/anchore/syft/pull/5127) [@&#8203;vigneshakaviki](https://github.com/vigneshakaviki)] ##### Additional Changes - Gradle lockfile comment line is catalogued as a package \[Issue [#&#8203;5371](https://github.com/anchore/syft/issues/5371)] \[PR [#&#8203;5372](https://github.com/anchore/syft/pull/5372) [@&#8203;pujitha24](https://github.com/pujitha24)] - use correct error variable in package load \[PR [#&#8203;4983](https://github.com/anchore/syft/pull/4983) [@&#8203;idhyt](https://github.com/idhyt)] - let go-make own the go version \[PR [#&#8203;5464](https://github.com/anchore/syft/pull/5464) [@&#8203;wagoodman](https://github.com/wagoodman)] - preserve semver build metadata in ffmpeg version \[PR [#&#8203;5452](https://github.com/anchore/syft/pull/5452) [@&#8203;akshaver](https://github.com/akshaver)] ##### Dependencies 40 dependency changes (38 updated, 1 added, 1 removed). 1 vulnerability remediated. **🟢 Remediated (1)** - [GHSA-mgcc-cww5-fp2q](https://github.com/advisories/GHSA-mgcc-cww5-fp2q) (High) — github.com/go-jose/go-jose/v4 <details> <summary>Updated (38 packages)</summary> - github.com/Microsoft/go-winio `v0.6.3-0.ad3df93` → `v0.6.3-0.f19d971` - github.com/ProtonMail/go-crypto `v1.4.1` → `v1.5.2` - github.com/anchore/clio `v0.1.1` → `v0.1.2` - github.com/anchore/stereoscope `v0.3.4` → `v0.4.0` - github.com/bmatcuk/doublestar/v4 `v4.10.2` → `v4.10.3` - github.com/containerd/containerd/v2 `v2.4.1` → `v2.4.2` - github.com/containerd/stargz-snapshotter/estargz `v0.18.2` → `v0.19.0` - github.com/deitch/magic `v0.0.0-1ff89d7` → `v1.0.0` - github.com/docker/cli `v29.8.2+incompatible` → `v29.9.2+incompatible` - github.com/docker/docker-credential-helpers `v0.9.8` → `v0.9.10` - github.com/docker/go-connections `v0.8.1` → `v0.8.2` - github.com/gabriel-vasile/mimetype `v1.4.15` → `v1.4.16` - github.com/github/go-spdx/v2 `v2.7.1` → `v2.8.0` - github.com/gkampitakis/go-snaps `v0.5.23` → `v0.5.24` - github.com/go-jose/go-jose/v4 `v4.1.5` → `v4.1.6` **(🟢 remediated [GHSA-mgcc-cww5-fp2q](https://github.com/advisories/GHSA-mgcc-cww5-fp2q))** - github.com/go-test/deep `v1.1.1` → `v1.1.2` - github.com/google/pprof `v0.0.0-ef3492d` → `v0.0.0-1facf8f` - github.com/gookit/color `v1.6.2` → `v1.6.3` - github.com/gpustack/gguf-parser-go `v0.26.4` → `v0.27.0` - github.com/klauspost/compress `v1.20.1` → `v1.20.3` - github.com/klauspost/pgzip `v1.2.6` → `v1.2.7` - github.com/mattn/go-runewidth `v0.0.27` → `v0.0.31` - github.com/mattn/go-sqlite3 `v1.14.48` → `v1.14.52` - github.com/moby/moby/api `v1.56.0` → `v1.56.1` - github.com/moby/moby/client `v0.6.0` → `v0.6.2` - github.com/ncruces/go-strftime `v1.0.0` → `v1.1.0` - github.com/sigstore/fulcio `v1.8.7` → `v1.8.8` - github.com/vbauerster/cupwriter `v0.0.4` → `v0.0.5` - github.com/vbauerster/mpb/v8 `v8.14.0` → `v8.16.2` - go.podman.io/image/v5 `v5.41.2` → `v5.42.0` - go.podman.io/storage `v1.64.1` → `v1.65.0` - golang.org/x/mod `v0.41.0` → `v0.42.0` - golang.org/x/tools `v0.51.0` → `v0.52.0` - modernc.org/cc/v4 `v4.29.7` → `v4.30.3` - modernc.org/ccgo/v4 `v4.36.1` → `v4.37.0` - modernc.org/gc/v3 `v3.1.5` → `v3.2.0` - modernc.org/libc `v1.77.1` → `v1.79.0` - modernc.org/sqlite `v1.60.1` → `v1.61.0` </details> <details> <summary>Added (1 package)</summary> - github.com/varlink/go `v0.4.1-0.c935be0` </details> <details> <summary>Removed (1 package)</summary> - github.com/becheran/wildmatch-go `v1.0.0` </details> **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.55.0...v1.56.0)** </details> --- ### Configuration 📅 **Schedule**: (UTC) - Branch creation - At any time (no schedule defined) - Automerge - At any time (no schedule defined) 🚦 **Automerge**: Enabled. ♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this PR and you won't be reminded about this update again. --- - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box --- This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate). <!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4xMTYuMSIsInVwZGF0ZWRJblZlciI6IjQ0LjExNi4xIiwidGFyZ2V0QnJhbmNoIjoibWFzdGVyIiwibGFiZWxzIjpbInJlbm92YXRlL2F1dG9tZXJnZSIsInJlbm92YXRlL2dpdGh1Yi1hY3Rpb24iXX0=-->

CSRBot added 1 commit 2026-11-09 18:16:40 +01:00

chore(deps): update dependency anchore/syft to v1.57.1 af36a22ce9

CSRBot scheduled this pull request to auto merge when all checks succeed 2026-11-09 18:16:42 +01:00

CSRBot merged commit eb7829cb9c into master 2026-11-09 19:01:52 +01:00

CSRBot deleted branch renovate/anchore-syft-1.x 2026-11-09 19:01:52 +01:00

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

No items

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

CSRBot (CSRBot) volker.raschek (Markus Pesch)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: volker.raschek/dcmerge#234