chore: update dependencies by renovate[bot] · Pull Request #567 · siderolabs/extensions

renovate · 2024-12-25T18:54:47Z

ℹ️ Note

This PR body was truncated due to platform limits.

Update Request | Renovate Bot

This PR contains the following updates:

Package	Type	Update	Change
awslabs/soci-snapshotter		minor	`v0.14.1` → `v0.15.0`
cgr.dev/chainguard/wolfi-base		digest	`02dab76` → `003627d`
cloudflare/cloudflared		patch	`2026.7.2` → `2026.7.3`
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git		patch	`6.18.39` → `6.18.42`
github.com/anchore/grype	indirect	minor	`v0.111.0` → `v0.116.1`
github.com/anchore/syft	indirect	minor	`v1.42.4` → `v1.50.0`
github.com/dsseng/syft	replace	patch	`v1.42.4-0.20260415171054-31b9430f030f` → `v1.42.4`
google/gvisor		patch	`20260714.0` → `20260727.0`
https://github.com/qemu/qemu.git		patch	`11.0.2` → `11.0.3`
https://gitlab.gnome.org/GNOME/glib.git		patch	`2.89.2` → `2.89.3`
https://sourceware.org/git/glibc.git		minor	`2.43` → `2.44`
kata-containers/kata-containers		major	`3.32.0` → `4.0.0`
netbirdio/netbird		minor	`0.74.7` → `0.76.1`
siderolabs/talos-vmtoolsd		patch	`v1.5.0` → `v1.5.1`
slackhq/nebula		minor	`1.10.3` → `1.11.0`
sqlite/sqlite		patch	`3.53.3` → `3.53.4`
systemd/systemd		minor	`261.1` → `261.2`
tailscale/tailscale		minor	`1.98.9` → `1.102.2`
youki-dev/youki		minor	`0.6.0` → `0.7.0`

Release Notes

awslabs/soci-snapshotter (awslabs/soci-snapshotter)

`v0.15.0`

Compare Source

Changelog

Eliminate serial per-layer registry round-trips during lazy pull (#2029)
Add "db-multi" per-layer metadata store to avoid shared bbolt writer lock (#2030)
Add opt-in registry auth client sharing to reduce token exchanges (#2042)
Add metadata_db_no_sync and metadata_insertion_chunk_size config options (#2039)
Add pull/mount critical-path observability metrics (#2028)
Fix spancache file descriptor leak in file Verify (#2043)
Fix background fetcher queue blocking layer mounts during silence period (#2038)
Honor resolver insecure flag for SOCI index and blob fetch paths (#2040)
Fix Referer header on redirect-cached requests (#2001)
Fix SynchronousReadRegistryFetchCount metric firing on cache hits (#2015)
Record InitMetadataStoreLatency metric after initialization completes rather than before (#2026)
Don't preserve tar ownership in standalone extraction (#2033)
Remove CRI v1alpha2 support (#1990)

Full Changelog: awslabs/soci-snapshotter@v0.14.1...v0.15.0

These binaries were compiled using glibc 2.34.

cloudflare/cloudflared (cloudflare/cloudflared)

`v2026.7.3`

Compare Source

SHA256 Checksums:

cloudflared-amd64.pkg: 6ea8e24e33fe530d3bea623ae1625ae22cc13a3937ffebc325556f785d492f2b
cloudflared-arm64.pkg: bc33145624dd2a81bf9ff23bce66d720cab06d9f818f6af748245063dafe1b72
cloudflared-darwin-amd64.tgz: e88fe5874d42a94f49a7ea59cabc3722d2962d0449232b0f3b1a426a712e275c
cloudflared-darwin-arm64.tgz: f35c50089cd25f77a4cb5a2152036bc26db15aa31fbe11f7995d2e42a4ed6257
cloudflared-fips-linux-amd64: dac96ecb6d017f1a9d128d29dd7b4cbc75124ec3dac0f1492a9552a31dd7702f
cloudflared-fips-linux-amd64.deb: 83ff18e7f8e24e5d360ecf5910ea14e07583cf533c0c728697289688b8da3ee1
cloudflared-fips-linux-x86_64.rpm: fc99457f0af90247d8ca7d5697ffbd5deb9600b1c27c35bc87e93f41fa5da152
cloudflared-linux-386: 6c982e77e644644f5bce76781dd2b69ddc0bfa5e1dd1f55f0037850ac0946771
cloudflared-linux-386.deb: 8696320238a9c04102491d032297f99cadb4554f039947d7b58c03524260021e
cloudflared-linux-386.rpm: 7adf5ff15897dc584fda148e254c60553a7bbdaecce4b18bebc03fb772f9e0be
cloudflared-linux-aarch64.rpm: 133677939d14ba6f9d90ea1bb4c78dfdf1ffacb4c12c60b22a3deb38f8fd9c2a
cloudflared-linux-amd64: 9d71c677db00134c1bd4144b7783486b654ad281b1ea62b4972098d19f770f17
cloudflared-linux-amd64.deb: 049777d30f9bf93da6df8bbe31383460eb2aa51a832c6551824d56f9fcc55974
cloudflared-linux-arm: 6dadd979b8833760e9f6d840a6239a8c08c8bcf73b4231ec537f483873f37c73
cloudflared-linux-arm.deb: a12ca7a373cd8f2be0e5a2b3ea9461cbb306402b8b96bddeb862a384aa63cdfc
cloudflared-linux-arm.rpm: a0ecd03050646aa2652201c478ec07ba8c96e1860b9c44caa0028a391df25e3d
cloudflared-linux-arm64: 65259e652a7bea08bf5df603233ab22b8bf3116af8df9f9206209af6a1b955c0
cloudflared-linux-arm64.deb: d3ea7d22dd337b465da33d6bc1c4b3cfd381407447a2a7d29542c19783430db3
cloudflared-linux-armhf: 2aadbe6416e5c52cb7ebba99119f413a124f358516c17d4ecaacb89a363e8a35
cloudflared-linux-armhf.deb: 3e6f1733d5188a34c787f00dc4c08be94ed6de7790fb8600757bdc68af48aca1
cloudflared-linux-armhf.rpm: cde7c9f2a8c19de3d61d617464119105dc5493bac846d4961e83e84fb7b8a610
cloudflared-linux-x86_64.rpm: 4d4d65759af8079d0c87ed0f03716218479b56c101078ff5ec7e3d99078bcb41
cloudflared-windows-386.exe: d026e39d9be21c70ea652528fda2801e164d5e25688b7b0fb3b65080cbd96503
cloudflared-windows-386.msi: 95147b1471c383e236d2c28f9cd4f3ce2ab276b74ab3da0d22a714df9722b477
cloudflared-windows-amd64.exe: 8635da433b6df8194746e88ed9d2589566c20e38bfc2a80e431a348b7c765841
cloudflared-windows-amd64.msi: 77e432aa86b152335fd1c8e8d37b9cc7fec9859f27fa5885abbc6ec3345c6830

anchore/grype (github.com/anchore/grype)

`v0.116.1`

Compare Source

Bug Fixes

Ensure channel parsing is consistent [PR #3603 @wagoodman]
Scope Go GHSA twins by shared CVE [PR #3592 @wagoodman]
do not cache a comparator that failed to build [PR #3567 @arpitjain099]
Add fix date to rhel minor records created from rhsa [PR #3585 @wagoodman]
grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #3591]
panic: index out of range in distro.parseVersion for VERSION_ID=v [Issue #3588] [PR #3589 @matiasinsaurralde]
False Positive: GO-2026-5932 [Issue #3573]

Dependencies

30 dependency changes (30 updated). 1 vulnerability remediated.

🟢 Remediated (1)

GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (30 packages)

github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
github.com/anchore/stereoscope v0.2.2 → v0.3.0
github.com/anchore/syft v1.48.0 → v1.50.0
github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
github.com/moby/moby/api v1.54.2 → v1.55.0
github.com/moby/moby/client v0.4.1 → v0.5.0
github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
golang.org/x/crypto v0.53.0 → v0.54.0
golang.org/x/mod v0.37.0 → v0.38.0
golang.org/x/net v0.56.0 → v0.57.0
golang.org/x/sync v0.21.0 → v0.22.0
golang.org/x/sys v0.46.0 → v0.47.0
golang.org/x/term v0.44.0 → v0.45.0
golang.org/x/text v0.39.0 → v0.40.0
golang.org/x/tools v0.47.0 → v0.48.0
google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
modernc.org/cc/v4 v4.28.4 → v4.29.0
modernc.org/ccgo/v4 v4.34.4 → v4.34.6
modernc.org/gc/v3 v3.1.3 → v3.1.4
modernc.org/libc v1.73.4 → v1.74.1
modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)

`v0.116.0`

Compare Source

Added Features

duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode]
add chainguard osv transformer [PR #3474 @crosleyzack]
populate package architecture for matching [PR #3504 @willmurphyscode]
lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs]
Deduplicate Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA) [Issue #3511] [PR #3509 @spiffcs]
Support Ubuntu ESM [Issue #3544] [PR #3546 @wagoodman]

Bug Fixes

regenerate v6.1.8 blob and sql schemas [PR #3574 @spiffcs]
rhel version streams [PR #3572 @kzantow]
Grype doesn't match u-boot in SBOM if type is set to firmware [Issue #2537]
Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go [Issue #1782]
Zarf scans emit warnings for consistently unreadable files (i.e., included non-SBOMs) [Issue #3516] [PR #3545 @brandtkeller]
Fail parsing github actions [Issue #3220]
Go vulnerability returned when installed version is greater than fixed version [Issue #3520]

Dependencies

14 dependency changes (11 updated, 3 added).

Updated (11 packages)

github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
github.com/anchore/syft v1.46.0 → v1.48.0
github.com/klauspost/compress v1.18.6 → v1.19.0
golang.org/x/text v0.38.0 → v0.39.0
golang.org/x/tools v0.46.0 → v0.47.0
gorm.io/gorm v1.31.1 → v1.31.2
modernc.org/cc/v4 v4.28.2 → v4.28.4
modernc.org/ccgo/v4 v4.34.0 → v4.34.4
modernc.org/gc/v3 v3.1.2 → v3.1.3
modernc.org/libc v1.72.3 → v1.73.4
modernc.org/sqlite v1.51.0 → v1.53.0

Added (3 packages)

github.com/mattn/go-sqlite3 v1.14.23
gorm.io/driver/sqlite v1.6.0
howett.net/plist v1.0.1

(Full Changelog)

`v0.115.0`

Compare Source

Added Features

emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode]
Merge Go vuln matches with GHSA matches [Issue #3515]

Bug Fixes

only emit records for stdlib [PR #3527 @willmurphyscode]
mark hummingbird distro as rolling [PR #3521 @willmurphyscode]
disable go stdlib CPE matching by default [PR #3517 @willmurphyscode]
merge in custom ranges when applicable [PR #3514 @willmurphyscode]
exclude linux-kbuild deb indirect matches by default [PR #3506 @westonsteimel]
avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
Support reading CycloneDX 1.7 SBOMs [Issue #3373]
Grype cannot read mariadb version correctly [Issue #3452]
grype hangs when downloading certain images using registry client [Issue #3492]
Can we get a fix for these Critical findings reported for grype [Issue #3484]

Additional Changes

Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #3493]
Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #3494]

Dependencies

35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
github.com/anchore/bubbly v0.2.0 → v0.2.1
github.com/anchore/clio v0.1.0 → v0.1.1
github.com/anchore/fangs v0.1.0 → v0.1.1
github.com/anchore/go-collections v0.1.0 → v0.1.1
github.com/anchore/go-homedir v0.1.0 → v0.1.1
github.com/anchore/go-logger v0.1.0 → v0.1.1
github.com/anchore/go-lzo v0.1.0 → v0.1.1
github.com/anchore/go-macholibre v0.1.0 → v0.1.1
github.com/anchore/go-make v0.5.0 → v0.8.0
github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
github.com/anchore/go-sync v0.1.0 → v0.1.1
github.com/anchore/stereoscope v0.2.1 → v0.2.2
github.com/anchore/syft v1.45.1 → v1.46.0
github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
github.com/google/go-containerregistry v0.21.6 → v0.21.7
github.com/mattn/go-runewidth v0.0.19 → v0.0.21
github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
golang.org/x/crypto v0.52.0 → v0.53.0
golang.org/x/mod v0.36.0 → v0.37.0
golang.org/x/net v0.55.0 → v0.56.0
golang.org/x/sync v0.20.0 → v0.21.0
golang.org/x/sys v0.45.0 → v0.46.0
golang.org/x/term v0.43.0 → v0.44.0
golang.org/x/text v0.37.0 → v0.38.0
golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

github.com/piprate/json-gold v0.7.0
github.com/pquerna/cachecontrol v0.0.0-1555304
github.com/tailscale/hujson v0.0.0-ecc657c

Removed (1 package)

github.com/google/osv-scanner v1.9.2

(Full Changelog)

`v0.114.0`

Compare Source

Added Features

Add ability to scan zarf packages [#3329 #3366 @brandtkeller]

Additional Changes

respect withdrawn status of Go Vuln DB OSV records [#3495 @willmurphyscode]
Govulndb OSV transformer [#3485 @willmurphyscode]

(Full Changelog)

`v0.113.0`

Compare Source

Added Features

Include Ubuntu 26.04 "resolute" in distro codenames [#3397 @anchore-oss-update-bot]
source RPM filtering on Hummingbird [#3410 @willmurphyscode]

Bug Fixes

use relatedVulnerabilities description as fallback in SARIF output [#3271 @axidex]
improve platform CPE determination logic [#3470 @westonsteimel]
normalize uppercase V in semantic version comparison [#3461 @immanuwell]
purl handling in cgr maven libs [#3420 @willmurphyscode]
Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#3037 #3089 @wasup-yash]
Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#3101 #3396 @Dashtid]
Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#3442 #3475 @msnandhis]
zsh completion fails [#2933 #3433 @brandtkeller]

(Full Changelog)

`v0.112.0`

Compare Source

Added Features

Expand ignore rules to owned sub packages of distro packages [#3368 #3326 @kzantow]

Additional Changes

update anchore dependencies [#3391 @anchore-oss-update-bot]

(Full Changelog)

`v0.111.1`

Compare Source

Bug Fixes

apply overlap by ownership removal to dynamically created relationships [#3363 @kzantow]
compare mismatched package / db versions [#3372 @kzantow]
Grype doesn't recognize debian component when "group" : "debian" is specified [#2967]
HelpURI missing information in SARIF output [#2874 #3351 @will-bates11]

(Full Changelog)

anchore/syft (github.com/anchore/syft)

`v1.50.0`

Compare Source

Added Features

Add bun binary classifier [PR #5103 @rezmoss]

Bug Fixes

Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz]
Decode golang symbols [PR #5089 @wagoodman]
CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees]
apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094] [PR #5100 @cyphercodes]

Additional Changes

package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #5101] [PR #5108 @Eljees]
consider vendored golang packages in module attribution [PR #5093 @kzantow]
Fix inverted bounds check dropping every Erlang string with a backslash [PR #5110 @arpitjain099]

Dependencies

14 dependency changes (14 updated). 1 vulnerability remediated.

🟢 Remediated (1)

GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (14 packages)

github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
modernc.org/cc/v4 v4.28.4 → v4.29.0
modernc.org/ccgo/v4 v4.34.4 → v4.34.6
modernc.org/gc/v3 v3.1.3 → v3.1.4
modernc.org/libc v1.73.4 → v1.74.1
modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)

`v1.49.0`

Compare Source

Added Features

Support for application/vnd.oci.image.index.v1+json manifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos]

Bug Fixes

Misinterpretation of Multiple replace Directives in Golang [Issue #2721] [PR #5069 @ychampion]

Dependencies

16 dependency changes (16 updated).

Updated (16 packages)

github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
github.com/anchore/stereoscope v0.2.2 → v0.3.0
github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
github.com/moby/moby/api v1.54.2 → v1.55.0
github.com/moby/moby/client v0.4.1 → v0.5.0
github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
golang.org/x/crypto v0.53.0 → v0.54.0
golang.org/x/mod v0.37.0 → v0.38.0
golang.org/x/net v0.56.0 → v0.57.0
golang.org/x/sync v0.21.0 → v0.22.0
golang.org/x/sys v0.46.0 → v0.47.0
golang.org/x/term v0.44.0 → v0.45.0
golang.org/x/text v0.38.0 → v0.40.0
golang.org/x/tools v0.47.0 → v0.48.0

(Full Changelog)

`v1.48.0`

Compare Source

Added Features

emit dependency relationships from mix.lock [PR #4985 @cgreeno]
add safe tensor model type to SBOM output [PR #4844 @spiffcs]
Capture golang binary symbols [PR #4988 @spiffcs]
Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman]
Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404]
Support for vcpkg [Issue #2110] [PR #4081 @gabetrau]
Add macOS .app cataloger [Issue #4010] [PR #4490 @rezmoss]
Add support for Kerberos 5 library cataloging [Issue #4780] [PR #4781 @nadimz]
Include date of scan in results [Issue #3910]

Bug Fixes

use printf instead of echo to fix ANSI color output [PR #4978 @Jouini-Mohamed-Chaker]
Strip peer-dep suffix from deno.lock npm keys [PR #5055 @Synvoya]
Allow more PEP440-compliant characters in python versions [PR #4964 @kzantow]
PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #4996 @activeobd]
Fix panic parsing a rockspec comment that ends at EOF [PR #5053 @arpitjain099]
Fix Debian point release detection [PR #4997 @OsamaSE]
Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #5041 @Synvoya]
npm redis client generates no CPE [Issue #5011] [PR #5012 @rezmoss]
Debug Docker images are running as nonroot user [Issue #4113] [PR #4608 @spiffcs]
libxml2 gets the wrong cpe vendor [Issue #5015] [PR #5016 @rezmoss]
wrong purl for spring-ldap-core dependency [Issue #4030] [PR #4908 @jonasboos]
Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #3961] [PR #4785 @SAY-5]
conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #5017] [PR #5020 @jfjrh2014]
dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #4514] [PR #4517 @rezmoss]
Go template sprig date functions not defined [Issue #2372] [PR #4644 @sputnik-mac]
CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #4720] [PR #4782 @SAY-5]

Dependencies

9 dependency changes (8 updated, 1 added).

Updated (8 packages)

github.com/bmatcuk/doublestar v1.3.1 → v8.8.8
github.com/klauspost/compress v1.18.6 → v1.19.0
golang.org/x/tools v0.46.0 → v0.47.0
modernc.org/cc/v4 v4.28.2 → v4.28.4
modernc.org/ccgo/v4 v4.34.0 → v4.34.4
modernc.org/gc/v3 v3.1.2 → v3.1.3
modernc.org/libc v1.72.3 → v1.73.4
modernc.org/sqlite v1.51.0 → v1.53.0

Added (1 package)

howett.net/plist v1.0.1

(Full Changelog)

`v1.47.0`

Compare Source

`v1.46.0`

Compare Source

Added Features

Add purl types to cataloger info cmd [PR #4984 @wagoodman]
Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu]
Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss]
SPDX 3 Support [Issue #4250] [PR #4269 @kzantow]
Add Deno support [Issue #4417] [PR #4523 @rezmoss]
Catalog Elastic Beats binary [Issue #4961] [PR #4969 @rezmoss]
Add binary classifiers for Elastic Beats [Issue #4972] [PR #4969 @rezmoss]
Catalog elastic-agent binary [Issue #4962]
Add support for Bun lockfile (bun.lock) [Issue #4617] [PR #4625 @hnnynh]
Add .bpl file support to the PE / DLL cataloger [Issue #4664] [PR #4954 @jfjrh2014]

Bug Fixes

respect arch qualifier [PR #4987 @willmurphyscode]
Preserve dependency edges when a compliance stub changes a package ID [PR #4993 @wagoodman]
Support envoy binary various versions [Issue #4590] [PR #4605 @rezmoss]
.net deps.json cataloger shows phantom pkgs for reference assembly library entries [Issue #4970] [PR #4971 @rezmoss]
Syft does not extract package licenses from opkg manager [Issue #4940] [PR #4963 @Dashtid]
squashfs breaks with godisk-fs 1.8.0 [Issue #4718]
requirements.txt cataloger silently drops PEP 440 local version identifiers, producing incorrect PURL [Issue #4958] [PR #4959 @kzantow]

Dependencies

34 dependency changes (31 updated, 3 added). 5 vulnerabilities remediated.

🟢 Remediated (5)

GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
github.com/anchore/bubbly v0.2.0 → v0.2.1
github.com/anchore/clio v0.1.0 → v0.1.1
github.com/anchore/fangs v0.1.0 → v0.1.1
github.com/anchore/go-collections v0.1.0 → v0.1.1
github.com/anchore/go-homedir v0.1.0 → v0.1.1
github.com/anchore/go-logger v0.1.0 → v0.1.1
github.com/anchore/go-lzo v0.1.0 → v0.1.1
github.com/anchore/go-macholibre v0.1.0 → v0.1.1
github.com/anchore/go-make v0.5.0 → v0.8.0
github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
github.com/anchore/go-sync v0.1.0 → v0.1.1
github.com/anchore/stereoscope v0.2.1 → v0.2.2
github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
github.com/google/go-containerregistry v0.21.6 → v0.21.7
github.com/jedib0t/go-pretty/v6 v6.7.10 → v6.8.1
github.com/mattn/go-runewidth v0.0.19 → v0.0.21
github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
golang.org/x/crypto v0.52.0 → v0.53.0
golang.org/x/mod v0.36.0 → v0.37.0
golang.org/x/net v0.55.0 → v0.56.0
golang.org/x/sync v0.20.0 → v0.21.0
golang.org/x/sys v0.45.0 → v0.46.0
golang.org/x/term v0.43.0 → v0.44.0
golang.org/x/text v0.37.0 → v0.38.0
golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

github.com/piprate/json-gold v0.7.0
github.com/pquerna/cachecontrol v0.0.0-1555304
github.com/tailscale/hujson v0.0.0-ecc657c

(Full Changelog)

`v1.45.1`

Compare Source

Bug Fixes

bump stereoscope to pull in fix for registry client hanging [#4934 @anchore-oss-update-bot]

(Full Changelog)

`v1.45.0`

Compare Source

Added Features

Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke]
MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
Catalog ingress-nginx binary [#4818 #4857 @witchcraze]

Bug Fixes

Support helm binary various versions [#4820 #4922 @witchcraze]
Support julia binary various versions [#4867 #4945 @witchcraze]
Support deno binary old versions [#4865 #4939 @witchcraze]
Compressed kernel modules are not scanned by the linux-kernel-cataloger [#4721 #4740 @will-bates11]
Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#4691 #4838 @calumleslie]
Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882 @witchcraze]
Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
Exclude path ending with a slash are discarded [#4839 #4892 @ChrisJr404]
Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
fix parsing of debian/copyright files [[#4708](https://redirect.github.com

✂ Note

PR body was truncated to here.

renovate · 2026-04-24T14:06:10Z

ℹ️ Artifact update notice

File name: internal/grype-scan/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

103 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.26.0` -> `1.26.3`
`cloud.google.com/go/auth`	`v0.18.1` -> `v0.18.2`
`cloud.google.com/go/storage`	`v1.60.0` -> `v1.61.3`
`github.com/CycloneDX/cyclonedx-go`	`v0.10.0` -> `v0.11.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.30.0` -> `v1.32.0`
`github.com/Masterminds/semver/v3`	`v3.4.0` -> `v3.5.0`
`github.com/Microsoft/go-winio`	`v0.6.2` -> `v0.6.3-0.20251027160822-ad3df93bed29`
`github.com/Microsoft/hcsshim`	`v0.14.0-rc.1` -> `v0.15.0-rc.1`
`github.com/ProtonMail/go-crypto`	`v1.4.0` -> `v1.4.1`
`github.com/anchore/bubbly`	`v0.2.0` -> `v0.2.1`
`github.com/anchore/clio`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/fangs`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-collections`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-homedir`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-logger`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-lzo`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-macholibre`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-rpmdb`	`v0.1.0` -> `v0.2.0`
`github.com/anchore/go-struct-converter`	`v0.1.0` -> `v0.2.0-rc2`
`github.com/anchore/go-sync`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/stereoscope`	`v0.1.22` -> `v0.3.0`
`github.com/aws/aws-sdk-go-v2`	`v1.41.2` -> `v1.41.5`
`github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream`	`v1.7.4` -> `v1.7.8`
`github.com/aws/aws-sdk-go-v2/config`	`v1.32.10` -> `v1.32.12`
`github.com/aws/aws-sdk-go-v2/credentials`	`v1.19.10` -> `v1.19.12`
`github.com/aws/aws-sdk-go-v2/feature/ec2/imds`	`v1.18.18` -> `v1.18.20`
`github.com/aws/aws-sdk-go-v2/internal/configsources`	`v1.4.18` -> `v1.4.21`
`github.com/aws/aws-sdk-go-v2/internal/endpoints/v2`	`v2.7.18` -> `v2.7.21`
`github.com/aws/aws-sdk-go-v2/internal/ini`	`v1.8.4` -> `v1.8.6`
`github.com/aws/aws-sdk-go-v2/internal/v4a`	`v1.4.17` -> `v1.4.22`
`github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding`	`v1.13.5` -> `v1.13.7`
`github.com/aws/aws-sdk-go-v2/service/internal/checksum`	`v1.9.8` -> `v1.9.13`
`github.com/aws/aws-sdk-go-v2/service/internal/presigned-url`	`v1.13.18` -> `v1.13.21`
`github.com/aws/aws-sdk-go-v2/service/internal/s3shared`	`v1.19.17` -> `v1.19.21`
`github.com/aws/aws-sdk-go-v2/service/s3`	`v1.96.0` -> `v1.97.3`
`github.com/aws/aws-sdk-go-v2/service/signin`	`v1.0.6` -> `v1.0.8`
`github.com/aws/aws-sdk-go-v2/service/sso`	`v1.30.11` -> `v1.30.13`
`github.com/aws/aws-sdk-go-v2/service/ssooidc`	`v1.35.15` -> `v1.35.17`
`github.com/aws/aws-sdk-go-v2/service/sts`	`v1.41.7` -> `v1.41.9`
`github.com/aws/smithy-go`	`v1.24.1` -> `v1.24.2`
`github.com/charmbracelet/colorprofile`	`v0.4.1` -> `v0.4.3`
`github.com/clipperhouse/displaywidth`	`v0.10.0` -> `v0.11.0`
`github.com/clipperhouse/uax29/v2`	`v2.6.0` -> `v2.7.0`
`github.com/cncf/xds/go`	`v0.0.0-20251210132809-ee656c7534f5` -> `v0.0.0-20260202195803-dba9d589def2`
`github.com/containerd/cgroups/v3`	`v3.1.2` -> `v3.1.3`
`github.com/containerd/containerd/api`	`v1.10.0` -> `v1.11.1`
`github.com/containerd/containerd/v2`	`v2.2.1` -> `v2.3.3`
`github.com/containerd/continuity`	`v0.4.5` -> `v0.5.0`
`github.com/containerd/platforms`	`v1.0.0-rc.2` -> `v1.0.0-rc.4`
`github.com/containerd/plugin`	`v1.0.0` -> `v1.1.0`
`github.com/containerd/ttrpc`	`v1.2.7` -> `v1.2.8`
`github.com/cyphar/filepath-securejoin`	`v0.6.0` -> `v0.6.1`
`github.com/diskfs/go-diskfs`	`v1.7.0` -> `v1.9.3`
`github.com/docker/cli`	`v29.3.0+incompatible` -> `v29.6.1+incompatible`
`github.com/docker/go-connections`	`v0.6.0` -> `v0.7.0`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.36.0` -> `v1.37.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.3.0` -> `v1.3.3`
`github.com/github/go-spdx/v2`	`v2.4.0` -> `v2.7.0`
`github.com/go-git/go-billy/v5`	`v5.8.0` -> `v5.9.0`
`github.com/go-git/go-git/v5`	`v5.17.0` -> `v5.19.1`
`github.com/go-jose/go-jose/v4`	`v4.1.3` -> `v4.1.4`
`github.com/google/go-containerregistry`	`v0.21.3` -> `v0.21.7`
`github.com/googleapis/enterprise-certificate-proxy`	`v0.3.11` -> `v0.3.14`
`github.com/gookit/color`	`v1.6.0` -> `v1.6.1`
`github.com/gpustack/gguf-parser-go`	`v0.24.0` -> `v0.25.0`
`github.com/hashicorp/aws-sdk-go-base/v2`	`v2.0.0-beta.70` -> `v2.0.0-beta.72`
`github.com/hashicorp/go-getter`	`v1.8.5` -> `v1.8.6`
`github.com/klauspost/compress`	`v1.18.5` -> `v1.19.0`
`github.com/mattn/go-runewidth`	`v0.0.19` -> `v0.0.21`
`github.com/moby/moby/api`	`v1.54.0` -> `v1.55.0`
`github.com/moby/moby/client`	`v0.3.0` -> `v0.5.0`
`github.com/openvex/go-vex`	`v0.2.7` -> `v0.2.8`
`github.com/package-url/packageurl-go`	`v0.1.3` -> `v0.1.5`
`github.com/pelletier/go-toml/v2`	`v2.2.4` -> `v2.4.3`
`github.com/pierrec/lz4/v4`	`v4.1.22` -> `v4.1.26`
`github.com/pjbgf/sha1cd`	`v0.4.0` -> `v0.6.0`
`github.com/spdx/tools-golang`	`v0.5.7` -> `v0.6.0-rc4`
`github.com/sylabs/sif/v2`	`v2.24.0` -> `v2.24.1`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.39.0` -> `v1.43.0`
`go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc`	`v0.63.0` -> `v0.68.0`
`go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp`	`v0.62.0` -> `v0.68.0`
`go.opentelemetry.io/otel`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/metric`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/sdk/metric`	`v1.40.0` -> `v1.43.0`
`go.opentelemetry.io/otel/trace`	`v1.40.0` -> `v1.43.0`
`golang.org/x/crypto`	`v0.49.0` -> `v0.54.0`
`golang.org/x/exp`	`v0.0.0-20251023183803-a4bb9ffd2546` -> `v0.0.0-20260410095643-746e56fc9e2f`
`golang.org/x/mod`	`v0.34.0` -> `v0.38.0`
`golang.org/x/net`	`v0.52.0` -> `v0.57.0`
`golang.org/x/sync`	`v0.20.0` -> `v0.22.0`
`golang.org/x/sys`	`v0.42.0` -> `v0.47.0`
`golang.org/x/term`	`v0.41.0` -> `v0.45.0`
`golang.org/x/text`	`v0.35.0` -> `v0.40.0`
`golang.org/x/tools`	`v0.43.0` -> `v0.48.0`
`gonum.org/v1/gonum`	`v0.16.0` -> `v0.17.0`
`google.golang.org/api`	`v0.267.0` -> `v0.271.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260414002931-afd174a4e478`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260203192932-546029d2fa20` -> `v0.0.0-20260414002931-afd174a4e478`
`google.golang.org/grpc`	`v1.79.3` -> `v1.82.1`
`google.golang.org/protobuf`	`v1.36.11` -> `v1.36.12-0.20260120151049-f2248ac996af`
`gorm.io/gorm`	`v1.31.1` -> `v1.31.2`
`modernc.org/libc`	`v1.70.0` -> `v1.74.1`
`modernc.org/sqlite`	`v1.46.2` -> `v1.54.0`

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

renovate Bot force-pushed the renovate/dependencies branch 3 times, most recently from 5ba679a to 8b58a61 Compare December 31, 2024 20:44

renovate Bot force-pushed the renovate/dependencies branch 4 times, most recently from 490052d to 23754db Compare January 9, 2025 12:01

renovate Bot force-pushed the renovate/dependencies branch 6 times, most recently from c9a1639 to 5aabad4 Compare January 17, 2025 07:19

renovate Bot force-pushed the renovate/dependencies branch 5 times, most recently from 6e3a52e to 3c9057e Compare January 25, 2025 12:15

renovate Bot force-pushed the renovate/dependencies branch 5 times, most recently from 37862c0 to ade8620 Compare February 5, 2025 00:08

renovate Bot force-pushed the renovate/dependencies branch 7 times, most recently from 88a8ea0 to 849332e Compare February 12, 2025 12:33

renovate Bot force-pushed the renovate/dependencies branch 8 times, most recently from dee5df0 to 2ed628e Compare March 10, 2025 09:42

renovate Bot force-pushed the renovate/dependencies branch from 2ed628e to 8833055 Compare March 10, 2025 20:32

smira closed this Apr 2, 2025

smira deleted the renovate/dependencies branch April 2, 2025 13:51

smira restored the renovate/dependencies branch April 2, 2025 15:12

smira reopened this Apr 2, 2025

talos-bot added the status/ok-to-test label Apr 2, 2025

talos-bot added this to Planning Apr 2, 2025

github-project-automation Bot moved this to To Do in Planning Apr 2, 2025

talos-bot moved this from To Do to In Review in Planning Apr 2, 2025

smira force-pushed the renovate/dependencies branch from 8833055 to 9d222f7 Compare April 2, 2025 15:42

smira removed this from Planning Apr 2, 2025

renovate Bot force-pushed the renovate/dependencies branch 3 times, most recently from 95295d4 to 66ab4f9 Compare April 6, 2025 11:50

renovate Bot force-pushed the renovate/dependencies branch 5 times, most recently from 929d827 to 83bdebd Compare April 17, 2025 13:15

renovate Bot force-pushed the renovate/dependencies branch from 83bdebd to 1e5f791 Compare April 19, 2025 11:22

chore: update dependencies

6c8d557

Signed-off-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Navigation Menu

Uh oh!

chore: update dependencies - #567

chore: update dependencies#567
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/dependencies

renovate Bot commented Dec 25, 2024 •

edited

Loading

Uh oh!

renovate Bot commented Apr 24, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

renovate Bot commented Dec 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

SHA256 Checksums:

Bug Fixes

Dependencies

Added Features

Bug Fixes

Dependencies

Added Features

Bug Fixes

Additional Changes

Dependencies

Added Features

Additional Changes

Added Features

Bug Fixes

Added Features

Additional Changes

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Dependencies

Added Features

Bug Fixes

Dependencies

Added Features

Bug Fixes

Dependencies

Added Features

Bug Fixes

Dependencies

Bug Fixes

Added Features

Bug Fixes

Uh oh!

renovate Bot commented Apr 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: internal/grype-scan/go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

renovate Bot commented Dec 25, 2024 •

edited

Loading

renovate Bot commented Apr 24, 2026 •

edited

Loading