[renovate]

This PR contains the following updates:

Package	Type	Update	Change	OpenSSF
github.com/anchore/syft	require	minor	v1.55.0 → v1.56.0

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.56.0

Compare Source

Added Features

• tighten source-distribution external refs [PR #​5493 @​wagoodman]
• output source PURL as external reference [PR #​5246 @​swadaptive]
• Full cataloging of archive contents [Issue #​246] [PR #​5260 @​kzantow]

Bug Fixes

• hash each file once in the file digest cataloger [PR #​5491 @​wagoodman]
• Support envoy binary various versions [Issue #​5470] [PR #​5476 @​pujitha24]
• Support istio binary various versions [Issue #​5060] [PR #​5121 @​hsdfat]
• CPE identifiers contain a wildcard in the CPE part field for packages discovered by the Bitnami cataloger [Issue #​5123] [PR #​5127 @​vigneshakaviki]

Additional Changes

• Gradle lockfile comment line is catalogued as a package [Issue #​5371] [PR #​5372 @​pujitha24]
• use correct error variable in package load [PR #​4983 @​idhyt]
• let go-make own the go version [PR #​5464 @​wagoodman]
• preserve semver build metadata in ffmpeg version [PR #​5452 @​akshaver]

Dependencies

40 dependency changes (38 updated, 1 added, 1 removed). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-mgcc-cww5-fp2q (High) — github.com/go-jose/go-jose/v4

Updated (38 packages)

• github.com/Microsoft/go-winio v0.6.3-0.ad3df93 → v0.6.3-0.f19d971
• github.com/ProtonMail/go-crypto v1.4.1 → v1.5.2
• github.com/anchore/clio v0.1.1 → v0.1.2
• github.com/anchore/stereoscope v0.3.4 → v0.4.0
• github.com/bmatcuk/doublestar/v4 v4.10.2 → v4.10.3
• github.com/containerd/containerd/v2 v2.4.1 → v2.4.2
• github.com/containerd/stargz-snapshotter/estargz v0.18.2 → v0.19.0
• github.com/deitch/magic v0.0.0-1ff89d7 → v1.0.0
• github.com/docker/cli v29.8.2+incompatible → v29.9.2+incompatible
• github.com/docker/docker-credential-helpers v0.9.8 → v0.9.10
• github.com/docker/go-connections v0.8.1 → v0.8.2
• github.com/gabriel-vasile/mimetype v1.4.15 → v1.4.16
• github.com/github/go-spdx/v2 v2.7.1 → v2.8.0
• github.com/gkampitakis/go-snaps v0.5.23 → v0.5.24
• github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 (🟢 remediated GHSA-mgcc-cww5-fp2q)
• github.com/go-test/deep v1.1.1 → v1.1.2
• github.com/google/pprof v0.0.0-ef3492d → v0.0.0-1facf8f
• github.com/gookit/color v1.6.2 → v1.6.3
• github.com/gpustack/gguf-parser-go v0.26.4 → v0.27.0
• github.com/klauspost/compress v1.20.1 → v1.20.3
• github.com/klauspost/pgzip v1.2.6 → v1.2.7
• github.com/mattn/go-runewidth v0.0.27 → v0.0.31
• github.com/mattn/go-sqlite3 v1.14.48 → v1.14.52
• github.com/moby/moby/api v1.56.0 → v1.56.1
• github.com/moby/moby/client v0.6.0 → v0.6.2
• github.com/ncruces/go-strftime v1.0.0 → v1.1.0
• github.com/sigstore/fulcio v1.8.7 → v1.8.8
• github.com/vbauerster/cupwriter v0.0.4 → v0.0.5
• github.com/vbauerster/mpb/v8 v8.14.0 → v8.16.2
• go.podman.io/image/v5 v5.41.2 → v5.42.0
• go.podman.io/storage v1.64.1 → v1.65.0
• golang.org/x/mod v0.41.0 → v0.42.0
• golang.org/x/tools v0.51.0 → v0.52.0
• modernc.org/cc/v4 v4.29.7 → v4.30.3
• modernc.org/ccgo/v4 v4.36.1 → v4.37.0
• modernc.org/gc/v3 v3.1.5 → v3.2.0
• modernc.org/libc v1.77.1 → v1.79.0
• modernc.org/sqlite v1.60.1 → v1.61.0

Added (1 package)

• github.com/varlink/go v0.4.1-0.c935be0

Removed (1 package)

• github.com/becheran/wildmatch-go v1.0.0

(Full Changelog)

---

Configuration

📅 Schedule: (in timezone Europe/Berlin)

• Branch creation
  • "before 6am"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated

Due to Go's usage of Minimal Version Selection (MVS), these packages have been updated to the minimum version available, so will still abide by minimumReleaseAge=2 days

Details:

Package	Change
github.com/anchore/clio	v0.1.1 -> v0.1.2
github.com/anchore/stereoscope	v0.3.4 -> v0.4.0