chore(deps): update dependency anchore/syft to v1.50.0

[renovate]

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	v1.46.0 → v1.50.0

---

Release Notes

anchore/syft (anchore/syft)

v1.50.0

Compare Source

Added Features

• Add bun binary classifier [PR #​5103 @​rezmoss]

Bug Fixes

• Fix Cargo PURLs for local workspace packages [PR #​5105 @​3nesdeniz]
• Decode golang symbols [PR #​5089 @​wagoodman]
• CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #​5073] [PR #​5081 @​Eljees]
• apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #​5094] [PR #​5100 @​cyphercodes]

Additional Changes

• package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #​5101] [PR #​5108 @​Eljees]
• consider vendored golang packages in module attribution [PR #​5093 @​kzantow]
• Fix inverted bounds check dropping every Erlang string with a backslash [PR #​5110 @​arpitjain099]

Dependencies

14 dependency changes (14 updated). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (14 packages)

• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
• github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
• github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
• github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
• github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
• go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
• google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
• google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
• google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
• modernc.org/cc/v4 v4.28.4 → v4.29.0
• modernc.org/ccgo/v4 v4.34.4 → v4.34.6
• modernc.org/gc/v3 v3.1.3 → v3.1.4
• modernc.org/libc v1.73.4 → v1.74.1
• modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)

v1.49.0

Compare Source

Added Features

• Support for application/vnd.oci.image.index.v1+json manifests in root OCI layout [Issue #​1545] [PR #​5074 @​jasonpaulos]

Bug Fixes

• Misinterpretation of Multiple replace Directives in Golang [Issue #​2721] [PR #​5069 @​ychampion]

Dependencies

16 dependency changes (16 updated).

Updated (16 packages)

• github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
• github.com/anchore/stereoscope v0.2.2 → v0.3.0
• github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
• github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
• github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
• github.com/moby/moby/api v1.54.2 → v1.55.0
• github.com/moby/moby/client v0.4.1 → v0.5.0
• github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
• golang.org/x/crypto v0.53.0 → v0.54.0
• golang.org/x/mod v0.37.0 → v0.38.0
• golang.org/x/net v0.56.0 → v0.57.0
• golang.org/x/sync v0.21.0 → v0.22.0
• golang.org/x/sys v0.46.0 → v0.47.0
• golang.org/x/term v0.44.0 → v0.45.0
• golang.org/x/text v0.38.0 → v0.40.0
• golang.org/x/tools v0.47.0 → v0.48.0

(Full Changelog)

v1.48.0

Compare Source

Added Features

• emit dependency relationships from mix.lock [PR #​4985 @​cgreeno]
• add safe tensor model type to SBOM output [PR #​4844 @​spiffcs]
• Capture golang binary symbols [PR #​4988 @​spiffcs]
• Detect Ubuntu Pro/ESM extended support [PR #​5028 @​wagoodman]
• Add scan duration timer to Syft [Issue #​4587] [PR #​4858 @​ChrisJr404]
• Support for vcpkg [Issue #​2110] [PR #​4081 @​gabetrau]
• Add macOS .app cataloger [Issue #​4010] [PR #​4490 @​rezmoss]
• Add support for Kerberos 5 library cataloging [Issue #​4780] [PR #​4781 @​nadimz]
• Include date of scan in results [Issue #​3910]

Bug Fixes

• use printf instead of echo to fix ANSI color output [PR #​4978 @​Jouini-Mohamed-Chaker]
• Strip peer-dep suffix from deno.lock npm keys [PR #​5055 @​Synvoya]
• Allow more PEP440-compliant characters in python versions [PR #​4964 @​kzantow]
• PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #​4996 @​activeobd]
• Fix panic parsing a rockspec comment that ends at EOF [PR #​5053 @​arpitjain099]
• Fix Debian point release detection [PR #​4997 @​OsamaSE]
• Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #​5041 @​Synvoya]
• npm redis client generates no CPE [Issue #​5011] [PR #​5012 @​rezmoss]
• Debug Docker images are running as nonroot user [Issue #​4113] [PR #​4608 @​spiffcs]
• libxml2 gets the wrong cpe vendor [Issue #​5015] [PR #​5016 @​rezmoss]
• wrong purl for spring-ldap-core dependency [Issue #​4030] [PR #​4908 @​jonasboos]
• Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #​3961] [PR #​4785 @​SAY-5]
• conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #​5017] [PR #​5020 @​jfjrh2014]
• dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #​4514] [PR #​4517 @​rezmoss]
• Go template sprig date functions not defined [Issue #​2372] [PR #​4644 @​sputnik-mac]
• CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #​4720] [PR #​4782 @​SAY-5]

Dependencies

9 dependency changes (8 updated, 1 added).

Updated (8 packages)

• github.com/bmatcuk/doublestar v1.3.1 → v8.8.8
• github.com/klauspost/compress v1.18.6 → v1.19.0
• golang.org/x/tools v0.46.0 → v0.47.0
• modernc.org/cc/v4 v4.28.2 → v4.28.4
• modernc.org/ccgo/v4 v4.34.0 → v4.34.4
• modernc.org/gc/v3 v3.1.2 → v3.1.3
• modernc.org/libc v1.72.3 → v1.73.4
• modernc.org/sqlite v1.51.0 → v1.53.0

Added (1 package)

• howett.net/plist v1.0.1

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.