fix(ai): use go.yaml.in/yaml/v3 to parse model card frontmatter (#5328)

* fix(ai): use go.yaml.in/yaml/v3 to parse model card frontmatter

gopkg.in/yaml.v3 panics on some malformed merge-key payloads (for
example "<<:\r? 0:"), which crashed the gguf and safetensors catalogers
when a model README contained such frontmatter. Switch the Hugging Face
frontmatter parser to the maintained go.yaml.in/yaml/v3 fork, which is
already used by the other catalogers and returns an error instead of
panicking. The existing error path logs and skips the frontmatter.

Fixes #5327

Signed-off-by: tk1475 <118763009+tk1475@users.noreply.github.com>
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* chore: finish moving off gopkg.in/yaml.v3

- move the snap catalogers and `internal/capabilities` to `go.yaml.in/yaml/v3`. The snap parsers decode yaml from scanned sources and hit the same merge-key panic as #5327
- enable `depguard` with a deny rule for `gopkg.in/yaml.v3` so it can't be reintroduced

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: tk1475 <118763009+tk1475@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>

syft/pkg/cataloger/ai/huggingface.go

@@ -3,7 +3,7 @@ package ai
 import (
 	"bytes"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/internal/log"
 	"github.com/anchore/syft/syft/pkg"

syft/pkg/cataloger/ai/parse_safetensors_test.go

@@ -1066,6 +1066,12 @@ func TestParseFrontmatter(t *testing.T) {
 			input:   "---\nlicense: mit\n",
 			wantNil: true,
 		},
+		{
+			// https://github.com/anchore/syft/issues/5327
+			name:    "malformed frontmatter that panics the yaml decoder",
+			input:   "---\n<<:\r? 0:\n---\nbody",
+			wantNil: true,
+		},
 	}
 
 	for _, tt := range tests {
@@ -1157,6 +1163,12 @@ limitations:
 			input: "---\nspdx-id: MIT\n(never closes)\n",
 			want:  "",
 		},
+		{
+			// https://github.com/anchore/syft/issues/5327
+			name:  "malformed frontmatter that panics the yaml decoder",
+			input: "---\n<<:\r? 0:\n---\nbody\n",
+			want:  "",
+		},
 	}
 
 	for _, tt := range tests {

syft/pkg/cataloger/snap/parse_base_dpkg.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"

syft/pkg/cataloger/snap/parse_snapd_snapcraft.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"

syft/pkg/cataloger/snap/parse_system_manifest.go

@@ -5,7 +5,7 @@ import (
 	"fmt"
 	"strings"
 
-	"gopkg.in/yaml.v3"
+	"go.yaml.in/yaml/v3"
 
 	"github.com/anchore/syft/syft/artifact"
 	"github.com/anchore/syft/syft/file"