dependabot[bot]
1e15428c6f
chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 ( #4501 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.11 to 0.21.0.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/43a17d6e7add2b5535efe4dcae9952337c479a93...a930d0ac434e3182448fe678398ba5713717112a )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:19:40 -05:00
dependabot[bot]
d1adfdc3a6
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8 ( #4502 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.7 to 6.7.8.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:19:34 -05:00
dependabot[bot]
0028165062
chore(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 ( #4503 )
...
Bumps [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang ) from 0.5.5 to 0.5.6.
- [Release notes](https://github.com/spdx/tools-golang/releases )
- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md )
- [Commits](https://github.com/spdx/tools-golang/compare/v0.5.5...v0.5.6 )
---
updated-dependencies:
- dependency-name: github.com/spdx/tools-golang
dependency-version: 0.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:19:29 -05:00
anchore-actions-token-generator[bot] and spiffcs
997a76712f
chore(deps): update tools to latest versions ( #4504 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-05 09:19:24 -05:00
dependabot[bot]
e44ef53489
chore(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 ( #4518 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.3 to 1.8.4.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.3...v1.8.4 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:17:46 -05:00
dependabot[bot]
e0708e725f
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.18 to 0.5.19 ( #4520 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.18 to 0.5.19.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.19
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:17:39 -05:00
Alex Goodman
e9e3494853
remove debug output ( #4496 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-22 14:51:39 -05:00
b3c70da3ea
Add experimental cataloger capabilities command ( #4317 )
...
* add info command from generated capabilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct gentoo and arch ecosystems
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename os pkg types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* better binary cataloger description
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expose metadata and pacakge types in json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expose json schema types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add completeness tests for metadata types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* latest generation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve testing a docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests and linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore goreleaser config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tweak diagram
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix pdm
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: java binary data
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* new capability descriptions for gguf and python
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct poetry lock integrity hash claim
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix compile error
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: remove purl version from overrides
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* fix lua deps ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep gguf as ai ecosystem
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split packages.yaml to multiple files by go package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure tests do not use go test cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* sort json output for info command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs: fix ocaml, php, and portage capabilities yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: update erlang capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update java capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update javascript capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update linux kernel capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* remove missing tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix package.yaml references
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert license list change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* check for drift in capability descriptions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate capabilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test cleanup
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use fixture cache in static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* claim fixtures pre-req for cap generation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update documentation with correct regeneration procedure
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: ruby-gemspec-cataloger finds no dependencies
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: fix python docs and config comment
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: commit re-generated java yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* add cataloger selection to caps command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* re-generate cap yamls
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests for cataloger selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename cmd to `cataloger info`
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] change capability description locations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] continued
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] adjust for import cycles
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-22 19:34:10 +00:00
Alex Goodman
ae1a247f3d
Unpin fixture dependencies that will always float ( #4495 )
...
* unpin dependencies for package dedup case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* prevent make from blocking tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-22 19:17:58 +00:00
Alex Goodman
0ea920ba6d
Decompress UPX packed binaries to extract golang build info (ELF formatted binaries with lzma method only) ( #4480 )
...
* decompress upx packed binaries
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting and remove dead code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-22 14:17:38 +00:00
anchore-actions-token-generator[bot] and spiffcs
7ef4703454
chore(deps): update tools to latest versions ( #4491 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-22 09:15:51 -05:00
dependabot[bot]
8334fb04ec
chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0 ( #4489 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.40.1 to 1.41.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.1...v1.41.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-19 11:00:31 -05:00
VictorHuu
c9760d2341
feat: snap can be queried by revision and ``track/risk/branch`` ( #4439 )
...
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-12-18 15:41:36 -05:00
Rez Moss and Christopher Phillips
74c9380248
fix: 4423 dotnet-deps cataloger skips project type by def
...
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-12-18 13:38:47 -05:00
Alex Goodman
7ed733c3fb
signpost to docs site ( #4483 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-17 18:00:38 +00:00
dependabot[bot]
a39c600913
chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 ( #4481 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.8 to 4.31.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/1b168cd39490f61582a9beae412bb7057a6b2c4e...5d4e8d1aca955e8d8589aabd499c5cae939e33c7 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-17 10:20:52 -05:00
dependabot[bot]
a2020fe1c7
chore(deps): bump github.com/goccy/go-yaml from 1.19.0 to 1.19.1 ( #4482 )
...
Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml ) from 1.19.0 to 1.19.1.
- [Release notes](https://github.com/goccy/go-yaml/releases )
- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md )
- [Commits](https://github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1 )
---
updated-dependencies:
- dependency-name: github.com/goccy/go-yaml
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-17 10:20:43 -05:00
Rez Moss and Alex Goodman
c79a57b6a1
Detect embedded deps.json in .NET binaries ( #4375 )
...
* syft detect embedded deps.json,dotnet , fixed #4344
Signed-off-by: Rez Moss <hi@rezmoss.com >
* [wip] have pe utils process embedded dep.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] add PoC bundler processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] search for bundle marker within pe sections
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* put bundle parsing for multiple .net versions under test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-16 08:35:19 -05:00
dependabot[bot]
2c97ff1b24
chore(deps): bump actions/cache from 5.0.0 to 5.0.1 ( #4476 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...9255dc7a253b0ccc959486e2bca901246202afeb )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-16 08:28:51 -05:00
dependabot[bot]
e760a7cad4
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #4477 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...9255dc7a253b0ccc959486e2bca901246202afeb )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-16 08:28:48 -05:00
anchore-actions-token-generator[bot] and spiffcs
e1ae4e1112
chore(deps): update tools to latest versions ( #4473 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-16 08:28:44 -05:00
Alex Goodman
beb70891e5
unapply base path for resolver inbound requests ( #4478 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-16 08:28:12 -05:00
Rez Moss and Keith Zantow
e0b61a3ae3
fix: golang PURL should include full module ( #4395 )
...
* fixed #4316 go mod with ver purl
Signed-off-by: Rez Moss <hi@rezmoss.com >
* go mod purl fixed, added func to handle go.mod
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fix: use module name in PURL string everywhere
Signed-off-by: Keith Zantow <kzantow@gmail.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-12-12 14:19:26 -05:00
VictorHuu and Alex Goodman
4c38ee1932
fix:best effort to get the os info of an ELF binary ( #4438 )
...
* fix:the os of an elf binary should be detected even when the os version is empty
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:revoke the update of appCpe
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:resume the testcase
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* fix:revoke the possible compromise to the json schema
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* fix:align with the json schema
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add a json schema(pre-relase,may be in conflict with others')
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:add a json schema
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:revert the accidental change to 16.1.0
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* regression/fix:best effort to get the os info
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:resume the previous json file
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* update the schema ver to 16.2.0
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:no breaking behavior
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore: follow the guide of the README.md
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* appCpe is temporarily unused
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* preserve json field for osCPE
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-12 19:13:59 +00:00
Alex Goodman
6be0a9abc4
Improve PR template ( #4472 )
...
* improve pr template
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-12 15:45:29 +00:00
Alexandre Steppé
ea1f4cba38
feat: add support for Gemfile.next.lock ( #4457 )
...
Signed-off-by: Alexandre Steppé <alexandre.steppe@gmail.com >
2025-12-12 10:20:53 -05:00
VictorHuu
c8982b887d
chore:cancel in-progress workflows for new commits on same PR ( #4465 )
...
Signed-off-by: VictorHuu <victorhu493@gmail.com >
2025-12-12 10:20:20 -05:00
anchore-actions-token-generator[bot] and spiffcs
6ad4873a33
chore(deps): update tools to latest versions ( #4466 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-12 08:49:02 -05:00
dependabot[bot]
052e4ca9a3
chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 ( #4468 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.7 to 4.31.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/cf1bb45a277cb3c205638b2cd5c984db1c46a412...1b168cd39490f61582a9beae412bb7057a6b2c4e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:36 -05:00
dependabot[bot]
41e133e2cf
chore(deps): bump actions/cache from 4.3.0 to 5.0.0 ( #4469 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.3.0 to 5.0.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...a7833574556fa59680c1b7cb190c1735db73ebf0 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:32 -05:00
dependabot[bot]
a85e034afc
chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to 0.1.16 ( #4470 )
...
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.1.14 to 0.1.16.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/stereoscope/compare/v0.1.14...v0.1.16 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-version: 0.1.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:28 -05:00
dependabot[bot]
d5380013ae
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #4471 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.3.0 to 5.0.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...a7833574556fa59680c1b7cb190c1735db73ebf0 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:22 -05:00
anchore-actions-token-generator[bot] and spiffcs
5ea3387cbc
chore(deps): update tools to latest versions ( #4462 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-11 09:55:34 -05:00
Chris Greeno
568b7601bb
fix(javascript): remove debug print statement in dependency parser ( #4412 )
...
Removes an accidental `fmt.Println("error", err)` that was left in
the javascript dependency parser. This causes noisy output to stdout
when parsing npm package-lock.json files that contain dependency
specifiers that aren't valid PURLs.
Signed-off-by: Chris Greeno <chris@fresha.com >
2025-12-10 13:42:09 -05:00
Kendrick
7fdb08c0b6
Validating download_url for github repositories, and updating if necessary ( #4390 )
...
* Adding a second function to validate/correct urls that are just github repositories
Signed-off-by: Kendrick <kmartinix@gmail.com >
* Adding test case to capture github repositories
Signed-off-by: Kendrick <kmartinix@gmail.com >
---------
Signed-off-by: Kendrick <kmartinix@gmail.com >
2025-12-10 13:41:00 -05:00
anchore-actions-token-generator[bot] and spiffcs
47e1cee5a5
chore(deps): update tools to latest versions ( #4456 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-10 13:34:42 -05:00
dependabot[bot]
a0c5b8aa8d
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7 ( #4460 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.5 to 6.7.7.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.7 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:32:56 -05:00
dependabot[bot]
ab5fa0a664
chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 ( #4459 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.11 to 8.0.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/22a9089034f40e5a961c8808d113e2c98fb63676...98357b18bf14b5342f975ff684046ec3b2a07725 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:32:51 -05:00
dependabot[bot]
07ad8a5573
chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 ( #4458 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.10 to 0.20.11.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/fbfd9c6c189226748411491745178e0c2017392d...43a17d6e7add2b5535efe4dcae9952337c479a93 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:32:47 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
bfe63f83db
chore(deps): update anchore dependencies ( #4440 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2025-12-09 20:56:03 +00:00
f01056d111
chore(deps): update tools to latest versions ( #4442 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: suppress revive on internal/os package name
golangci-lint has started flagging internal/os package name for
shadowing the stdlib package named "os". Suppress this.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-09 11:00:08 -05:00
dependabot[bot]
09b24bdb47
chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.11 ( #4447 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.8 to 7.0.11.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...22a9089034f40e5a961c8808d113e2c98fb63676 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 7.0.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:59:32 -05:00
dependabot[bot]
ae1fa09e02
chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.1 ( #4445 )
...
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token ) from 2.1.4 to 2.2.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases )
- [Commits](https://github.com/actions/create-github-app-token/compare/67018539274d69449ef7c02e8e71183d1719ab42...29824e69f54612133e76f7eaac726eef6c875baf )
---
updated-dependencies:
- dependency-name: actions/create-github-app-token
dependency-version: 2.2.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:57:48 -05:00
dependabot[bot]
6b0f924426
chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0 ( #4448 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.6.2 to 5.7.0.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.6.2...v5.7.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-version: 5.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:56:00 -05:00
dependabot[bot]
6d56087289
chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 ( #4446 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.6 to 4.31.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/fe4161a26a8629af62121b670040955b330f9af2...cf1bb45a277cb3c205638b2cd5c984db1c46a412 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:47:52 -05:00
dependabot[bot]
1d718f3311
chore(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 ( #4453 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.39.0 to 0.40.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.39.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:46:52 -05:00
Keith Zantow
9e3150b7ee
fix: java archives excluded due to incorrect license glob results ( #4449 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-12-08 15:58:13 -05:00
Will Murphy
d950ac1fae
fix: use vercel for vendor in nextjs CPE ( #4450 )
...
The recent react / next CVE uses "vercel" as the vendor, see
https://nvd.nist.gov/vuln/detail/CVE-2025-55182
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-08 20:23:36 +00:00
VictorHuu
baca32f04a
fix:after compliance applied,the relationship concerning the original one should be omitted ( #4419 )
...
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-12-04 15:30:16 -05:00
dependabot[bot]
155738aba7
chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to 2.3.5 ( #4434 )
...
Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.3.4...v2.3.5 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-version: 2.3.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-04 13:42:59 -05:00
dependabot[bot]
anchore-actions-token-generator[bot]andspiffcs
Alex Goodman
VictorHuu
Rez MossandChristopher Phillips
Alexandre Steppé
Chris Greeno
Kendrick
