dependabot[bot]
ee48c01c06
chore(deps): bump actions/cache/restore in /.github/actions/bootstrap ( #5037 )
...
Bumps [actions/cache/restore](https://github.com/actions/cache ) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9 )
---
updated-dependencies:
- dependency-name: actions/cache/restore
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:31:51 +00:00
dependabot[bot]
f6bf15bb3c
chore(deps): bump golang.org/x/tools from 0.46.0 to 0.47.0 ( #5038 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.46.0 to 0.47.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.46.0...v0.47.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.47.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:31:03 +00:00
dependabot[bot]
312f2532d0
chore(deps): bump modernc.org/sqlite from 1.51.0 to 1.53.0 ( #5039 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.51.0 to 1.53.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.51.0...v1.53.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.53.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:30:45 +00:00
dependabot[bot]
f2c9463e76
chore(deps): bump anchore/go-make/.github/actions/setup ( #5036 )
...
Bumps [anchore/go-make/.github/actions/setup](https://github.com/anchore/go-make ) from 0.6.0 to 0.8.0.
- [Release notes](https://github.com/anchore/go-make/releases )
- [Commits](https://github.com/anchore/go-make/compare/39fe5f71112d4dceb3ff0a92a40f272f067fc457...430e2175bb166bfd138ef75466adbcc8ddab875f )
---
updated-dependencies:
- dependency-name: anchore/go-make/.github/actions/setup
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:30:15 +00:00
dependabot[bot]
4eb61fc104
chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml ( #5034 )
...
Bumps [anchore/workflows/.github/workflows/check-gate.yaml](https://github.com/anchore/workflows ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b0c30a80409130d329aaa356fd64a34d8c0b3375...7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/check-gate.yaml
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:50 +00:00
dependabot[bot]
832d96c1dd
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #5035 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:37 +00:00
dependabot[bot]
5a7a72b53e
chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 ( #5030 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.5.6 to 0.5.7.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...192e21d79ab29983730a13d1382995c2307fbcaa )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:27 +00:00
dependabot[bot]
df1fc98e7a
chore(deps): bump anchore/workflows/.github/workflows/codeql.yaml ( #5032 )
...
Bumps [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b0c30a80409130d329aaa356fd64a34d8c0b3375...7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/codeql.yaml
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:04 +00:00
gab and Alex Goodman
656a4d46d7
Vcpkg Cataloger ( #4081 )
...
* Vcpkg cataloger for vcpkg "Manifest Mode"
Find and parse vcpkg-lock.json to get HEAD commit hash
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* just use local vcpkg git repo if it exists, clone it if it doesn't
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Config opt for git remote clones for vcpkg and README update
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* Look in vcpkg cache git repo for custom git repos
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add triplet to metadata and support overlay-ports from config file
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Add PURL to packages (not sure if this is correct)
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* flatten structs in pkg module and move vcpkg structs to resolver
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* account for overriden versions in toplevel manifest
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema for vcpkg metadata
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* test for basic vcpkg project
dependencies for vcpkg registry to be pulled in
add tree hashes and use correct git hash in builtin-baseline for helloworld test
vcpkg-registry for testing that uses object hashes from syft repo
fix broken tests
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* formatting
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* fix static-analysis violations
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration test failure
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* remove uneeded files from vcpkg test fixture and use custom registry
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* change vcpkg registry to anchore one
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* purl spec based on open PR
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate-json-schema
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rebased and generate json schema 16.0.40
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* address low hanging fruit
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* handle additional comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve docs and testing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove license from pkg metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix capabilities claim
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-01 09:11:33 -04:00
Rez Moss and Alex Goodman
148fe572bc
added macOS .app cataloger ( #4490 )
...
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump schema to 16.1.7
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address static analysis failures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expand fields and improve test coverage
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-30 10:32:57 -04:00
Keith Zantow
deee79411a
fix: composite action version parsing ( #4616 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-29 15:23:47 -04:00
e7f1a803e7
fixed dotnet cataloger can't find packages from deps.json in linux el… ( #4517 )
...
* fixed dotnet cataloger can't find packages from deps.json in linux elf, fixed #4514
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split bundle and PE concerns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* limit resource usage of readall call
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* removed duplicat
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* make sure the first 4 bytes in elf arent lostt
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert readelfbundle func, check size of readdeps json
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert readelfbundle func, check size of readdeps json, fixed #4514
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move dotnet net8 linux fixture to testdata convention
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address malformed elf size claims + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont key off of cataloger name in testing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-29 13:52:55 -04:00
sputnik-mac and Alex Goodman
a34f86fba1
fix(template): expose sprig date/time functions in Go templates ( #4644 )
...
* fix(template): expose sprig date functions in Go templates
Replace HermeticTxtFuncMap with TxtFuncMap to expose date/time
functions (now, date, dateInZone, etc.) while still excluding
security-sensitive env/expandenv functions.
Users can now use date functions in templates, e.g.:
{{ now | unixEpoch }}
{{ now | date "2006-01-02" }}
Fixes #2372
Signed-off-by: Sputnik-MAC <sputnik.mac.001@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* invert to add functions to the hermetic set, not the other way around
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sputnik-MAC <sputnik.mac.001@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-29 11:55:51 -04:00
e388b5249d
Add support for MIT and Heimdal Kerberos 5 library detection ( #4781 )
...
* Add support for MIT and Heimdal Kerberos 5 library detection
Signed-off-by: Nadim Zubidat <nadimz@users.noreply.github.com >
* support 2-component case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Nadim Zubidat <nadimz@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Nadim Zubidat <nadimz@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-29 11:54:44 -04:00
Archy
1746e96ad3
fix: correct typos and update examples README ( #4703 )
...
Signed-off-by: Artem Muterko <artem@sopho.tech >
2026-06-29 11:16:50 -04:00
Sai Asish Y and Alex Goodman
956858fc11
ruby/gemspec: resolve simple #{s.name}/#{s.version} interpolation ( #4782 )
...
* ruby/gemspec: resolve simple #{s.name}/#{s.version} interpolation
Reported in anchore/syft#4720 : scanning projects that depend on gems
like formatador leaks literal Ruby interpolation into the emitted
SBOM, e.g.
"externalReferences": [
{ "url": "https://github.com/geemus/#{s.name} ", "type": "website" }
]
because formatador.gemspec uses
s.homepage = "https://github.com/geemus/#{s.name} "
and parseGemSpecEntries reads the file as plain text instead of
evaluating it. The interpolation leaks through the captured homepage
field and on into any externalReferences entry the cataloger produces.
Dependency Track then rejects the whole BOM because '{' and '}' are
not valid IRI-reference characters (RFC 3987).
Add a post-parse pass that substitutes the common interpolation forms
(#{s.name}, #{gem.name}, #{name}, and the matching #{*.version}
variants) in captured string fields using values already parsed from
the same gemspec. Anything still containing '#{' after best-effort
substitution is an unresolvable Ruby expression, and for URL-like
fields (currently just homepage) we drop the field entirely so the
SBOM is always schema-valid; callers would rather miss a homepage URL
than emit one that breaks downstream tools.
Adds testdata/formatador.gemspec, a minimal real-world gemspec using
the #{s.name} pattern, plus a new parser test asserting that the
homepage field comes out fully resolved.
Fixes #4720
Signed-off-by: Sai Asish Y <say.apm35@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve test cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sai Asish Y <say.apm35@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-29 11:00:48 -04:00
Chris Greeno
37fee88b5c
feat(elixir): emit dependency relationships from mix.lock ( #4985 )
...
adds dependency-of relationships between elixir locked packages, matching how other
ecosystem catalogers (alpine, arch, debian, redhat, python) express the
dependency graph via the shared dependency.Processor/Specifier mechanism.
Signed-off-by: Chris Greeno <cgreeno@gmail.com >
2026-06-29 10:22:38 -04:00
sputnik-mac
1143c12a97
fix: add .bpl file extension support to PE/DLL cataloger ( closes #4664 ) ( #4688 )
...
Borland Package Library (.bpl) files are standard Windows PE/DLL files
used in Delphi and C++Builder ecosystems. This adds the .bpl glob
pattern to the PE file discovery so these files are cataloged alongside
.dll and .exe files.
2026-06-29 10:17:52 -04:00
b15c5dbfe2
chore(deps): update anchore dependencies ( #4960 )
...
* chore(deps): update anchore dependencies
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
* update snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-25 15:26:14 -04:00
Alex Goodman
35d56bfb99
Update go-make to v0.8.0 ( #5010 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-25 15:01:40 -04:00
Alex Goodman
abf6d78dfc
fixes the wrapped taskfile-tasks ( #5013 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-24 11:22:16 -04:00
Will Murphy
fe42bcec38
fix(purl-backfill): respect arch qualifier ( #4987 )
...
* fix(purl-backfill): respect arch qualifier
Previously, when constructing rpm, alpm, and apk metadata struct from a
PURL, Syft would ignore the arch qualifier. Start respecting that
qualifier.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: fix static analysis
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* Clean up control flow in PURL backfill code
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-06-23 15:23:46 -04:00
Rez Moss and Christopher Phillips
fea4a50124
feat: deno cataloger #4417 ( #4523 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-23 10:58:22 -04:00
dependabot[bot]
5eefd73ac7
chore(deps): bump golang.org/x/tools from 0.45.0 to 0.46.0 ( #5008 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.45.0 to 0.46.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.45.0...v0.46.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.46.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:50:24 +00:00
dependabot[bot]
684c7018be
chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 ( #5004 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.55.0 to 0.56.0.
- [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:34:47 +00:00
dependabot[bot]
f827f91ec1
chore(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 ( #5007 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.36.0 to 0.37.0.
- [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:19:47 +00:00
dependabot[bot]
e9af7d218c
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.10 to 6.8.1 ( #5006 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.10 to 6.8.1.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.1 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.8.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:18:54 +00:00
Alex Goodman
506ad5d6a7
refactor release pipeline: TAG_TOKEN, skip-checks gate, dependabot/zizmor cleanup ( #5003 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 14:04:48 -04:00
Rez Moss
1f4f9332c5
feat: support envoy bin classifier
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-22 13:16:33 -04:00
Rez Moss
52a4c3b594
feat: elastic beats bin classifier ( #4969 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-22 11:49:44 -04:00
Keith Zantow
9c321691d4
feat: SPDX 3 ( #4269 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-22 10:59:34 -04:00
Alex Goodman
0e8d6deabe
require tmpdir to exist for fingerprints ( #5002 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 10:54:26 -04:00
dependabot[bot]
deb2fd92ef
chore(deps): bump github.com/containerd/containerd/v2 ( #5001 )
...
Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd ) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v2.3.1...v2.3.2 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
dependency-version: 2.3.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 14:12:11 +00:00
Alex Goodman
80d3b62de4
bump go-make to v0.7.0 ( #4999 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 09:47:58 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
b71afc87fc
chore(deps): update tool versions ( #4994 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-06-19 11:51:05 +00:00
Alex Goodman
efe3174b5f
Preserve dependency edges when a compliance stub changes a package ID ( #4993 )
...
* fix relationship rewrites for isolated nodes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* cover dangling pointers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-18 19:50:30 -04:00
Rez Moss
58e4dbbf01
feat: added bin classifier elastic-agent ( #4968 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-17 15:29:07 +00:00
Sebastiaan van Stijn
b70fa899cb
golangci-lint: enable gci formatter ( #4828 )
...
This allows linting the imports to be grouped correctly, and provides
an auto-fix (`golangci-lint run --fix`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl >
2026-06-17 10:34:22 -04:00
Alex Goodman
951fbd454a
add purl types to cataloger info cmd ( #4984 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-16 12:13:34 -04:00
Rez Moss
92ae4d44c5
fix: .net deps.json cataloger no longer shows phantom pkgs ( #4971 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-16 12:02:42 -04:00
Alex Goodman
8d48a8b8c2
ensure we have a snapshot build for cli tests ( #4981 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-16 10:41:33 -04:00
David Dashti and Alex Goodman
cff5a05681
fix(dpkg): extract License field for opkg/ipkg entries ( #4963 )
...
* fix(dpkg): extract License field for opkg/ipkg entries
opkg and ipkg use the dpkg cataloger but declare the package License
inline in the status DB (unlike Debian dpkg, where licenses live in
copyright files). The cataloger silently dropped the License field at
mapstructure decode time, so all opkg-managed packages reported empty
licenses.
This adds the field to the intermediate decode struct and the public
DpkgDBEntry, and populates licenses in newDpkgPackage using the alpine
cataloger's pattern: try license.ParseExpression first to keep valid
SPDX expressions whole, fall back to whitespace splitting for
space-separated lists.
Standard Debian dpkg status files never carry a License field per
Debian policy, so the new path is a no-op for them; the existing
copyright-file lookup in addLicenses is unaffected.
Closes #4940
Signed-off-by: David Dashti <47575784+Dashtid@users.noreply.github.com >
* remove license from dpkg metadata struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore format snapshot files
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add additional tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: David Dashti <47575784+Dashtid@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-15 16:15:32 -04:00
Kursat Topcuoglu and Kursat Topcuoglu
00ca43d24a
fix: catalog uv PEP 723 script lockfiles (*.py.lock) ( #4950 )
...
Signed-off-by: Kursat Topcuoglu <7313835+ktopcuoglu@users.noreply.github.com >
Co-authored-by: Kursat Topcuoglu <7313835+ktopcuoglu@users.noreply.github.com >
2026-06-15 11:34:02 -04:00
dependabot[bot]
6a27678036
chore(deps): bump the actions-minor-patch group across 2 directories with 6 updates ( #4975 )
...
Bumps the actions-minor-patch group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
| [anchore/workflows/.github/workflows/check-version-available.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
| [anchore/workflows/.github/workflows/check-gate.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
| [actions/checkout](https://github.com/actions/checkout ) | `6.0.2` | `6.0.3` |
| [anchore/workflows/.github/workflows/release-install-script.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [anchore/go-make](https://github.com/anchore/go-make ).
Updates `anchore/workflows/.github/workflows/codeql.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `anchore/workflows/.github/workflows/check-version-available.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `anchore/workflows/.github/workflows/check-gate.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
Updates `anchore/workflows/.github/workflows/release-install-script.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `anchore/go-make` from 0.5.0 to 0.6.0
- [Release notes](https://github.com/anchore/go-make/releases )
- [Commits](https://github.com/anchore/go-make/compare/9de27be11ed73e2f9d5406a836a492b7d8aa1225...39fe5f71112d4dceb3ff0a92a40f272f067fc457 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/codeql.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-version-available.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-gate.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/release-install-script.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/go-make
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 13:29:23 +00:00
Keith Zantow
89773c0a12
fix: support CycloneDX 1.7 ( #4967 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-11 09:40:42 -04:00
Yoonho Hann and Christopher Phillips
b08d3c2970
feat: add support for Bun lockfile ( #4625 )
...
---------
Signed-off-by: Yoonho Hann <hnnynh125@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-09 13:22:43 -04:00
Keith Zantow
63232bf725
fix: local version identifiers in python requirements parsing ( #4959 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-08 11:12:47 -04:00
Marcus and Christopher Phillips
908eb57890
feat: add .bpl extension to PE cataloger ( #4954 )
...
BPL (Borland Package Library) files are standard PE/DLL format used by
Delphi and C++Builder. Adding the extension to the glob list so syft
picks them up during directory scans without users needing to rename
to .dll first.
---------
Signed-off-by: jfjrh2014 <jfjrh2014@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-08 10:07:15 -04:00
Arpit Jain
c5c423ab37
fix: detect mariadb version from RHEL build path ( #4952 )
...
Signed-off-by: Arpit Jain <arpitjain099@gmail.com >
2026-06-07 13:28:18 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
d4496b05aa
chore(deps): update anchore dependencies ( #4934 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-06-05 13:55:57 +00:00
dependabot[bot]
gabandAlex Goodman
Rez MossandAlex Goodman
Keith Zantow
sputnik-macandAlex Goodman
Archy
Sai Asish YandAlex Goodman
Chris Greeno
Will Murphy
Sebastiaan van Stijn
David DashtiandAlex Goodman
Kursat TopcuogluandKursat Topcuoglu
Yoonho HannandChristopher Phillips
MarcusandChristopher Phillips
Arpit Jain