oss/syft
2
0
Fork 0
mirror of https://github.com/anchore/syft.git synced 2026-10-30 14:02:26 +01:00
Code Issues Packages Projects Releases Wiki Activity
2,210 Commits 65 Branches 273 Tags
f7ffcc534fd44e304527dfd34c6e0b372310456a
Commit Graph
2210 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Christopher Angelo Phillips f7ffcc534f fix: stabilize cpe sorting during collection sort (#3009) 2024-07-09 14:24:21 -04:00
Laurent Goderre b101f44aba Map the downloadLocation field for PHP Composer packages (#3011) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-07-09 09:01:58 -07:00
anchore-actions-token-generator[bot]andkzantow de3313cfb6 chore(deps): update stereoscope to e46739e217969fa67cbe8834b64bb165a10a1548 (#3013) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>
 2024-07-09 07:53:04 -07:00
dependabot[bot] b2f9904d74 chore(deps): bump golang.org/x/net from 0.26.0 to 0.27.0 (#3015) 
Bumps [golang.org/x/net](https://github.com/golang/net) from 0.26.0 to 0.27.0.
- [Commits](https://github.com/golang/net/compare/v0.26.0...v0.27.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-07-09 07:52:32 -07:00
dependabot[bot] 13d01ecaff chore(deps): bump golang.org/x/mod from 0.18.0 to 0.19.0 (#3014) 
Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.18.0 to 0.19.0.
- [Commits](https://github.com/golang/mod/compare/v0.18.0...v0.19.0)

---
updated-dependencies:
- dependency-name: golang.org/x/mod
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-07-09 07:08:25 -07:00
dependabot[bot] 7dc1b1ce27 chore(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4 (#3017) 
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 4.3.3 to 4.3.4.
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/65462800fd760344b1a7b4382951275a0abb4808...0b2256b8c012f0828dc542b3febcab082c67f72b)

---
updated-dependencies:
- dependency-name: actions/upload-artifact
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-07-09 07:08:12 -07:00
dependabot[bot] b8dce675fe chore(deps): bump github.com/google/go-containerregistry (#3019) 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.19.2 to 0.20.0.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.19.2...v0.20.0)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-07-09 07:08:02 -07:00
dependabot[bot] 6dda9edd7c chore(deps): bump github.com/adrg/xdg from 0.4.0 to 0.5.0 (#3020) 
Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg) from 0.4.0 to 0.5.0.
- [Release notes](https://github.com/adrg/xdg/releases)
- [Commits](https://github.com/adrg/xdg/compare/v0.4.0...v0.5.0)

---
updated-dependencies:
- dependency-name: github.com/adrg/xdg
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-07-09 07:07:53 -07:00
anchore-actions-token-generator[bot] 04c861bf77 chore(deps): update CPE dictionary index (#3016) 2024-07-08 08:13:17 -04:00
Alex Goodman 573440b7cf Infer the package type from ELF package notes (#3008) 
* fix ELF package types to be honored

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* prefer OS packages over binary packages when there are duplicates

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-07-02 16:07:08 -04:00
anchore-actions-token-generator[bot] c816039e91 chore(deps): update tools to latest versions (#3003) 2024-07-01 20:04:45 -04:00
anchore-actions-token-generator[bot] 7f3ca65cf6 chore(deps): update CPE dictionary index (#3002) 2024-07-01 15:02:15 -04:00
dependabot[bot] 43e5b1b45f chore(deps): bump github.com/docker/docker (#3006) 2024-07-01 19:01:01 +00:00
dependabot[bot] a876aaccb2 chore(deps): bump github/codeql-action from 3.25.10 to 3.25.11 (#3004) 2024-07-01 19:00:35 +00:00
dependabot[bot] 875669bfd1 chore(deps): bump github.com/saferwall/pe from 1.5.3 to 1.5.4 (#3005) 2024-07-01 19:00:07 +00:00
Danielle Featherstone 5283c4687a feat: version 3 support for swift package manager of the resolved files (#3001) 
Signed-off-by: Danielle Featherstone <dfeatherstone@fearless.tech>
 2024-07-01 14:27:37 -04:00
dependabot[bot] 4d48adfa3f chore(deps): bump github.com/spdx/tools-golang from 0.5.4 to 0.5.5 (#2999) 2024-06-26 13:44:52 +00:00
dependabot[bot] c8b449c92b chore(deps): bump github.com/docker/docker (#2994) 
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 26.1.4+incompatible to 27.0.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases)
- [Commits](https://github.com/docker/docker/compare/v26.1.4...v27.0.1)

---
updated-dependencies:
- dependency-name: github.com/docker/docker
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-25 14:40:51 -07:00
Laurent Goderre ceced5eb27 Add detection of Erlang in Alpine linux (#2996) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-06-25 14:40:40 -07:00
anchore-actions-token-generator[bot]andspiffcs 7da15890eb chore(deps): update tools to latest versions (#2991) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-06-25 13:41:26 -07:00
anchore-actions-token-generator[bot]andkzantow 580c09b01c chore(deps): update stereoscope to 753b5576fe42bc007b22108ad7911d1729957a46 (#2992) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com>
 2024-06-25 13:41:08 -07:00
dependabot[bot] 0dce67872e chore(deps): bump github.com/charmbracelet/bubbletea (#2995) 
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 0.26.5 to 0.26.6.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases)
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml)
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.5...v0.26.6)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-25 10:10:26 -07:00
anchore-actions-token-generator[bot]andwagoodman 1eae9333a9 chore(deps): update CPE dictionary index (#2986) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com>
v1.8.0 		2024-06-24 08:27:29 -07:00
dependabot[bot] 863891f325 chore(deps): bump github.com/go-test/deep from 1.1.0 to 1.1.1 (#2988) 
Bumps [github.com/go-test/deep](https://github.com/go-test/deep) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/go-test/deep/releases)
- [Changelog](https://github.com/go-test/deep/blob/master/CHANGES.md)
- [Commits](https://github.com/go-test/deep/compare/v1.1.0...v1.1.1)

---
updated-dependencies:
- dependency-name: github.com/go-test/deep
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-24 08:27:13 -07:00
Keith Zantow bd1c1d260c fix: handle errors reading go licenses (#2985) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-24 10:27:03 -04:00
Christopher Angelo Phillips f5a917a5a2 docs: update cyclone-dx documentation (#2983) 
* chore: update docs to show 1.6 for cyclone-dx by default
* chore: update README showing version information for formats

---------

Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
 2024-06-21 09:32:59 -07:00
Rajan Agaskar ae0683074e feat: update syft to generate cyclone-dx 1.6 by default (#2978) 
- Resolves #2974
- add detailed instructions re: updating schemas (a necessary task
  when a new CycloneDX spec version becomes available).
- The DefaultVersion constant has been updated to "1.6" -- it's not
  clear to me how this is used at this time (it may be redundant given
  other code), but effectively unless a specific spec version is
  configured, `syft` will emit the "most recent" spec version available
  for cyclonedx. Users who wish to pin back to a "older" specVersion
  (e.g. to preserve compatibilty with utilities that have not yet bumped
  to latest) can either set this in a syft config file or pass a
  name@spec_version pair to the output flag (e.g. `-o
  cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`)
- Regenerate relevant .golden files (there seems to be a way to do this
  via flags, but I couldn't quite figure out the right set to pass
  correctly, esp. since (as a relative go novice) I found it difficult
  to run just a single test file. I ended up "brute-forcing it" by
  changing the *updateSnapshot val to "true" and running it in Goland.
  A brief comment giving an example of regenerating fixtures usage would
  be helpful.

Signed-off-by: Rajan Agaskar <ragaskar@gmail.com>
 2024-06-21 08:51:27 -07:00
dependabot[bot] 9b178174a7 chore(deps): bump github.com/charmbracelet/bubbletea (#2982) 
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea) from 0.26.4 to 0.26.5.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases)
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml)
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.4...v0.26.5)

---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-21 08:46:35 -07:00
dependabot[bot] e947779886 chore(deps): bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 (#2975) 2024-06-20 15:12:12 +00:00
Laurent Goderre 7a35de04ee fix: detection of arangodb 3.12 (#2979) 
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com>
 2024-06-20 11:11:03 -04:00
Weston Steimel 246df97ae7 chore: enable dependabot to keep boostrap action updated (#2976) 
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-06-19 20:17:11 +01:00
dependabot[bot] 750d37f075 chore(deps): bump github.com/github/go-spdx/v2 from 2.2.0 to 2.3.1 (#2973) 
Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx) from 2.2.0 to 2.3.1.
- [Release notes](https://github.com/github/go-spdx/releases)
- [Commits](https://github.com/github/go-spdx/compare/v2.2.0...v2.3.1)

---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-18 09:46:11 -07:00
dependabot[bot] 5061b905dc chore(deps): bump github.com/google/go-containerregistry (#2971) 
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.19.1 to 0.19.2.
- [Release notes](https://github.com/google/go-containerregistry/releases)
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)
- [Commits](https://github.com/google/go-containerregistry/compare/v0.19.1...v0.19.2)

---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-17 08:44:19 -07:00
dependabot[bot] ed3774afa7 chore(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 (#2972) 
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/spf13/cobra/releases)
- [Commits](https://github.com/spf13/cobra/compare/v1.8.0...v1.8.1)

---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-17 08:44:10 -07:00
Christopher Angelo PhillipsandAlex Goodman 22d5731482 fix: fix parsing for complex toml types (#2965) 
* fix: fix parsing for complex toml types
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
v1.7.0 		2024-06-14 19:32:17 +00:00
Keith Zantow af3aaa0397 fix: make caching options more explicit (#2966) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-14 18:45:48 +00:00
anchore-actions-token-generator[bot]andspiffcs 70098e20bb chore(deps): update tools to latest versions (#2961) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-06-14 08:18:41 -07:00
dependabot[bot] 784b17f66c chore(deps): bump github/codeql-action from 3.25.9 to 3.25.10 (#2964) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.9 to 3.25.10.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/530d4feaa9c62aaab2d250371e2061eb7a172363...23acc5c183826b7a8a97bce3cecc52db901f8251)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-14 08:18:25 -07:00
Weston Steimel d5cd5f6091 feat: index known CPEs for wordpress plugins and themes (#2963) 
Signed-off-by: Weston Steimel <commits@weston.slmail.me>
 2024-06-14 14:39:43 +01:00
Weston SteimelandAlex Goodman 749ccc59c1 fix(golang): improve version extraction from ldflags for pingcap TiDB (#2962) 
* fix(golang): improve version extraction from ldflags for pingcap TiDB

Signed-off-by: Weston Steimel <commits@weston.slmail.me>

* loosen ld flag parsing requirements

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Weston Steimel <commits@weston.slmail.me>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-14 14:35:14 +01:00
dependabot[bot] 273e31e806 chore(deps): bump actions/checkout from 4.1.6 to 4.1.7 (#2955) 
Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.6 to 4.1.7.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](https://github.com/actions/checkout/compare/a5ac7e51b41094c92402da3b24376905380afc29...692973e3d937129bcbf40652eb9f2f61becf3332)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-13 12:28:04 -04:00
dependabot[bot] 9beaec2e97 chore(deps): bump github/codeql-action from 3.25.8 to 3.25.9 (#2956) 
Bumps [github/codeql-action](https://github.com/github/codeql-action) from 3.25.8 to 3.25.9.
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](https://github.com/github/codeql-action/compare/2e230e8fe0ad3a14a340ad0815ddb96d599d2aff...530d4feaa9c62aaab2d250371e2061eb7a172363)

---
updated-dependencies:
- dependency-name: github/codeql-action
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-13 12:27:53 -04:00
Keith Zantow ca0cc52d47 fix: separate golang license caches from mod dir (#2852) 
Signed-off-by: Keith Zantow <kzantow@gmail.com>
 2024-06-12 19:12:35 -04:00
dependabot[bot] dd723bb3c5 chore(deps): bump github.com/vbatts/go-mtree from 0.5.3 to 0.5.4 (#2952) 
Bumps [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree) from 0.5.3 to 0.5.4.
- [Release notes](https://github.com/vbatts/go-mtree/releases)
- [Changelog](https://github.com/vbatts/go-mtree/blob/main/releases.md)
- [Commits](https://github.com/vbatts/go-mtree/compare/v0.5.3...v0.5.4)

---
updated-dependencies:
- dependency-name: github.com/vbatts/go-mtree
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-12 13:17:06 -04:00
anchore-actions-token-generator[bot]andspiffcs fb68489590 chore(deps): update tools to latest versions (#2949) 
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com>
 2024-06-11 08:09:07 -07:00
dependabot[bot] 5590d5c1ce chore(deps): bump modernc.org/sqlite from 1.30.0 to 1.30.1 (#2950) 
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite) from 1.30.0 to 1.30.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.30.0...v1.30.1)

---
updated-dependencies:
- dependency-name: modernc.org/sqlite
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2024-06-11 08:08:45 -07:00
Alex Goodman 0956753409 Consider Author field for wordpress plugins when generating CPEs (#2946) 
* enhance wordpress vendor candidates for CPEs

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

* encode wordpress plugin target software

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

---------

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 14:12:20 -04:00
Alex Goodman f966bcfd03 trim whitespace from wordpress values (#2945) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 13:35:01 -04:00
Alex Goodman c43f4fb416 add signature verification to install.sh (#2941) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
v1.6.0 		2024-06-10 11:29:53 -04:00
Alex Goodman db0c33481e pin golang image (#2944) 
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
 2024-06-10 09:59:33 -04:00