anchore-oss-update-bot and anchore-oss-update-bot
02ba369d13
chore(deps): update anchore dependencies ( #5236 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-09-17 10:09:46 -04:00
Jason Paulos and Alex Goodman
74073aa481
fix: update steroscope to include OCI platform metadata ( #5128 )
...
* Update steroscope to include OCI platform metadata
Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com >
* chore(deps): point stereoscope at anchore/main
drops the fork `replace` directive and moves to a pseudo-version off stereoscope
main (`a22e5ae`, anchore/stereoscope#657 ). no tag carries it yet, so this should
move to a real version once one is cut.
`readImageMetadata` now fills os/architecture/variant for every provider, not
just oci. the docker tarball provider set neither before, so image metadata and
the image purl change for docker-archive input too:
- `"architecture": ""` -> `"amd64"`
- `"os": ""` -> `"linux"`
- `?arch=` -> `?arch=amd64`
the empty `arch=` qualifier was never right, but it is user-visible output.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: cover single-platform oci layouts
the pr only added assertions to the multiplatform fixture, which already
reported the right platform. the behavior that actually changed is single-image
layouts: they used to report empty os/arch and silently ignore `--platform`, and
now report what the image config says and fail with a platform mismatch.
also drops the non-linux skip on the default-platform test. the oci providers
default to `linux/<GOARCH>` regardless of host os, so it holds on macos too.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-16 01:40:54 +00:00
Anže Pečar
0b234b3256
perf(javascript): cache npm registry license lookups across runs ( #5297 )
...
When javascript.search-remote-licenses is enabled, the lock catalogers
query registry.npmjs.org once per package occurrence, on every run, with
nothing in front of the network call. The same name@version is fetched
again for every lockfile that mentions it, and again on the next scan.
This adds a javascriptLicenseResolver that resolves licenses through
syft's on-disk cache, keyed on "<name>/<version>" and namespaced as
javascript/v1, and routes the package-lock v1, package-lock v2, pnpm,
yarn and bun package constructors through it, leaving
getLicenseFromNpmRegistry itself unchanged. Failed lookups are not
cached: a transient registry failure or a name that 404s must not be able
to blank out licenses for the lifetime of the cache entry, since a
missing license silently weakens downstream license policy checks. A
successful lookup that returns an empty license is a real answer and is
still cached.
Signed-off-by: Anže Pečar <anze@pecar.me >
2026-09-15 17:32:28 -04:00
Alex Goodman
b4ee6e4696
fix(debian): bound the decompressed members of a .deb archive ( #5293 )
2026-09-14 18:17:56 -04:00
Alex Goodman
2be26a1af9
fix(kernel): bound what a compressed kernel module expands to ( #5294 )
...
`.ko.gz`/`.ko.xz`/`.ko.zst` modules are spilled to a temp file so ELF parsing
can seek over them. The compressed size is bounded by the file in the image but
what it decompresses to is not, so a few KB of crafted zstd filled the temp
directory until the disk did.
`io.Copy` now stops one byte past a 256MB cap and rejects rather than
truncating, since a partial ELF reads as a corrupt module instead of a rejected
one. The partial spill is removed on the reject path.
The cap is a parameter on an inner function so the tests exercise the boundary
with a few hundred bytes instead of materializing 256MB, matching
`decompressSbomWithLimit` in the graalvm cataloger.
The cap bounds one spill, not the process: peak disk is 256MB times however many
modules are parsed at once, which is cataloger parallelism (`NumCPU*4` by
default, and unbounded when `--parallelism` is negative).
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-14 17:40:41 -04:00
Alex Goodman
30e9e65608
Fix: alpm mtree gzip unbounded processing ( #5292 )
...
* fix(arch): bound the decompressed mtree listing
The ALPM cataloger handed a gzip stream straight to `mtree.ParseSpec`, which
materializes every entry before it returns any of them. Nothing capped the
decompressed size, so a crafted mtree in a scanned image expanded until the
process died. 64KB of input is enough to produce 64MB, and the ratio scales.
Reads through a limit now and rejects a listing that exceeds it. The read goes
one byte past the cap so that tripping it is distinguishable from a listing that
simply ends there, since silently truncating would produce a package missing
most of its files. The existing error path already surfaces this as an unknown.
The cap is well above any real package: an mtree names every file with its
digests, and even the largest packages land far under it.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(arch): bound mtree entry count, not just decompressed bytes
The byte cap alone does not bound what the parse retains. go-mtree keeps an
entry per line and appends it unconditionally, blank lines included, so short
lines cost about 1KB of heap each.
Measured on the previous commit: 15KB of gzipped newlines expanding to 16MB,
comfortably inside the 64MB byte cap, drove 8.1GB of peak heap over 74 seconds
and returned no records and a nil error. Same input now rejects in 0.05s at
51MB peak.
Counting lines before parsing is what makes the entry allocation bounded, since
the parser materializes all of them before returning. Lines the parser skips
only make the count high, never low.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(arch): apply the mtree bounds while streaming
Both caps were enforced against a fully buffered listing, so the peak cost
scaled with cataloger parallelism, which runs a goroutine per package. They now
apply as the stream flows: a limited reader for the byte cap and a counting
reader for the entry cap, which has to trip while the parser is still reading
since it materializes every entry before returning any of them.
Both limits are injectable so the boundary tests can be exact on both sides
without allocating their way up to the shipped 64MB. Each cap gets a listing
exactly at it, asserting the records parse whole rather than just that no error
came back, since quiet truncation is the failure a size check invites.
The byte limiter carries one byte of headroom, which is what makes an
overrunning listing distinguishable from one that simply ends at the cap.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(arch): refuse mtree line continuations
go-mtree collapses a line ending in a backslash into the next one with a
quadratic string concat, so the cost is lines times bytes and neither the byte
cap nor the line cap can see it. 199k continued lines sitting inside both caps
measured 4m34s and 6.1TB of allocation churn, and returned no error.
Also re-derived both constants against a real package rather than a guess.
`texlive-fontsextra` is 105,847 files and 1,978 directories, so roughly 108k
lines at 150-250 bytes each. 16MB would have falsely rejected it, so the byte
cap stays at 64MB and the line cap goes 200k -> 300k, which is ~2.8x a real
package instead of 1.85x.
Rejections are now sentinels so tests can name which bound tripped, and the
constants carry the measured ceiling they imply: a crafted listing of minimal
fields still reaches ~1.1GB at the byte cap, since go-mtree allocates per
whitespace-delimited field. Bounding that further means bounding fields rather
than bytes, and legitimate input is already within ~1.3x of the crafted worst
case, so there is little to win.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(arch): refuse a continuation spelled with a carriage return
The refusal matched the literal bytes backslash-newline, but go-mtree decides
"this is a continuation" from the scanner token, and `bufio.ScanLines` drops a
trailing carriage return before testing for the backslash suffix. So a listing
using CRLF ran the quadratic collapse with nothing watching.
Measured: 775KB of gzip expanding to 17MB across 150k lines, inside both other
bounds, took 1m33s and returned a nil error. Same input now rejects in 50ms.
The check is a single byte pass that counts newlines and looks for a backslash
before either line ending, which replaces the two scans and the straddle special
case it took to catch only one spelling. A tripped bound is also latched now:
`bufio.Scanner` stops at the first error, but nothing about the type said a
caller had to, and the refusal was recomputed per chunk.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test(arch): make the bombpkg fixture able to fail
The fixture was 310k bare newlines, which go-mtree turns into blank entries with
no name, and the parse loop already skips those. So the assertion that a rejected
listing leaves an empty file list held whether or not the bound existed. It is now
a repeated file line: 0 records with the bound, 310,000 without.
Dropped the two tests that asserted nothing as a result. The cataloger-level one
was a weaker restatement of what the golden comparison already pins exactly, and
the shipped-size-cap one drove a real 64MB listing through the parser to prove a
constant had not moved. Asserting the constants directly catches any change rather
than only a loosening.
Race-mode package runtime goes 15.7s -> 4.4s.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test(arch): make three mtree assertions able to fail
The truncated-gzip case asserted the failure was not misreported as the size
bound, but ran against the shipped 64MB cap on a 3.5KB listing, so the check it
guarded could never fire. It now runs against a cap just above the truncation
point, where the two genuinely race.
The bomb case asserted an allocation delta from `runtime.MemStats`, which is a
process-wide cumulative counter and measures the property indirectly. It now
counts bytes pulled through the reader, which is what "gave up while reading"
actually means and does not drift with GC or parallelism.
Added the one bound that had no test at all. A single line over 64KB is refused
by go-mtree's scanner, not by anything here, so a dependency bump that called
`scanner.Buffer` would remove it silently.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs(arch): correct the mtree bound comments and close the gzip reader
The comment said both bounds apply while the listing streams. Only the line cap
does. `io.LimitedReader` signals a drained budget with `io.EOF`, which the parser
reads as the end of a complete listing, so the byte cap is necessarily a check
after the fact. Peak cost is the same either way, since accepting a listing at
the cap costs what rejecting one just past it does, but the comment was claiming
a mechanism that isn't there.
Also trimmed the benchmark writeups down to the reasoning that outlives them.
The exact transient-heap and wall-clock figures are tied to a go-mtree version
with nothing to detect them going stale, and one of them described the CRLF case
as prevented when it wasn't. And `TestMtreeParse` was labelled the regression
guard for the continuation refusal, but its fixture has no backslashes in it.
`gzReader` now gets a `defer Close` to match the other gzip site in the tree.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(arch): stop the alpm database parser panicking on a malformed backup line
A `%BACKUP%` entry is `path\tmd5`, and the parser indexed the second field
without checking the split produced one. A line with no tab panics. The database
is attacker-controlled, and while the task executor recovers, it recovers at task
granularity, so one crafted line drops every Arch package from the SBOM.
The same loop also never checked the scanner's error. A field over the 1MB token
cap ends the scan, and the entry came back populated up to that field and empty
after it, with a nil error saying it was fine. That is the failure the mtree
bounds in this branch exist to avoid, two functions up in the same file.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs(arch): trim the comments added by this branch
the comments were carrying reasoning that belongs in the PR description rather
than the code. Kept the parts a future reader cannot recover from the code (the
cap sizing, why continuations are refused, why the byte check runs after the
parse) and cut the rest.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test(arch): generate the mtree bomb fixture instead of committing it
the fixture is a synthetic listing fully described by a line count and a
repeated line, but it landed as a committed gzip member, which shows neither and
leaves no way to rebuild it when maxMtreeLines moves. the two tests that walk
testdata/installed write it first now, and git ignores it.
the real pacman listings (gmp, tree-sitter) stay committed since those are
captured output rather than something a rule can reproduce.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct and simplify comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-14 19:59:20 +00:00
Juan and Alex Goodman
e6d364437a
feat(convert): passthrough-exact-format copies matching syft-json input unchanged ( #5279 )
...
* feat(convert): passthrough-exact-format copies matching syft-json input unchanged
When a syft-json input SBOM already exactly matches the requested output
format and schema version, `syft convert` can write the input bytes out
verbatim instead of decoding and re-encoding them. This avoids the lossy
round trip (and the associated cost) for callers that normalise SBOMs into
a target format without knowing up front whether the source already matches.
The behaviour is opt-in and configuration-only: it is enabled with
convert.passthrough-exact-format in the config file or the
SYFT_CONVERT_PASSTHROUGH_EXACT_FORMAT environment variable, and there is
deliberately no command-line flag, since it changes how every invocation in
a pipeline behaves rather than varying call by call. It defaults to off, so
existing behaviour is unchanged.
Pass-through applies only to syft-json input, and only when the document's
schema version is identical to the one this build of syft produces; any
other input is always converted. Outputs that do not match are still
converted, so a mixed set of `-o` values behaves as expected, and every
output is resolved and validated before anything is written. Pass-through
output is a byte-for-byte copy, so format options such as `format.pretty`
and `format.json.legacy` are not applied to it.
When the option is enabled a warning is logged stating so and noting the
syft-json-only scope, and a second warning is logged whenever an input is
found to match and the shortcut is actually taken.
The option lives under a `convert:` configuration section (options.Convert),
mirroring how attest scopes its own options. The description documents the
caveats above and notes that file-path input written with `-o <format>=<path>`
keeps memory minimal, whereas piped input or STDOUT output must hold the
whole document in memory.
Signed-off-by: juanjsebgarcia <github@juangarcia.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* perf(convert): stream pass-through output instead of buffering the input
Identify, copy, and decode the input through a seekable reader rather than
loading the whole document into memory first. File inputs are read in place
and pass-through output is an io.Copy from the file. STDIN is used in place
when it is a redirected regular file. A pipe or terminal cannot seek, so its
contents are drained into an internal/spillbuf buffer: the first 1MB stays in
memory and the rest goes to a temp file under the user's TMPDIR (created
lazily, only when something actually spills), giving a seekable view without
ever holding the document in memory. The temp dir is rooted per invocation
via internal/tmpdir, honouring one already attached to the context, and is
removed when the command returns.
Writing pass-through output over the input file itself is now a no-op rather
than truncating the file before it is copied.
Measured on a 1GB syft-json document (Apple M1 Max), file in, file out:
origin/main full re-encode 86.3s wall 99s CPU 12.0GB max RSS
in-memory pass-through 7.4s wall 6.7s CPU 4.2GB max RSS
streaming pass-through 7.0s wall 6.9s CPU 3.1GB max RSS
and the same 1GB document piped over STDIN with pass-through enabled:
io.ReadAll into memory 1.3s wall 0.8s CPU 2.7GB max RSS
spill buffer 1.8s wall 1.0s CPU 66MB max RSS
The remaining cost of the streaming pass-through is entirely format.Identify,
which for syft-json decodes the whole document through a json.Decoder that
buffers the full value: measured alone it takes 7.1s and 3.1GB on the same
input. Reducing that further belongs to the format package.
Signed-off-by: juanjsebgarcia <github@juangarcia.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* perf(syftjson): identify documents from their tail instead of a full parse
syft always writes the schema block as the last key of a syft-json document,
so the format and version can be read from the final bytes of the file. The
syft-json decoder's Identify now reads at most 2MB from the end of a seekable
input, finds the last "schema" key there, and verifies it sits directly within
the top-level object by scanning the remaining bytes for the single closing
brace of the document. Anything the tail cannot vouch for (non-seekable input,
a reordered document, a nested key) falls back to the existing full parse, so
behaviour is unchanged for documents the fast path declines.
The verification is position-independent: it also accepts documents whose
keys have been reordered so that other small keys follow schema. It rejects
nested schema objects, array-wrapped documents, truncated input, trailing
content, and schema text inside strings.
Supporting changes:
- the offset-aware reader the decoder collection hands to decoders now
supports io.SeekEnd, which the tail read requires
- model.Document documents that Schema must remain its last field, and a
test guards that the encoder writes it last in both compact and pretty
output
- the decoder list documents that syft-json must stay first
Since Decode calls Identify before parsing, this also removes one of the two
full parses every syft-json conversion used to perform.
Measured on a 1GB syft-json document (Apple M1 Max), file in, file out:
pass-through, previous commit 7.0s wall 6.9s CPU 3.1GB max RSS
pass-through, this commit 0.85s wall 0.05s CPU 66MB max RSS
full re-encode, previous commit 85.3s wall 99s CPU 11.5GB max RSS
full re-encode, this commit 75.2s wall 91s CPU 9.9GB max RSS
Signed-off-by: juanjsebgarcia <github@juangarcia.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(syftjson): only identify from the tail when the document starts where the reader does
The tail scan vouched for the last 2MB, but nothing checked those bytes belonged to the
document the reader was pointed at. So `Identify` started claiming syft-json for files it
cannot decode: a document with a byte order mark or a stray log line in front of it, or a
syft document sitting after something else in the same stream, where `format.Decode` went
on to return an empty SBOM with a nil error.
Two O(1) checks:
- the first non-space byte at the reader's position has to be `{`
- `Decode` errors when the parsed document has no `schema.version`, instead of handing back
the empty document it decoded into
Streams holding several concatenated documents are deliberately not detected. Proving there
is exactly one top-level value means reading all of it, which is the cost the tail path
exists to avoid, so `Identify` can still name a later document's version on such a file.
`Decode` reports what it actually parsed.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(convert): recognize the input file by identity rather than by path
`convert - -o syft-json=sbom.json < sbom.json` truncated the file and exited 0. The
passthrough guard compared paths, and a shell redirect does not have one, so it was blind to
the one input mode where the truncation was silent.
`openConvertInput` now returns the input's `os.FileInfo`, which the STDIN branch already had
from its `Stat`, and `isSameFile` compares that instead.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: juanjsebgarcia <github@juangarcia.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-14 14:33:03 -04:00
Alex Goodman
c55e1cf2fd
Fix: graalvm unbounded allocation ( #5291 )
...
* fix(java): bound user-controlled reads in the graalvm native-image cataloger
Sizes, offsets and lengths in a native-image binary all come from the file
being parsed, and several were acted on directly.
The PE export directory sized a `make([]byte, Size)` from a uint32 in the
optional header, so an 8KB file claiming 4GB reserved 4GB before reading a
byte. It now reads what the file actually holds, bounded by the declared size,
and still requires the whole directory to be present. This also fixes a latent
bug: `unionreader.readerAtAdapter.ReadAt` can return a short read with a nil
error, and the old code discarded the count, so squashfs-sourced binaries could
parse zero padding as export data.
The bounds checks in `decompressSbom` and the PE export walk validated only the
end of a range, computed by adding to a value out of the file. Those sums wrap,
and a wrapped sum compares as in range while the slice that follows it panics.
They now subtract from the known-good length instead. The three
`address - sectionBase` subtractions are unsigned and underflowed on an address
below the base; they share one guarded helper now.
The embedded SBOM decompresses through an `io.LimitedReader`, since the
compressed bytes are bounded by the file but what they expand to is not. The
limit is checked before the decoder's own error, which would otherwise report a
size problem as "not a cyclonedx json document". Hitting it is logged, since
the caller reports parse failures at trace level and a dropped SBOM would
otherwise go unnoticed.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(java): stop at the first format that parses a native image
The format loop tried ELF, Mach-O and PE against every reader and kept going
after one of them parsed, so a file that parses as more than one format
contributes its packages once per format.
No input parses as two formats today, so this is not a behavior change in
practice: `debug/pe` rejects an ELF on the optional-header magic, and both
`debug/elf` and `debug/macho` reject anything without their own magic. It
removes the possibility rather than a live bug.
Note this does not deduplicate across readers, which is the outer loop: a
universal Mach-O carrying the same native image for two architectures still
yields its packages twice.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(java): bound the graalvm export directory read against the file
Follow-up to the hardening earlier in this branch, from review.
The export directory read was still bounded only by file size, so a large
mostly-empty file (cheap to ship inside a compressed layer) was read into
memory in full and then discarded. It now weighs the declared size against an
absolute cap and against the bytes really present before allocating anything,
matching `readDataFromRVA` in `syft/pkg/cataloger/internal/dotnet/pe`. A 64MB
file declaring a 4GB export directory went from ~140MB allocated to ~3.6KB.
Also from the same review:
- dropped the decompressed-SBOM ceiling from 100MB to 16MB. Decoding costs
roughly 48x the JSON size in allocation and 6x retained, so the old ceiling
was worth several GB of churn per file, and catalogers run concurrently.
- `symbolOffsets` is now single-address `symbolOffset`. Two same-typed address
arguments in a row could be transposed at a call site and would produce a
silently wrong SBOM rather than an error.
- `newMachO` now returns an error on a real read failure. It was falling
through and dropping the file with no error and no log at all.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(java): reject a short read of the graalvm export directory
Second round of review on this branch.
The export directory read introduced earlier in the branch only consulted the
byte count when `ReadAt` also returned an error, so a reader handing back fewer
bytes with a nil error was accepted and the tail of the buffer stayed zeroed,
then got parsed as a valid export directory. The count decides now, whatever
the error says. `io.ReadFull` would also cover it but spins forever on a reader
that keeps answering `(0, nil)`, which is the same hostile input this is meant
to reject, so the single read stays.
Also in here:
- the decompressed SBOM is buffered and size-checked before the decoder is
invoked, instead of inferring the overrun from `io.LimitedReader.N` after the
fact. That check was only correct because the cyclonedx decoder happens to
drain its reader before parsing, and nothing would have caught it if that
changed.
- four bounds guards, the `newMachO` error path and the SBOM ceiling had no
test that failed when they were removed. They do now, verified by deleting
each one and watching a named test go red. The ceiling in particular could be
raised to 2GB with the suite still green, since every case derived its sizes
from the constant.
- `nativeImagePE.reader` is dead now that the read takes the reader as an
argument.
- three comments claimed guarantees the code does not make: that `symbolOffset`
cannot be called with transposed arguments, that a rejected file cannot go
unrecorded when it is only logged at trace level, and a set of measured
allocation multipliers that nothing pins.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore(java): trim the graalvm cataloger comments
Comment pass over everything this branch added. Cut about a quarter of the
comment lines, mostly restatement and detail that was never going to stay true.
Dropped: a production comment naming a test, the measured allocation multiples
behind the two size ceilings, cross-references to the equivalent constants in
`dotnet/pe` and `elfutil`, and test docs that restated their own test name
before saying anything.
Kept the parts that fail silently if someone tidies them away: why the read is
a single `ReadAt` rather than `io.ReadFull`, the note that `readExportDirectory`
uses an RVA directly as a file offset, and the fixture notes explaining why a
`VirtualAddress` is deliberately huge or why no symbol sits at index 0.
Three that were stale rather than verbose:
- `nativeImagePE`'s doc still said it holds the underlying reader, which this
branch deleted.
- `TestFetchSbomSymbols_FindsAllThreeSymbols`' doc had ended up above
`TestFetchSbomSymbols_AddressBaseOutOfRangeGuard`, documenting the wrong
function.
- a comment referenced a commit sha that no longer exists on this branch.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-14 13:49:19 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
356e601cd5
chore(deps): update CPE dictionary index ( #5290 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-09-14 09:30:19 -04:00
dependabot[bot]
ee05a595b6
chore(deps): bump github.com/hashicorp/go-getter from 1.8.8 to 1.8.9 ( #5272 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.8 to 1.8.9.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.8...v1.8.9 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 21:46:07 +00:00
dependabot[bot]
05c6817c07
chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 ( #5262 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.83.1 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.1...v1.83.2 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 21:28:05 +00:00
Alex Goodman
d85c72a08e
fix: harden .NET PE/ELF parsing against malformed binaries ( #5267 )
...
* fix(dotnet): bound the bundle signature search by the file, not the headers
The single-file bundle marker search sized its buffer from `calculatePEEndOffset` /
`calculateELFEndOffset`, both of which sum user-controlled header fields. A tiny file
declaring 4GB sections drove an 8.6GB allocation, and on the ELF side the sum could
overflow negative and panic in `make`.
The search now clamps its window to the real file length before sizing anything. The PE
and ELF paths had grown two copies of the same find-and-read sequence, so they collapse
into one `bundle.ExtractDepsJSON`, which lets the signature search and the header reader
both go unexported.
Also guards `read7BitEncodedInt` against returning a negative length, which on a 32-bit
`int` would seek a manifest walk backwards and re-read the same bytes per declared file.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(dotnet): stop a truncated version resource from spinning forever
`readIntoStruct` reported a truncated read as success and left the destination struct
zeroed. Its callers advance their loop counters by the offsets it updates, so the string
table loop consumed nothing, advanced nothing, and never reached its length bound: a
version resource whose header claims more content than the blob carries hung the parse.
A truncated read is now an error, and the two places where hitting the end of a blob is
normal say so explicitly. That distinction is what keeps a well-formed resource whose last
child is `VarFileInfo` from losing its `FileVersion` fallback. io.EOF and
io.ErrUnexpectedEOF mean the same thing here, so both take the same path.
The string table walk moves into its own function, since the two new arms put
`parseVersionResourceSection` over the funlen limit.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(dotnet): bound PE resource parsing by what the file actually holds
Resource sizes and RVAs are user-controlled uint32s that sized buffers before anything
checked the file held that many bytes, so a small crafted section could reserve up to 4GB.
The walk now carries the section's reader and its base RVA for its whole lifetime, so
`reader.Size()` is the single authoritative bound and one `offsetOf` helper rejects every
RVA the section does not hold. That replaces the per-node section value the recursion used
to synthesize, whose size argument was only correct by convention.
Bounding the allocations alone turns the OOM into a hang, though: nothing in the format
stops entries from aliasing, so thousands of them may name one fat blob and every offset
still checks out. A 256KB section built that way drove 24GB of allocation over two minutes
with peak memory flat. Capping entry *count* does not help since the cost is per byte read,
so the walk now charges every read against a budget of a few times the section size. Real
binaries come in at about 1x, since a well-formed section's entries partition it.
A resource tree that stops early no longer fails the whole file. It says nothing about the
CLR directory or an embedded deps.json, and dropping the package from the SBOM over one
malformed section is worse than reporting the fields we did get.
Also widens the entry counts before summing them (two uint16s can sum past 0xFFFF and wrap),
and bounds the name length and section header count against the reader for the same reason.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(dotnet): bound resource recursion depth and cap declared sizes absolutely
Review follow-ups on this branch. The headline one is a real crash: the resource
walk had no depth bound, and the `budget` comment claiming depth "falls out for
free" was wrong, since the budget scales with the section while the stack does
not. A chain of directories at distinct RVAs (which the `dirs` set does not
catch) recursed until the goroutine stack gave out. A 13.7MB crafted PE took the
whole process down with `fatal error: stack overflow`, which is unrecoverable,
so unlike every other bug on this branch no caller could log-and-continue past
it. Now capped at 32 levels, versus the 3 the format actually uses.
The other bounds moved from "the file" to a real ceiling. Clamping an allocation
to the bytes remaining in the file is not enough on its own: a mostly empty file
costs almost nothing inside a compressed layer, so a cheap artifact could still
authorize a multi-gigabyte read. Both the PE data directories and the bundle
marker search now cap the same way `elfutil` already does.
Also hardened in the bundle reader:
- `headerOffset` is validated against the file. It comes straight out of the
file bytes and everything downstream seeks to it, so it was the least
trustworthy value in there and the only one not being checked.
- a manifest entry count that could not fit in the remaining bytes is rejected
rather than walked for hundreds of millions of reads.
- a non-positive `searchLimit` falls back to the whole file instead of reading
nothing. It is only ever an optimization hint, so treating it as authoritative
let one bogus ELF `p_offset` hide a bundle from us entirely.
- a short read no longer aborts the search. `unionreader` can return fewer bytes
than the file reports, and the marker may well be in what we did get.
`pe.Read` now reports partial parses instead of choosing between dropping the
package and hiding the problem. It was inconsistent: a malformed resource tree
was non-fatal while an unreadable resource *section* one call away was fatal, and
the non-fatal path only reached a trace log, so the unknowns task could not see
that a file had been cataloged on incomplete evidence. Both now land on a new
`File.ParseErr`, which the dotnet and PE catalogers join into their unknowns and
still keep the package.
Worth noting for changelog purposes: the `isTruncated` guard fixes a
user-visible bug beyond the hardening. A version resource leaving 1 to 5
trailing bytes cuts the next struct in half, which reports as
`io.ErrUnexpectedEOF` rather than `io.EOF`; that used to propagate out and skip
the `VS_FIXEDFILEINFO` fallback, so those binaries lost their version entirely.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(dotnet): treat a zero bundle offset as unbundled, not malformed
The apphost ships the 32-byte bundle signature compiled in with its 8-byte header
offset left as zero, and only `HostWriter.SetAsBundle` fills that slot in when you
publish as a single file. So a zero offset means "never bundled", which is what
every framework-dependent .NET executable looks like.
The bounds work on this branch folded that case in with the hostile ones, so the
most common shape a .NET binary takes started reporting a parse failure. It
surfaces through the PE cataloger rather than the dotnet one, since an apphost
carries no CLR metadata of its own: the package still comes out, with a spurious
unknown attached to it. `main` had this right and said so in a comment; the
regression is on this branch.
Reproduces on a fixture already in the repo. Of the 53 PE files in
`image-net8-app`, `/app/dotnetapp.exe` was the only one reporting anything, and
the whole image is clean again now.
The three outcomes are now distinct, since collapsing any two of them loses
something the caller needs: zero means there is no bundle, an error means we could
not tell, and a positive offset is the answer.
`Test_Read_DotNetDetection` gains the apphost and, more usefully, an assertion
that a well-formed binary reports no partial parse at all. That one line is what
would have caught this, and it now covers all six fixtures. The unit case that
pinned the old behavior asserted the bug, so it flips.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(dotnet): measure readers with the shared helper and report refusals
Two things, both about not re-deriving what the campaign already has.
`internal/file.ReaderSize` exists on `main` for exactly this job, and `upx.go`
already uses it. Its doc comment is the problem statement here almost verbatim: a
declared size is worth nothing until you weigh it against a byte count the reader
can actually back, which it does by reading the last byte. This branch was
hand-rolling `Seek(0, io.SeekEnd)` in three places, one of them reimplementing the
helper's save-and-restore dance verbatim, and then absorbing the reader-lies case
downstream by tolerating short reads.
Adopting it means the bundle reader and `readDataFromRVA` now take the reader
types they were always being handed (`unionreader.UnionReader` and `io.ReaderAt`),
and the reads move to `ReadAt`, which leaves the caller's cursor alone and drops
two seeks. Net effect is a smaller diff than what it replaces, and the case the
`shortReader` fake was invented for is now caught up front instead of tolerated:
the fake was modeling a lie about length, which is not what a short squashfs read
actually does. It now models the real shape (honest length, read stops early) and
a second reader covers the lie.
Three places also still returned "there is nothing here" when what they meant was
"I could not tell", which is the thing `File.ParseErr` was added to stop:
- an ELF that `elfutil` refused to parse read as "not an ELF". `ErrDeclaredSizeExceeded`
is exported precisely so a refusal can be told apart from a broken file, and the
caller upstream already turns an error into an unknown.
- a `deps.json` past the 3MB cap returned "". That is the file's entire dependency
list, so this handed back an SBOM that looked complete and silently was not.
- the marker search clamped at 512MB and then reported no bundle. It cannot claim
there is no bundle when it declined to look everywhere one could be, so a miss
after clamping is now an error.
`readSizeRecorder` records `ReadAt` alongside `Read`, or the allocation-bound tests
would have quietly stopped measuring anything.
Also renames `findSignatureOffset` back to `findBundleHeaderOffset`, since it
returns a header offset and reading it as "no signature" is what the last bug was,
and fixes the stale `ExtractDepsJSONFromBundle` doc comment.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test(dotnet): assert allocation sizes directly in the bundle search guards
The PE and ELF search guards asserted the largest read the reader was asked for.
That happened to track the allocation, since the whole buffer goes to ReadAt, but
nothing said so. Both now measure the bytes allocated with the same `measureAlloc`
helper the resource guards use, and keep the read-size check as a separate claim.
Also names the reason a reader can report a size it cannot back: `debug/elf` and
`debug/pe` hand out `io.NewSectionReader(r, 0, 1<<63-1)`, whose `Size()` is nominal
rather than measured, so answering a size is not on its own evidence the bytes are
there. Renames `lyingReader` to `unbackedSizeReader` and regroups the two reader
implementations, which had their methods interleaved.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-11 21:25:10 +00:00
dependabot[bot]
1ca1fa73d3
chore(deps): bump github.com/gpustack/gguf-parser-go ( #5274 )
...
Bumps [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go ) from 0.26.0 to 0.26.3.
- [Release notes](https://github.com/gpustack/gguf-parser-go/releases )
- [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.26.0...v0.26.3 )
---
updated-dependencies:
- dependency-name: github.com/gpustack/gguf-parser-go
dependency-version: 0.26.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 21:11:53 +00:00
dependabot[bot]
a675c81143
chore(deps): bump modernc.org/sqlite from 1.57.0 to 1.58.0 ( #5278 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.57.0 to 1.58.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.57.0...v1.58.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.58.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 21:11:47 +00:00
dependabot[bot]
875daec82b
chore(deps): bump github.com/google/go-containerregistry ( #5275 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.22.0 to 0.22.1.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.22.0...v0.22.1 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.22.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 21:11:44 +00:00
Juan
fb59c4e65c
perf(spdx): make findRootPackages linear instead of packages x relationships ( #5280 )
...
Decoding an SPDX document into the syft model was quadratic in document
size. findRootPackages (spdxhelpers/to_syft_model.go), which locates the
packages the document DESCRIBES, scanned every relationship for every
package. On a 119MB SPDX JSON document (70,701 packages, 153,301
relationships) that is 1.1e10 comparisons and 91% of all CPU samples; on a
238MB document it is 4.3e10 comparisons and 95%. A 1.3GB document did not
finish in 91 minutes. Everything else on the decode path is map-indexed and
linear, and spdx/tools-golang's own parse is linear (4.5s and 9.3s for the
two documents above). The scan dates from 9480f10cgithub@juangarcia.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-11 21:11:21 +00:00
Alex Goodman
c4800b2393
Fix slow pe tests ( #5285 )
...
* test(dotnet): speed up pe fixture tests
the pe package took ~90s under -race, nearly all of it loading docker archive
fixtures. two things:
the three bundle fixtures published with `SelfContained=true`, so each `hello.exe`
carried a full .NET runtime (~60MB, 33MB tar). the bundle format is what those
fixtures exercise and it is identical framework-dependent, so they now publish
with `SelfContained=false` (160KB exe, 2MB tar). the race detector multiplies the
layer inflate + diffID hashing by ~15x, which is why the size mattered so much.
`fixtureFile` also loaded the image and built a squashed resolver per table row,
so `image-net8-app` was loaded four times for four files in it. resolvers are now
built once per distinct fixture from the parent test.
87s -> 28.5s under -race, and ~60MB less fixture cache.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(dotnet): read the right file type from V1 single-file bundles
V1 bundles (.NET Core 3.x) predate the `unknown` member at the head of the
manifest file type enum, so their types are all one less than V2+: deps.json is
2, runtimeconfig.json is 3. we were matching on the V2+ value, which silently
matched runtimeconfig.json instead, so every .NET Core 3.x single-file app
reported its runtimeconfig as the embedded deps.json and its dependencies went
unseen.
the existing fixture test asserted the buggy output (it expected
`runtimeOptions`, which only ever appears in a runtimeconfig). the assertions
now pin the framework moniker out of each fixture's real deps.json, so reading
the neighboring file can't pass.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test(dotnet): drop the 64MB jruby binary from the net8-app fixture
the `image-net8-app` fixture wget'd a 64MB jruby release binary at build time to
serve as "a PE that is not a .NET binary", which was 64MB of the image's 65MB.
every test that loads that image pays for it, in both the dotnet cataloger and
the pe package, and it sits in the fixture cache twice.
the same jruby binary already has its own fixture in the binary cataloger
(`image-jruby`), asserted through the same `pe.Read`, so the coverage is not
lost. the negative case here now uses `/app/dotnetapp.exe` -- the native apphost
that is already in the image -- which pairs nicely with the single file case,
same apphost with the app bundled in and CLR evidence present.
also drops a github release download from the fixture build.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-11 15:27:20 -04:00
Alex Goodman
eb58f698bd
Fix oom when running unit tests in CI ( #5284 )
...
* fix oom when testing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* right-size CI test runners
the `r` family and `ram=32+128` were sized for the tmpfs footprint rather
than the workload. with the caches back on disk the build+test peak fits in
16GB, so move to `m`/`c` at `ram=16+32`.
- ~27% cheaper per instance-hour on spot, and a much deeper pool to schedule
against (~20 x86 types vs 7)
- `cpu=4+8` with `ram=16+32` lets price-capacity-optimized opportunistically
land an 8 vCPU box when it's cheap
- plain `volume=100gb` replaces the provisioned throughput. a 4 vCPU instance
caps near 150MB/s of EBS and gp3's free baseline is already 125MB/s, so the
override bought nothing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-11 14:58:30 -04:00
Alex Goodman
de98400c39
fix(test): drop apt from java-no-main-package fixture ( #5283 )
...
the base image is digest-pinned to a bullseye snapshot whose InRelease has
expired, so `apt-get update` now exits 100 on any cold fixture build. rather
than disable Check-Valid-Until (which just delays the next break), skip apt
entirely:
- `less` was never used and `unzip` already ships in the base image
- rezip with `jar cfM` from the base JDK instead of installing `zip`
the `-M` matters here: this fixture intentionally has no META-INF/MANIFEST.MF,
and plain `jar cf` would generate one.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-11 14:44:45 -04:00
Alex Goodman
9e520d1442
fix(test): use immutable URL for dpkg archive fixture ( #5282 )
...
`archive.ubuntu.com/ubuntu/pool/main` only keeps the current version of a
package, so the pinned `zlib1g 1:1.3.dfsg-3.1ubuntu2.1` URL started 404ing.
`curl` without `-f` wrote the error page into `zlib1g.deb` and exited 0, so
the fixture image built clean and just contained a non-deb, failing
`TestDpkgArchiveCataloger` only when the fixture cache was cold.
Now points at the launchpad `+files` URL, which is immutable. Also added `-f`
to the other fixture Dockerfiles that curl a pinned artifact so the next bit
of URL rot fails the build instead of quietly poisoning a fixture.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-11 13:45:16 -04:00
dependabot[bot]
3ec2e33d73
chore(deps): bump github.com/klauspost/compress from 1.19.2 to 1.20.0 ( #5276 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.19.2 to 1.20.0.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.19.2...v1.20.0 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 14:34:14 +00:00
dependabot[bot]
40a4ec72b9
chore(deps): bump golang.org/x/time from 0.15.0 to 0.16.0 ( #5273 )
...
Bumps [golang.org/x/time](https://github.com/golang/time ) from 0.15.0 to 0.16.0.
- [Commits](https://github.com/golang/time/compare/v0.15.0...v0.16.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/time
dependency-version: 0.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 13:57:52 +00:00
dependabot[bot]
268897ca82
chore(deps): bump zizmorcore/zizmor-action from 0.6.2 to 0.6.3 ( #5270 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.6.2 to 0.6.3.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/3dc1ecc9bcb9e94e9b2c709687979e1298497054...70fb788f84895a7701f5643d103d587e460b5c99 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 13:53:48 +00:00
dependabot[bot]
031de8ddab
chore(deps): bump golang.org/x/mod from 0.40.0 to 0.41.0 ( #5271 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.40.0 to 0.41.0.
- [Commits](https://github.com/golang/mod/compare/v0.40.0...v0.41.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-11 13:34:10 +00:00
Alex Goodman
1d25dfe4da
fix(golang): bound allocations from UPX-packed binary headers ( #5195 )
...
* fix(golang): bound UPX decompression by what the input can justify
A UPX block's `sz_unc` was passed straight to `make([]byte, n)`, so four bytes of
attacker input spanned the full uint32 range. A ~300KB file could drive multi-GB
resident memory, which Go reports as a fatal runtime OOM that no `recover` on this
path can contain. Syft parses binaries out of arbitrary images, so that is reachable
from any scan.
Two bounds do the work, and UPX's own invariants make them exact:
- all blocks together reconstruct `p_filesize`, so a running remainder caps the sum.
Bounding only per-block would leave the total at (block count x original size), so
the remainder is the part that actually closes it
- `p_filesize` sizes the output buffer, so it is capped both absolutely and against
the size of the file on disk. The absolute cap alone left a ~60 byte header able to
claim 500MB; the ratio alone cannot work either, since LZMA encodes a run of N
equal bytes in O(log N) and a `go:embed` of 120MB of zeros legitimately packs 209x
The output buffer is also allocated on the first block that survives validation
rather than up front, so a header claiming a large size with nothing decodable behind
it costs nothing.
Alongside that, several ways the block loop could be steered off its own buffer:
- `parseELFPTLoadOffsets` bounds-checked program headers with `phStart+phentsize >
len(buf)`, which overflows for a `p_offset` near 2^64 and lets an out-of-range entry
through into a slice index. Switched to the subtraction form, and a `phentsize`
shorter than an ELF64 program header is rejected since the reads use fixed offsets
- block placement had the same overflow shape, and on failure it skipped the copy and
fell through. `outputOffset` derives from the rejected offset, so a `p_offset` at the
uint64 ceiling wrapped it to 0 and the next block landed on the reconstructed ELF
header, still returning success. Out-of-range placement now ends the block chain,
keeping the blocks already placed since those often carry `.go.buildinfo`
- the UPX 2-byte LZMA header carries `lc`/`lp` as nibbles and `pb` as three bits, so
they can hold values LZMA does not permit. Folded into the props byte they wrap
(`lc=15, lp=15, pb=7` gives 465, which truncates to 209) and the stream mis-decodes
instead of failing
- blocks decode directly into a slice of the output buffer instead of a per-block
buffer that is then copied, so one block no longer doubles peak memory
- the block count is capped: the size budget alone still allows millions of 12-byte
blocks, each spinning up an LZMA reader
Verified against the `image-small-upx` fixture, a real `upx --best --lzma` binary:
four blocks, max `sz_unc` equal to `p_blocksize` exactly, blocks summing to 0.68 of
`p_filesize`, and a 1.96x expansion against the packed file, so every bound holds with
headroom on genuine output.
Note `p_blocksize` is deliberately not used as a ceiling on `sz_unc`. It adds nothing
the remainder does not already cover, and real output sits at exactly `p_blocksize`,
so it would run with zero headroom against a value the format does not promise.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(golang): report UPX binaries we cannot unpack as unknowns
A packed Go binary we fail to unpack means its packages are silently missing from the
SBOM. `getBuildInfo` checked the decompression error for nil and discarded it, so a
rejected file surfaced only the original `buildinfo.Read` error, and that one is
deliberately silenced because it is usually just "not a Go binary".
`decompressUPX` now marks the cases worth reporting with `errUPXDecompress`: it got
past the header and the method dispatch and still could not unpack the file. Everything
else stays quiet, which matters more than it sounds. `upx` defaults to NRV2B unless
`--lzma` is passed and only LZMA is implemented here, so treating any decompression
failure as reportable would attach a golang-cataloger unknown to every packed non-Go
binary in an image. Making the reportable case opt in rather than the quiet case a
growing list also means a guard added later is silent by default.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor(golang): drop the vendored xcoff parser
The only thing the golang cataloger read from it was `TargetMachine`, which is the same
two magic bytes `getGOARCHFromBin` had already matched on to dispatch there. So a full
XCOFF walk (string table, symbol table, every relocation table) ran to recover a value
that was already in hand.
`getGOARCHFromBin` reads those two bytes directly now. That is also strictly more
correct: `xcoff.NewFile` bailed with "no symbol table" when `symptr == 0`, so a stripped
XCOFF binary reported no arch at all.
Fixtures move to `testdata/xcoff/`, since they are no longer a package's own testdata.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat(internal/file): report a reader's real size behind one helper
Bounds get written as "does this claim exceed what the reader actually holds", and the
subtlety is that a reader's own answer cannot be trusted: an `io.SectionReader` reports
the nominal length it was built with, so one constructed with `1<<63-1` will happily
claim to hold 8EB. Confirming the last byte is readable is what separates a real size
from a nominal one.
Returns `(int64, bool)` rather than a bare size, since there are five ways to not know
and collapsing them to 0 makes every caller reinvent "0 means stop bounding".
The doc also names the wrapper trap: a type embedding `io.ReaderAt` as an interface
promotes only `ReadAt`, so it answers no size at all however large the reader beneath it
is, and a bound written against it silently does nothing.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(golang): bound every section a reader can expand, not just the name table
`CheckSectionNameTable` bounds the one section `elf.NewFile` expands while parsing, which
is enough for a caller that only parses. It is not enough for one that goes on to read
sections: those are expanded lazily, so a 260KB ELF declaring a compressed `.symtab`
drove 1.3GB of allocation through `goversion`, which opens the file with `debug/elf`
inside its own package and cannot be routed through `elfutil.NewFile`.
`CheckAllSections` is that gate, and is deliberately named as the superset so the
relationship to the narrow one is structural rather than documented.
Also exports `ErrDeclaredSizeExceeded`. A refusal here costs the SBOM a package, so
callers report it as an unknown, and matching on an error string to decide that is not
something to build a reporting policy on.
A ruleguard rule now flags `buildinfo.Read` and `version.ReadExeFromReader` outside
`scan_binary.go`. Both open `debug/elf` internally and are only bounded there by the
wrappers that gate the reader first, which the existing rule on `elf.NewFile` could not
see through.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat(internal/spillbuf): sparse offset-addressed buffer that spills to disk
For output that arrives out of order, at offsets the input itself declares: a
decompressor placing extents, an archive rebuilding a file from chunks. A plain `[]byte`
cannot do that without either pre-sizing to a length the input claims or growing to the
furthest offset it names, and both hand a hostile input an allocation knob.
The load-bearing property is that it reports only what it actually stored. `Size` is the
contiguous run written from offset zero and a read past it is `io.EOF`, never the zeros
an unwritten region would hand back for free. Sparse storage serving holes as real
content is what lets a write offset stand in for output nothing produced, so anything
sizing an allocation against this reader (`saferio` in `debug/elf` does exactly that)
stays bounded by work actually done.
`FirstGap` answers where the next write fits, so callers filling holes do not need the
extent bookkeeping and cannot re-derive that rule wrongly, and it only reports gaps
lying entirely inside `[0, within)`. The extent type is unexported for the same reason.
The rest of the contract worth stating: reads and writes after `Close` fail with
`os.ErrClosed` rather than looking like an empty buffer, and a write that fails leaves
the buffer unchanged.
Memory is bounded by the limit rather than by how much is written: filling 1MB and
filling 64MB cost about the same. What lands on disk past that limit is the caller's
bound to set, not this package's. Growth is geometric and capped, because sizing the
tier to exactly what each write needs is quadratic once a caller streams through it in
small chunks.
The golang cataloger is the only consumer today, and nothing else in the tree has this
shape.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(golang): rebuild UPX binaries through spillbuf and read the reconstruction everywhere
Two amplification paths were still reachable. A 128 byte input allocated 16MB by
trusting `sz_cpr` before weighing it against the bytes the file actually holds, and the
reconstruction was assembled in a `[]byte` sized from the header's declared original
size, so a 301KB input allocated 300MB.
The reconstruction is a `spillbuf.Buffer` now, which is what makes the second one go
away: blocks are placed at the offsets the file declares, nothing is pre-sized from a
claim, and the reader's length is the contiguous run actually rebuilt. That last part is
the invariant everything downstream leans on. A reader reporting the declared size would
serve the holes between placed blocks as zeros it never stored, and a 64 byte block
parked at `p_filesize-64` then made a 300KB input hand out a 64MB reader: measured, that
drove 269MB through `getBuildInfo` and returned nothing, silently.
Placement and storage are separate concerns. `upx.go` places blocks at the offsets the
file declares and asks the buffer how much was rebuilt and where the next gap is; it
knows nothing about temp files or memory limits.
The remaining bounds are ratios against the input wherever they can be, since an
absolute ceiling only ever drops a large legitimate binary. The one absolute left is on
`p_filesize`, because padding an input is nearly free, and the LZMA dictionary is paid
for in its own block's `sz_cpr`.
Interface change: `scanFile` takes a context and hands back the reconstruction for each
binary that turned out to be packed, and the caller owns it. Everything after the build
info read (crypto settings, arch, symbols, the version scan) reads it, so a packed
binary no longer reports its packages with no symbols at all.
Also narrows what gets reported. This cataloger runs on every executable in an image, so
reporting every `getBuildInfo` error attached an unknown to every corrupt ELF, odd PE and
non-Go Mach-O slice in it. Now only four gaps, the ones that cost the SBOM something
syft could have had: a packed file we could not decode (`errUPXDecompress`), a header
the size bounds refused (`errUPXSizeRefused`), a reconstruction that came up short
(`errUPXPartial`), and an ELF expansion `elfutil` declined
(`ErrDeclaredSizeExceeded`). An unimplemented UPX method stays quiet on purpose: `upx`
defaults to NRV2B and only LZMA is implemented here, so reporting it would attach an
unknown to most packed non-Go binaries in an image.
That filtering is a new pattern. No other cataloger picks which of its errors become
unknowns, and the reason this one does is that it runs on every executable in an image
rather than on files a glob already selected.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: ignore local spec/ planning notes
`/specs` was already ignored; `/spec` is the same thing under the singular name and was
not, so working notes landed in commits.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor(golang): name what the unpack hands back, not where it stores it
the scan's signatures said `*spillbuf.Buffer` all the way down, which told
every reader below the scan that it cares whether the reconstruction lives in
memory or on disk. it does not. two interfaces instead, each naming only what
its side actually uses:
- `unpackedContents` for the consumers: `ReaderAt`, `Closer`, and a `Size` that
is the contiguous run rebuilt from zero
- `blockSink` for the decoder, which additionally needs `WriterAt` and
`FirstGap` to place blocks
this costs one thing worth flagging. `Close` on a nil `*spillbuf.Buffer` was
nil-safe, so callers just deferred it; widened into an interface, a nil pointer
becomes a non-nil interface and the same call panics. `closeUnpacked` absorbs
that, and it is now the only way an owner releases contents. `readerFor`,
`seekerFor` and `closeUnpacked` are the three places that resolve the nil.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs(elfutil): say that CheckAllSections is the decompression-bomb gate
the doc led with "bounds every section syft can drive debug/elf into
decompressing", which describes the mechanism without ever naming what it is
defending against. a reader landing on the call site could not tell that this
is the decompression-bomb check.
state the attack instead: a compressed section header declares its own
decompressed size, debug/elf believes that number and allocates it on open, and
nothing forces it to match what the compressed bytes actually yield. the 260KB
ELF that drove 1.3GB of allocation now lives in the doc rather than only at the
one call site that happened to mention it.
comments only.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs(golang): move the overflow note onto the bounds test it describes
the "subtraction form" note sat above the phStart assignment with ten lines of
wrap analysis between it and the `if` it was talking about, so the subtraction
it names reads as missing. it is `hdrLen-phStart < phentsize`.
move it onto that test and name the form it is avoiding (`phStart+phentsize >
hdrLen`, which can overflow past the buffer end) so the referent is not several
paragraphs away.
comments only.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore(golang): drop the internal/ README left over from xcoff
that README existed to record where the vendored xcoff package came from and
that Go keeps it internal, which is a provenance note worth having while
third-party code sat there. dropping xcoff took the reason with it, and
repurposing it to point at gotestdata just made it redundant: gotestdata has
its own README covering why it is under internal/, why it is not testdata/, and
what belongs in each.
internal/ now holds one self-documenting directory.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-10 09:21:19 -04:00
dependabot[bot]
0c049806bd
chore(deps): bump github.com/containerd/containerd/v2 ( #5265 )
...
Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v2.3.4...v2.3.5 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
dependency-version: 2.3.5
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-10 02:29:44 +00:00
Alex Goodman
9addda3da5
fix(test): pull elf fixture build tools from archive.debian.org ( #5264 )
...
bullseye went EOL and deb.debian.org dropped it, so the elf executable
fixture image stopped building and took the whole unit test job with it
(fixture generation runs before any test does). main has been red on this
since 2026-09-08.
two separate breakages, both handled here:
- the base repo moved to `archive.debian.org`, whose Release files are
permanently expired, so `Acquire::Check-Valid-Until=false` is required
- `bullseye-security` is worse off: its index is still served but every
package in the pool behind it 404s, and it has not landed on the archive
yet. dropping it is the only option right now. these are throwaway
fixture build tools, so base bullseye versions are fine.
verified by rebuilding the image and running the fixture `verify` target,
which still reports `PASS: all security features accounted for`.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-09-09 10:53:58 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
767c83d513
chore(deps): update CPE dictionary index ( #5256 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-09-08 11:22:39 -04:00
dependabot[bot]
392539dc28
chore(deps): bump github.com/CycloneDX/cyclonedx-go ( #5252 )
...
Bumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) from 0.11.0 to 0.12.0.
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.11.0...v0.12.0 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-version: 0.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-04 13:30:25 +00:00
dependabot[bot]
3dd674c53b
chore(deps): bump anchore/sbom-action from 0.24.0 to 0.24.2 ( #5250 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.24.0 to 0.24.2.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/e22c389904149dbc22b58101806040fa8d37a610...3ad7283483fc7af8ff2b4ea19663c2d5ca935e26 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.24.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-04 13:29:14 +00:00
dependabot[bot]
fd7517bbba
chore(deps): bump github.com/google/go-containerregistry ( #5251 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.21.9 to 0.22.0.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.21.9...v0.22.0 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.22.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-04 13:29:06 +00:00
Rez Moss
c935b71c9e
fixed java-archive-cataloger returns unknown ver for uber-jars , fixed #5163 ( #5164 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-09-03 16:09:20 -04:00
dependabot[bot]
77031752fa
chore(deps): bump google.golang.org/grpc from 1.83.0 to 1.83.1 ( #5245 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.83.0 to 1.83.1.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.83.0...v1.83.1 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.83.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-09-02 08:27:04 +00:00
Vaibhav Srivastava
12d5544b2a
docs: fix typo implmentation -> implementation ( #5243 )
...
Signed-off-by: Vaibhav Srivastava <vaibhavsri1712@gmail.com >
2026-08-31 17:21:05 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
cc13d1dbf1
chore(deps): update CPE dictionary index ( #5244 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-31 13:03:10 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
af937d74c0
chore(deps): update tool versions ( #5242 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-29 10:24:02 +00:00
dependabot[bot]
4017979670
chore(deps): bump docker/setup-buildx-action from 4.2.0 to 4.3.0 ( #5237 )
...
Bumps [docker/setup-buildx-action](https://github.com/docker/setup-buildx-action ) from 4.2.0 to 4.3.0.
- [Release notes](https://github.com/docker/setup-buildx-action/releases )
- [Commits](https://github.com/docker/setup-buildx-action/compare/bb05f3f5519dd87d3ba754cc423b652a5edd6d2c...37fe631027851001ddb9b187196cc803df7f5f0e )
---
updated-dependencies:
- dependency-name: docker/setup-buildx-action
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-28 13:33:27 +00:00
dependabot[bot]
82d273fac5
chore(deps): bump github.com/gpustack/gguf-parser-go ( #5239 )
...
Bumps [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go ) from 0.25.0 to 0.26.0.
- [Release notes](https://github.com/gpustack/gguf-parser-go/releases )
- [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.25.0...v0.26.0 )
---
updated-dependencies:
- dependency-name: github.com/gpustack/gguf-parser-go
dependency-version: 0.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-28 13:32:35 +00:00
dependabot[bot]
1417c1989b
chore(deps): bump modernc.org/sqlite from 1.56.0 to 1.57.0 ( #5238 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.56.0 to 1.57.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.56.0...v1.57.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-28 13:31:08 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
91a0032987
chore(deps): update anchore dependencies ( #5085 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-27 12:25:09 -04:00
Ankush Pathak
f91bf4528b
fix: correct Apache Derby group ID in purl generation ( #5090 )
...
Signed-off-by: Ankush Pathak <ankush.pathak@chainguard.dev >
2026-08-27 10:55:31 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
c5fc6998d3
chore(deps): update CPE dictionary index ( #5221 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-27 09:30:58 -04:00
Pujitha Paladugu and Pujitha Paladugu
d3734ddeb2
fix(binary): detect grafana security-patch release versions ( #5213 )
...
---------
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com >
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com >
2026-08-27 04:20:09 +00:00
Matt Van Horn and Christopher Phillips
bf82010f3c
fix(lua): skip rockspec with no package name ( #4825 )
...
---------
Signed-off-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-08-21 17:36:47 -04:00
Pujitha Paladugu and Pujitha Paladugu
7ca1f22395
fix(dotnet): correct inverted dependency-of relationship direction in packages.lock.json parser ( #5143 )
...
Fixes #5125
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com >
Co-authored-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com >
2026-08-21 18:53:45 +00:00
Sueun Cho and Christopher Phillips
93cf89363b
fix(rpm): keep the epoch when parsing RPM manifest packages ( #5201 )
...
---------
Signed-off-by: Sueun Cho <sueun.dev@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-08-21 14:47:23 -04:00
dependabot[bot]
34ef7dcbfe
chore(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 ( #5208 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.39.0 to 0.40.0.
- [Commits](https://github.com/golang/mod/compare/v0.39.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-21 13:50:49 +00:00
dependabot[bot]
29edf90038
chore(deps): bump github.com/hashicorp/go-getter from 1.8.6 to 1.8.8 ( #5207 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.6 to 1.8.8.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.6...v1.8.8 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-21 13:50:46 +00:00
dependabot[bot]
766907e6ed
chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 ( #5206 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.11.1 to 1.12.0.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.11.1...v1.12.0 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.12.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-21 13:29:57 +00:00
dependabot[bot]
e820f2d21a
chore(deps): bump golang.org/x/tools from 0.48.0 to 0.49.0 ( #5205 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.48.0 to 0.49.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.48.0...v0.49.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-21 13:29:25 +00:00
Alex Goodman
39c9c690df
fix: move image hardlink handling upstream during image indexing ( #5196 )
...
* chore(deps): pin stereoscope to the hardlink-inode-adoption branch
temporary pin to anchore/stereoscope#670 so the hardlink changes can be
exercised end to end. needs re-pinning to a release tag before merge.
pulls transitive bumps along with it: docker/cli, docker/go-connections and
gabriel-vasile/mimetype.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: drop the image resolver hardlink workaround
stereoscope now adopts a hardlink's target at index time, so a hardlinked name
arrives already described as a regular file with the target's size, mime type
and content. the resolver-side fix from #5029 sat on top of that doing the same
job a second time, gated on a file type that no longer shows up, so both
`resolveHardLinkTarget` implementations and the extra tree walk they cost on
every `FilesByPath` are gone.
`file.NewVirtualLocationFromImage` stays as-is. it is exported and syft is v1,
so it keeps working for anyone using it, it just has no callers in syft now.
this picks up `FilesByMIMEType`, which #5029 explicitly could not fix, so
hardlinked names now reach mime-driven catalogers. on images built around
multi-call binaries (busybox and friends) that is a lot more file and executable
entries than before; distro and toolchain images move by about one entry.
one shape regresses: a hardlink stereoscope could not adopt (a link name that is
absent, empty, names a directory, names another un-adopted link, or points into
a lower layer) keeps `TypeHardLink`, and syft goes back to collapsing it onto
its target's path. no mainstream builder emits the cross-layer case.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump stereoscope to main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-20 20:17:41 +00:00
addielarue
c4597a08a2
fix(file-resolver): don't abort scan on inaccessible symlink target ( #5170 )
...
Signed-off-by: addielarue <bhasmerutika@gmail.com >
2026-08-20 16:16:45 -04:00
Christopher Angelo Phillips
236755a6b1
fix(binary): gzip classifier & GNU gzip identity string ( #5202 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-08-20 16:02:14 -04:00
Alex Goodman
168eb64235
fix(javascript): pass a yaml node to the pnpm v5 collision test ( #5203 )
...
#5188 changed `pnpmV6LockYaml.Parse` to take a `*yaml.Node` and #5175 added
this test against the old `[]byte` signature. both were green on their own
branches, so main does not compile.
the v9 and v6 cases in the same test already go through the `yamlDocument`
helper, this is just the v5 one that was missed.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-20 16:01:52 -04:00
Xenira
490732aa58
fix(cpe): fix generated cpe for rust packages
...
---------
Signed-off-by: Xenira <1288524+Xenira@users.noreply.github.com >
2026-08-20 15:01:24 -04:00
Sueun Cho
fd4796b0d8
fix(python): keep epoch-pinned requirements in the SBOM ( #5161 )
...
parsePinnedVersion rejected any version constraint containing "!" to
skip the "!=" exclusion operator. PEP 440 epochs use "!" as well
(e.g. "1!2.0.0"), so an exact pin like "pkg == 1!2.0.0" was treated as
unparseable and returned "". parseRequirementsTxt drops a requirement
whose version resolves to "", so the package never made it into the
SBOM at all in either the pinned or guessed path.
Check for the "!=" operator as a substring instead of the bare "!"
character, which leaves the epoch separator alone.
Signed-off-by: Sueun Cho <sueun.dev@gmail.com >
2026-08-20 13:06:17 +00:00
78f39ee3a5
fix(javascript): strip underscore peer-dep suffixes from pnpm v5 lockfile versions ( #5175 )
...
pnpm v5 lockfiles encode resolved peer dependencies as an
underscore-delimited suffix of the dependency path, e.g.
/acorn-jsx/5.3.2_acorn@8.8.0 or a hashed form like
/webpack-cli/4.10.0_fzn43tb6bdtdxy2s3aqevve2su. Only the v6+
parenthesized form was stripped, so for v5 lockfiles the suffix leaked
into reported versions and PURLs, and peer variants of the same
name+version were not deduplicated.
Strip the suffix on the v5 code path (version < 6.0) wherever a version
is extracted: top-level dependencies values, packages keys, and
per-package dependencies map values. Only values with a leading digit
are stripped so link:/file:/git specifiers are unaffected.
Fixes #5174
Signed-off-by: codeAnqiang-ma <273298913+codeAnqiang-ma@users.noreply.github.com >
Co-authored-by: codeAnqiang-ma <273298913+codeAnqiang-ma@users.noreply.github.com >
Co-authored-by: Cursor <cursoragent@cursor.com >
2026-08-20 08:40:18 -04:00
5c6cf08a8c
fix(binary): detect multi-arch ingress-nginx ( #5179 )
...
* fix(binary): detect multi-arch ingress-nginx
Add v1.9.6 ARM64, ARMv7, and s390x fixtures from the published controller image and match their version marker against the nearby Go build version.
Assisted-by: OpenAI Codex
Signed-off-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com >
* fix(binary): match ingress-nginx release marker on all arches
The release is injected with `-ldflags -X`, so it lands in its own aligned,
NUL-padded data symbol. Only that padding is portable -- the surrounding bytes
are an arch-specific float constant pool, which is why the existing matchers all
anchor on incidental junk like `$a` and `S=v<y5` and only ever worked on amd64.
Matching `v<version>` followed by two NULs finds exactly one hit in every v1.9.6
binary (amd64, arm, arm64, s390x) and in all nine amd64 releases already under
test. Two NULs matter -- with one, s390x matches a vendored `v1.19.0` earlier in
the file and reports the wrong version.
This also drops the ~8KB wildcard window the marker previously needed, so the new
fixtures are ordinary 369 byte snippets instead of 8.4KB ones.
Two things in the fixture tooling had to move for that to work:
- `config.yaml` pinned the multi-arch *index* digest for all four platforms, but
extraction runs `docker create <ref>` with no `--platform`, so every entry
resolved to whichever image was pulled last. `make download` failed outright on
`linux/arm/v7`, since the registry labels that platform `armv7` and docker
normalizes it to `arm`. Now pinned per-platform, matching the redis entry.
- `write-snippet` only recognized EM_X86_64 and EM_AARCH64, so anything else
landed in a `linux-unknown-<hex>` directory and had to be placed by hand.
Verified against the real binaries with `-must-use-original-binaries`.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(binary): put non-amd64 snippets where the tests look for them
`write-snippet` used to fall back to `unknown-<hex>` for any ELF machine it
didn't recognize, so three snippets were sitting in directories nothing reads:
helm/3.12.0/linux-unknown-454d5f53333930 (hex of "EM_S390")
helm/4.1.4/linux-unknown-454d5f53333930
redis-server/7.2.5/linux-unknown-454d5f333836 (hex of "EM_386")
The test table asks for `linux-s390x` and `linux-386`, so those three cases were
quietly falling through to downloading the full binaries instead. Renamed to
match, and taught the tool about EM_386 and EM_RISCV so it stops producing dead
directories (there is an existing `linux-riscv64` snippet it also couldn't have
written).
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Shurong Cao <170531907+CAOShurong@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-19 18:15:15 +00:00
Hamody We and Alex Goodman
8bb3b5eed1
fix(javascript): read every document of a pnpm-lock.yaml stream ( #5188 )
...
* fix(javascript): read every document of a pnpm-lock.yaml stream
pnpm-lock.yaml can be a multi-document YAML stream. pnpm keeps config
dependencies and the pinned package-manager version in a leading document
and the project's dependency graph in the next one. That layout has
shipped since pnpm 11 for projects using config dependencies, and pnpm 12
records the package-manager pin by default, so two documents is now the
common case.
The cataloger called yaml.Unmarshal, which reads the first document only.
On such a lockfile the SBOM contains pnpm's own release binaries and none
of the project's dependencies. Both documents declare the same
lockfileVersion and the result is well-formed and non-empty, so nothing
signals that it is wrong.
Split the stream and parse each document, merging the results. A
single-document lockfile yields exactly one document, so its behaviour is
unchanged. A document that omits lockfileVersion falls back to the
version from the first one rather than being dropped.
Fixes #5168
Signed-off-by: hamodywe <iosapk.org@gmail.com >
* refactor(javascript): stream pnpm-lock.yaml documents instead of buffering
The multi-document fix read the whole lockfile, decoded it to a `yaml.Node`
tree, re-marshaled every document back to `[]byte` and then re-parsed each one
twice. `yaml.Node` already has a `Decode` method, so the decoder can walk the
stream straight off the reader and hand each document's node to the parser.
On a 4.8MB single-document lockfile that takes total allocations from 1069MB to
250MB, which is also below where things sat before multi-document support. It
drops the `io.ReadAll` and its `noUnboundedReads` suppression, and puts pnpm in
line with every other YAML cataloger in the tree, all of which already stream.
`pnpmLockfileParser.Parse` now takes a `*yaml.Node` rather than `[]byte`. It is
package-private with two implementations and one production call site.
Documents accumulate into a single map keyed by `name@version`, so the stream
follows one collision rule rather than two: the last entry to appear wins,
which is what already happens within a document. That replaces the separate
first-wins-with-fill-in merge pass. A conflicting integrity between documents
is now traced rather than resolved silently.
Three behaviour fixes come with it:
- an empty or comment-only leading document no longer takes down the whole
file. It decodes to a null node, not a zero-kind one, so the old guard never
fired and the stream failed with `invalid lockfile version ""`.
- a malformed document no longer discards the documents that already parsed.
It is reported through `unknown` instead, matching how the rest of the
cataloger reports partial results.
- parse errors carry the document index, and their line numbers again point at
the user's file rather than into a re-marshaled buffer.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore(javascript): trim the duplicated pnpm multi-document comment
The six-line explanation of why a pnpm lockfile can hold two documents sat
verbatim in both the parser and its test. Keep it next to the code, where
someone debugging will be, and leave the test pointing at it.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: hamodywe <iosapk.org@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-19 18:09:51 +00:00
Oleksandr Vodotiiets
21cca30e5b
perf: make orderedIDSet membership checks constant time ( #5178 )
...
orderedIDSet.add scanned the entire existing slice for every inserted ID,
so building a Collection was quadratic in the number of packages sharing an
index key. This is most visible in idsByType: package types are few, so that
index accumulates nearly every package in the SBOM into a single set, and
each Add rescans it.
Keep the ordered slice (ordering and dedup semantics are unchanged) and add
a hash index for membership checks. The index is only built once a set grows
beyond a small threshold, so the many single-element sets held by idsByName
and idsByPath do not pay for a map, while the large idsByType sets get
constant-time lookups.
BenchmarkCollectionAdd (Apple M2 Pro), packages sharing one type:
packages before after speedup
1,000 1.37 ms 0.76 ms 1.8x
10,000 100.31 ms 9.80 ms 10.2x
50,000 2,423.79 ms 34.46 ms 70.3x
The tradeoff is memory: sets past the threshold allocate an index map,
about 14% more bytes at 50,000 packages, with allocation counts unchanged.
Signed-off-by: Oleksandr Vodotiiets <61548316+avodotiiets@users.noreply.github.com >
2026-08-19 18:01:20 +00:00
Keith Zantow
ed76e96749
fix: panic when scanning squashfs symlinks ( #5119 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-08-19 13:13:42 -04:00
Luan Taraschi
ab508169e6
fix(golang): skip remote license lookup for standard library module paths ( #5192 )
...
With search-remote-licenses enabled, every module name went to the proxy,
including toolchain binaries whose main module is synthesized from the
package path, such as cmd/cgo. The proxy answers 404, and the direct
fallback then treats the path as a repository host, producing requests
like https://cmd/cgo/info/refs?service=git-upload-pack .
Reuse isStandardImportPath, already in this package, to skip the remote
search for paths whose first element carries no dot. Those are never
publishable module paths, so neither a proxy nor a repository can resolve
them.
Fixes #3149
Signed-off-by: Luan Taraschi <130802253+luantaraschi@users.noreply.github.com >
2026-08-19 10:11:10 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
360dbc04aa
chore(deps): update CPE dictionary index ( #5189 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-18 11:44:00 -04:00
Alex Goodman
58a033f924
Prevent unnecessary allocations when parsing compressed ELF sections ( #5187 )
...
* fix(elf): bound compressed ELF section reads
`debug/elf` takes a section's decompressed size from that section's own
compression header, and a highly compressible stream really does deliver the
bytes that header promises, so `internal/saferio` does not help: it faithfully
allocates every one of them. A 2MB input file drives `elf.NewFile` to allocate
over 10GB and return no error, which is a fatal OOM rather than a recoverable
panic.
Which sections get read is not up to the caller. `elf.NewFile` always reads the
section-name string table, and `File.Symbols` reads `.symtab` plus whatever
section its `Link` field points at, so being selective about sections is not
enough to avoid it.
New `elfutil.NewFile` is a drop-in for `elf.NewFile` that rejects a declared
decompressed size over 128MB. Every production call site goes through it, and a
ruleguard rule keeps the next one from going direct.
The check runs in two parts, since `debug/elf` expands sections at two different
times. The section-name string table is the only one `elf.NewFile` expands
itself, so it is checked against the raw bytes before the call; everything else
is expanded lazily by `(*Section).Open` and is checked after the parse, where
names, types and decompressed sizes are already resolved.
Only the sections syft can actually reach are bounded, which keeps the guard
from costing real binaries. DWARF is excluded since nothing calls `File.DWARF`,
so a large compressed `.debug_info` no longer skips the whole file, and sections
`debug/elf` will not decompress anyway (`SHF_ALLOC`, `SHT_NOBITS`) are left
alone. The legacy `.zdebug` form is matched on the section name the way
`debug/elf` gates it rather than on the `ZLIB` magic, so an ordinary section
starting with those four bytes is not mistaken for a compressed one.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix(elf): gate debug/buildinfo behind the compressed-section check
`debug/buildinfo.Read` opens ELF files with `debug/elf` itself, and `elf.NewFile`
expands the section-name string table as it parses, so the golang cataloger was
still reachable by the same bomb `elfutil` exists to stop. A 261KB fixture drove
1.4GB of allocation through `buildinfo.Read` and returned no error.
`elfutil.CheckSectionNameTable` is now exported for that case: callers that cannot
use `NewFile` because the `debug/elf` call is made for them inside another package.
Both `buildinfo.Read` call sites go through it, including the UPX-decompressed one.
Also corrects claims that did not hold up:
- the package doc's 2MB-to-10GB figure is not reachable with zlib (~1000:1), so it
now carries the measured 510KB-to-2.6GB, and names zstd's 32767:1 since that is
what makes the small inputs possible
- `.go.buildinfo` was listed as a hot-path section elfutil covers, but it is read
through `debug/buildinfo` and never touches `Section.Data`
- the graalvm comment claimed routing size rejections away from `*elf.FormatError`
improved reporting; both branches are skipped by the caller and only the
FormatError branch logs, so it did the opposite
- `sharedLibraries` logged short and truncated files as real ELF failures, since
`debug/elf` returns a bare `io.EOF` rather than an `*elf.FormatError` for those
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added test comments around the negative cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* additional tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* better decomposition and comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use a less brittle constant for error detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-14 20:08:58 +00:00
Alex Goodman
04a6fa1b41
fix(unionreader): honor the io.ReaderAt contract in readerAtAdapter ( #5186 )
...
`readerAtAdapter.ReadAt` seeks and then issues a single `Read`, which breaks the
`io.ReaderAt` contract in both directions against the squashfs reader it exists
to wrap:
- `squashfs.File.Read` copies against the decompressed block length but advances
its block cursor by the nominal block size, so a block that decompresses short
silently stops copying and returns fewer bytes with a nil error. `ReadAt`
forbids that, and callers rely on it: anything decoding a fixed-size structure
off the result gets zero padding it has no way to detect and parses it as real
data. The GraalVM PE export table and the UPX block reader both size a buffer
from a header field and then ignore `n` entirely, so a crafted image drives
them straight through the padding.
- a read landing exactly on the end of the file returns a *full* buffer paired
with `io.EOF`. `bytes.Reader.ReadAt` returns nil there, and the callers that
treat any error as fatal were written against that, so squashfs-resident
binaries sized near a read boundary were being skipped outright.
`io.ReadFull` normalizes both: it fills the buffer across short reads, and it
clears the error once the buffer is full. A genuinely short tail is reported as
`io.EOF`, which is what `ReadAt` implementations return at the end of a file, and
what the buffering branch of `GetUnionReader` already returns.
Affects squashfs-backed sources (snaps), so in practice the binary catalogers
reading structure out of executables.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-14 14:09:10 -04:00
dependabot[bot]
d63c774fa9
chore(deps): bump modernc.org/sqlite from 1.55.0 to 1.56.0 ( #5183 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.55.0 to 1.56.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.55.0...v1.56.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-14 13:34:28 +00:00
dependabot[bot]
3eee102f63
chore(deps): bump github.com/google/go-containerregistry ( #5184 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.21.7 to 0.21.9.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.21.7...v0.21.9 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.21.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-14 13:34:24 +00:00
dependabot[bot]
20cc3df387
chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 ( #5181 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.6.1 to 0.6.2.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/6fc4b006235f201fdab3722e17240ab420d580e5...3dc1ecc9bcb9e94e9b2c709687979e1298497054 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-14 13:33:58 +00:00
dependabot[bot]
4782a94029
chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 ( #5182 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.19.1 to 1.19.2.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.19.1...v1.19.2 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.19.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-14 13:33:38 +00:00
Weston Steimel
2293641e3b
fix: add correct CPE vendor/product candidates for Git for Windows PE binary ( #5156 )
...
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2026-08-10 10:26:29 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
9dd9ce0bdd
chore(deps): update CPE dictionary index ( #5166 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-10 10:24:51 -04:00
Ankit
949ac70369
fix(java): map legacy Jackson 1.x (-asl) artifacts to org.codehaus.jackson ( #5146 )
...
jackson-mapper-asl, jackson-core-asl, and their sibling artifacts
(jackson-jaxrs, jackson-xc, jackson-smile) predate the convention of
embedding META-INF/maven/.../pom.properties in the jar (they were
built with Ant before ~2014). With no POM metadata to read, syft's
groupIDFromJavaMetadata falls through to using the artifact name
itself as the group ID, e.g.
pkg:maven/jackson-mapper-asl/jackson-mapper-asl@1.9.13
instead of the correct
pkg:maven/org.codehaus.jackson/jackson-mapper-asl@1.9.13
(confirmed against the published POM on Maven Central for all five
artifacts). Because the generated purl's namespace doesn't match the
vulnerability database's namespace for these packages, this causes
false negatives in downstream scanning (e.g. Grype cannot match known
CVEs such as CVE-2019-10202 against jackson-mapper-asl).
Add the five artifacts to DefaultArtifactIDToGroupID, the same known-
package-list fallback already used for other jars with incomplete
metadata (e.g. the existing ant-*, spring-ldap* entries).
Fixes #4598
Signed-off-by: ankit090701 <ankitanku090701@gmail.com >
2026-08-07 14:38:14 +00:00
Gunny Patel
07fb23487f
feat(golang): detect native Go FIPS 140 mode in binaries ( #5155 )
...
Signed-off-by: Gunny Patel <zip159@gmail.com >
2026-08-07 14:36:09 +00:00
Timo
f45586b457
Remove Go Report Card badge from README ( #5130 )
...
Signed-off-by: Timo <57227498+EchterTimo@users.noreply.github.com >
2026-08-07 10:31:27 -04:00
dependabot[bot]
0fe98ed1f2
chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 ( #5159 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.19.1 to 5.19.2.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md )
- [Commits](https://github.com/go-git/go-git/compare/v5.19.1...v5.19.2 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.19.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 13:32:31 +00:00
dependabot[bot]
5f67883fe8
chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 ( #5158 )
...
Bumps [go.yaml.in/yaml/v3](https://github.com/yaml/go-yaml ) from 3.0.4 to 3.0.5.
- [Commits](https://github.com/yaml/go-yaml/compare/v3.0.4...v3.0.5 )
---
updated-dependencies:
- dependency-name: go.yaml.in/yaml/v3
dependency-version: 3.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 13:31:31 +00:00
dependabot[bot]
d288dd67ae
chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 ( #5157 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.5.1 to 4.6.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/abd2ef45e78c5afb21d64d4ca52ee8550d9572c7...dbcb813823bdd20940b903addbd779551569679f )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-08-07 13:30:56 +00:00
Alex Goodman
da745b13e8
feat(golang): add extended-stdlib scope and module patterns for symbol capture ( #5154 )
...
* feat(golang): add extended-stdlib scope and include patterns for symbol capture
`golang.capture-symbols` decides how much symbol data lands in the SBOM for grype's reachability analysis. It's `none`, `stdlib`, or `all` today, and the useful middle is missing: `stdlib` stops at the standard library, `all` multiplies SBOM size.
A new `extended-stdlib` configurable covers stdlib plus everything under `golang.org/x/`:
```yaml
golang:
capture-symbols: extended-stdlib
```
Also, a new `capture-symbols-include` configurable for modules that are noisy in your binaries but not everyone's. It's unioned with whatever the scope selects, so it only ever widens:
```yaml
golang:
capture-symbols: extended-stdlib
capture-symbols-include:
- github.com/klauspost/**
```
Patterns are standard doublestar globs, which matters because module paths carry `/v2`-style suffixes:
```yaml
golang:
capture-symbols-include:
- github.com/klauspost/* # compress, but not compress/v2
- github.com/klauspost/** # both
- k8s.io/client-go # exact match only
```
Ordering is `none` < `stdlib` < `extended-stdlib` < `all`. The existing three values
and the `none` default are unchanged, and the include list is inert under `none`.
Presets compile into glob lists internally, so a single matcher answers "does this
module get symbols" instead of a preset branch sitting next to a separate glob branch.
An unrecognized `capture-symbols` value still falls back to `none`, but warns now
instead of doing it silently. A malformed include pattern warns and gets skipped.
One thing worth a look beyond the feature: the `Symbols` field description in the JSON
schema was wrong after this (it claimed only `all` and `stdlib` populate anything), and
that description lives in the already-published `16.1.10`. Rather than bump a version for
a sentence, `16.1.10` is amended in place and `schema/json/README.md` grows an explicit
exception for description-only changes: descriptions only, no shape change of any kind,
`$id` unchanged. Anything else still needs a bump. Happy to split that into its own PR if
you'd rather review the policy separately.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor(golang): rename capture-symbols-include to capture-symbols-modules
The key's entries are go module paths, and `-include` sitting next to `capture-symbols` reads as plausibly taking symbol or package names instead. Those spellings parse and match nothing, which is quieter than the confusion `-include` was picked to avoid, so the name now says what the list holds.
`golang.CatalogerConfig.CaptureSymbolsModules` and `WithCaptureSymbolsModules` rename with it. Nothing behavioral changes; the key is new in this PR so there is no compatibility surface.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat(golang): match capture-symbols-modules across major version suffixes
`github.com/anchore/*` covered `github.com/anchore/syft` and silently stopped covering it the day it became `github.com/anchore/syft/v2`. The config keeps parsing, nothing warns, and symbols quietly go missing from the SBOM. Exact paths had the same hole: `github.com/klauspost/compress` did not cover `compress/v2` either, so no spelling short of `**` survived a major bump.
A major version suffix is part of a module's path but not part of its identity, so patterns are now matched against the module path both with and without it, using `module.SplitPathVersion` from `golang.org/x/mod` (already a direct dep, already used in this package for `PseudoVersion`).
```yaml
golang:
capture-symbols-modules:
- github.com/klauspost/* # compress and compress/v2
- github.com/klauspost/compress # same module at every major version
- github.com/klauspost/compress/v2 # v2 alone
```
Only a trailing suffix is a version, which is Go's own rule. In `github.com/anchore/syft/v2/thing` the `v2` is an ordinary path element naming a major subdirectory a nested module lives in, so it stays literal and `github.com/anchore/**/thing` is how you reach it. `/v0` and `/v1` are not valid suffixes and are left alone.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-07 12:44:42 +00:00
Alex Goodman
68da404bd7
fix(make): don't let ambient RACE leak into raceEnabled test ( #5152 )
...
The two "RACE is unset" cases only skipped the t.Setenv call, so they
inherited whatever RACE was in the environment. Running `make test` with
RACE=false exported job-wide flipped the CI-default case and failed.
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-05 10:00:17 -04:00
Alex Goodman
35bf33bcf0
fix(make): explicit integration test timeout + single race switch ( #5151 )
...
with a cold fixture cache the integration suite builds and saves 18 docker
images across 36 sequential tests, which walks past `go test`'s default 10m
timeout and takes the fixture cache rebuild down with it. that suite now runs
`go test` directly with `-timeout=30m` (gotest.Tasks() has no timeout option),
plus `-count=1` since the built fixtures are the side effect we're actually
after and a test cache hit would skip producing them.
also adds `RACE` as one switch for the race detector across every suite:
- `RACE=false make test` drops `-race` from unit + integration and skips the
race smoke, worth doing on a cache rebuild where the wall clock is all
docker builds anyway
- `RACE=true` forces it on locally
- unset behaves as before: on in CI, off locally and on windows
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-08-04 10:46:35 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
7f73d6a603
chore(deps): update CPE dictionary index ( #5148 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-08-03 13:20:36 -04:00
dependabot[bot]
ef40eec38d
chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 ( #5140 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.19.0 to 1.19.1.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.19.0...v1.19.1 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:50:21 +00:00
dependabot[bot]
80212d87c2
chore(deps): bump github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1 ( #5139 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.9.0 to 5.9.1.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.9.0...v5.9.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-version: 5.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:35:46 +00:00
dependabot[bot]
b14123ecc1
chore(deps): bump github.com/magiconair/properties ( #5141 )
...
Bumps [github.com/magiconair/properties](https://github.com/magiconair/properties ) from 1.8.10 to 1.18.11.
- [Release notes](https://github.com/magiconair/properties/releases )
- [Commits](https://github.com/magiconair/properties/compare/v1.8.10...v1.18.11 )
---
updated-dependencies:
- dependency-name: github.com/magiconair/properties
dependency-version: 1.18.11
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:34:20 +00:00
dependabot[bot]
e00aeb16e4
chore(deps): bump github.com/ulikunitz/xz from 0.5.15 to 0.5.16 ( #5142 )
...
Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz ) from 0.5.15 to 0.5.16.
- [Commits](https://github.com/ulikunitz/xz/compare/v0.5.15...v0.5.16 )
---
updated-dependencies:
- dependency-name: github.com/ulikunitz/xz
dependency-version: 0.5.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:32:58 +00:00
dependabot[bot]
fa6f6d70f0
chore(deps): bump modernc.org/sqlite from 1.54.0 to 1.55.0 ( #5138 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.54.0 to 1.55.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.54.0...v1.55.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.55.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:29:04 +00:00
dependabot[bot]
0975d80dc0
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.8.2 to 6.8.3 ( #5137 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.8.2 to 6.8.3.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.8.2...v6.8.3 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.8.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:28:49 +00:00
dependabot[bot]
4d823eaaa7
chore(deps): bump github.com/diskfs/go-diskfs from 1.9.3 to 1.9.4 ( #5136 )
...
Bumps [github.com/diskfs/go-diskfs](https://github.com/diskfs/go-diskfs ) from 1.9.3 to 1.9.4.
- [Commits](https://github.com/diskfs/go-diskfs/compare/v1.9.3...v1.9.4 )
---
updated-dependencies:
- dependency-name: github.com/diskfs/go-diskfs
dependency-version: 1.9.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:27:56 +00:00
dependabot[bot]
138e42b428
chore(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 ( #5134 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.6.0 to 0.6.1.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/6599ee8b7a49aef6a770f63d261d214911a7ce02...6fc4b006235f201fdab3722e17240ab420d580e5 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:27:32 +00:00
dependabot[bot]
ecd8fb7740
chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 ( #5135 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.4.0 to 4.5.1.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/af1e73f918a031802d376d3c8bbc3fe56130a9b0...abd2ef45e78c5afb21d64d4ca52ee8550d9572c7 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.5.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-31 13:27:08 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
dd639c09b2
chore(deps): update tool versions ( #5124 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-07-30 10:59:36 +00:00
Christopher Angelo Phillips and Alex Goodman
31a352d030
fix(snap): release temp directories on every snap failure path
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-29 14:50:20 -04:00
Alex Goodman
08e913a2ce
Report each hardlink as its own file when scanning images ( #5029 )
...
* report each hardlink as its own file when scanning images
image scans previously collapsed a set of hardlinks onto a single file, so only
one path per inode showed up in results. dir scans report every hardlink path,
which made image vs dir SBOMs of the same filesystem diverge (and produce
different SPDX `packageVerificationCode` values for packages that own hardlinked
files).
now both image resolvers (squash and all-layers) surface each hardlink at its
own path as a regular file bound to the target's content, matching dir scans.
user-facing impact:
- SBOMs for images containing hardlinks will list more `file` entries
- SPDX `packageVerificationCode` values change for affected packages, now
matching the equivalent `dir:` scan
- adds `file.NewVirtualLocationFromImage` to the public API
fixes #5019
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix busybox test assertion
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-29 13:50:43 -04:00
dependabot[bot] and Christopher Phillips
5ef5b1badc
chore(deps): bump anchore/workflows/.github/workflows/check-version-available.yaml ( #5033 )
...
Bumps [anchore/workflows/.github/workflows/check-version-available.yaml](https://github.com/anchore/workflows ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b0c30a80409130d329aaa356fd64a34d8c0b3375...7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/check-version-available.yaml
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-07-29 17:33:37 +00:00
dependabot[bot] and Christopher Phillips
b236f8c1f7
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.8.1 to 6.8.2 ( #5051 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.8.1 to 6.8.2.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.8.1...v6.8.2 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-07-29 17:30:07 +00:00
Yashas Gunderia and ychampion
476ce60768
fix(binary): detect Deno 1.11 and 2.9 versions
...
Signed-off-by: ychampion <ychampion@users.noreply.github.com >
Co-authored-by: ychampion <ychampion@users.noreply.github.com >
2026-07-29 16:33:46 +00:00
Keith Zantow
16223e6dd7
fix: consider vendored golang packages in module attribution ( #5093 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-07-27 15:20:49 -04:00
Eljees
1286689419
Fix missing nested packages in package-lock.json v1 ( #5108 )
...
* fix(javascript): catalog nested package-lock v1 dependencies
Signed-off-by: Eljees <57435526+Eljees@users.noreply.github.com >
* test(javascript): cover nested package-lock v1 dependencies
Signed-off-by: Eljees <57435526+Eljees@users.noreply.github.com >
---------
Signed-off-by: Eljees <57435526+Eljees@users.noreply.github.com >
2026-07-27 15:18:48 -04:00
Eljees
295454945c
fix: strip publisher URL from RPM CPE vendor ( #5081 )
...
Signed-off-by: Eljees <yurytumanov.r@yandex.ru >
2026-07-27 15:18:27 -04:00
Enes Deniz
86baeeb481
fix(rust): omit Cargo PURLs for local packages ( #5105 )
...
Signed-off-by: Enes Deniz <142517728+3nesdeniz@users.noreply.github.com >
2026-07-27 14:50:13 +00:00
Rayan Salhab and cyphercodes
2dcf5163b8
fix(apk): allow large installed db fields ( #5100 )
...
Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com >
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
2026-07-27 14:36:56 +00:00
Arpit Jain
12b8ba47fb
Fix inverted bounds check dropping every Erlang string with a backslash ( #5110 )
...
parseErlangString advances past a backslash escape and then checks
len(data) >= *i before reading the escaped byte. That condition is
almost always true (it only turns false once *i runs off the end),
so the intended out-of-range guard fires on the very first escape
character it sees instead of only at EOF. Any rebar.lock or OTP
resource file containing a backslash in a quoted string (a Windows
git path, an escaped quote, anything) fails to parse and the whole
file, and every package in it, gets dropped.
Flip the comparison to *i >= len(data) so the guard only trips when
the escape is genuinely truncated, and add a regression test for a
string with an escaped quote.
Signed-off-by: Arpit Jain <arpitjain099@gmail.com >
2026-07-27 14:22:41 +00:00
Rez Moss
138d9ce2a0
added bun binary classifier ( #5103 )
...
* added bun binary classifier
Signed-off-by: Rez Moss <hi@rezmoss.com >
* added bun binary classifier
Signed-off-by: Rez Moss <hi@rezmoss.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-07-27 10:18:50 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
8a229b16c4
chore(deps): update CPE dictionary index ( #5109 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-07-27 10:04:27 -04:00
dependabot[bot]
9af0098a68
chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 ( #5099 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.80.0 to 1.82.1.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.80.0...v1.82.1 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.82.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 13:48:24 +00:00
dependabot[bot]
2840ea6653
chore(deps): bump modernc.org/sqlite from 1.53.0 to 1.54.0 ( #5098 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.53.0 to 1.54.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.53.0...v1.54.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 13:29:49 +00:00
dependabot[bot]
b38e40e3e6
chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 ( #5096 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.5.7 to 0.6.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/192e21d79ab29983730a13d1382995c2307fbcaa...6599ee8b7a49aef6a770f63d261d214911a7ce02 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 13:29:21 +00:00
dependabot[bot]
a6eedecd31
chore(deps): bump github.com/gpustack/gguf-parser-go ( #5097 )
...
Bumps [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go ) from 0.24.1 to 0.25.0.
- [Release notes](https://github.com/gpustack/gguf-parser-go/releases )
- [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.24.1...v0.25.0 )
---
updated-dependencies:
- dependency-name: github.com/gpustack/gguf-parser-go
dependency-version: 0.25.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 13:29:04 +00:00
dependabot[bot]
691b1357b2
chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 ( #5095 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0...3d3c42e5aac5ba805825da76410c181273ba90b1 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-24 13:27:48 +00:00
Alex Goodman
c890e7f17f
decode golang symbols ( #5089 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-23 15:03:36 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
29fd7d0dec
chore(deps): update anchore dependencies ( #5022 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-07-20 18:04:57 +00:00
Yashas Gunderia and ychampion
289137ff3c
Avoid duplicate packages for replaced Go modules ( #5069 )
...
* Prevent duplicate Go packages after source replacement resolution
Source analysis already applies module replacements through go/packages. Avoid synthesizing the same replacement again from go.mod while retaining fallback synthesis for modules that source analysis did not resolve.
Constraint: Preserve unimported and local-path replacement cataloging.
Rejected: Deduplicate only during final assembly | That retains redundant license lookup and ambiguous metadata ownership.
Confidence: high
Scope-risk: narrow
Directive: Keep go.mod fallback packages limited to modules absent from source analysis.
Tested: Focused replacement regression, related Go module parser tests, go vet, gofmt, and diff checks.
Not-tested: Docker-backed full cataloger fixtures; local root storage was exhausted by image generation.
Signed-off-by: ychampion <ychampion@users.noreply.github.com >
* Keep replacement fixtures with the Go module test data
Constraint: The maintainer reserves internal/gotestdata for fixtures that need special Go tooling discovery.
Rejected: Leave this fixture in gotestdata | The regression opens its module explicitly and does not need the special location.
Confidence: high
Scope-risk: narrow
Directive: Use internal/gotestdata only when a fixture must avoid Go testdata discovery rules.
Tested: replacement regression repeated 10 times; Go module parser table; go vet for the Go cataloger; gofmt; diff checks.
Not-tested: Full cataloger package; three unrelated parser fixtures fail identically on exact prior head in this environment.
Signed-off-by: ychampion <ychampion@users.noreply.github.com >
---------
Signed-off-by: ychampion <ychampion@users.noreply.github.com >
Co-authored-by: ychampion <ychampion@users.noreply.github.com >
2026-07-20 12:30:56 -04:00
dependabot[bot]
22ffd5209d
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.22 to 0.5.23 ( #5079 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.22 to 0.5.23.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.22...v0.5.23 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.23
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-20 15:28:53 +00:00
Jason Paulos and Alex Goodman
a0852ebf98
Add multi-platform OCI image support ( #5074 )
...
* Add multi-platform OCI image support
Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com >
* Reduce calls to PrepareMultiplatformFixtureImage in TestMultiPlatformOCIImageSelection
Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com >
* Use smaller image for testing & update stereoscope fork
Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com >
* bump to stereoscope@main after 548 merge
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Jason Paulos <jasonpaulos@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-20 15:28:29 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
d380ad08b5
chore(deps): update CPE dictionary index ( #5082 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-07-20 15:21:24 +00:00
dependabot[bot]
ae9534203d
chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 ( #5078 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/mod/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 13:52:25 +00:00
dependabot[bot]
dc1ef98237
chore(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 ( #5077 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.47.0 to 0.48.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.47.0...v0.48.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.48.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 13:52:22 +00:00
dependabot[bot]
36a3af41d9
chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 ( #5076 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.56.0 to 0.57.0.
- [Commits](https://github.com/golang/net/compare/v0.56.0...v0.57.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.57.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-17 13:32:07 +00:00
Christopher Angelo Phillips
3e2bc6ed09
ci: add docker-container driver ( #5071 )
...
* ci: add docker-container driver
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* fix: update to v4.2.0
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-07-16 10:21:22 -04:00
Yashas Gunderia
5e11775c8b
feat: detect unpackaged Firefox in software inventories ( #5068 )
...
Signed-off-by: ychampion <ychampion@users.noreply.github.com >
2026-07-15 22:09:58 -04:00
Rez Moss
8ed534c32b
fix: NPM redis.js CPE ( #5012 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-07-15 20:55:42 -04:00
Christopher Angelo Phillips and Alex Goodman
aff2c247db
feat: add safe tensor model type to SBOM output ( #4844 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-15 17:14:03 -04:00
Christopher Angelo Phillips
ed499fd2d0
chore: migrate .goreleaser config to use docker_v2 ( #4608 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-07-15 16:52:46 -04:00
Rez Moss
ad828d659f
fix: conan libxml2 CPE ( #5016 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-07-15 15:29:03 -04:00
ChrisJr404 and Chris
2805655ab0
feat(cmd): log total scan duration at info level ( #4858 )
...
Closes #4587
Adds a single info-level log line at the end of every `syft scan` run that reports the total scan wall-clock time, e.g.:
[0003] INFO scan completed in 2.017s
Per maintainer guidance on the issue, the line is logged at INFO so it surfaces with `-v` (alongside the existing per-cataloger timing) and stays out of the default TUI / stdout. Useful for users who leave long scans running and want the overall time at a glance, without having to wrap the invocation in `time`.
Signed-off-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
2026-07-14 12:49:53 +00:00
Monibee-Fudgekins and Alex Goodman
552ddbfadb
fix: map NuGet PURLs to dotnet package type ( #4861 )
...
* test: use unique NuGet PURL subtest name
Signed-off-by: Monibee Fudgekins <menoisback@proton.me >
* fix: emit canonical NuGet PURL type
Signed-off-by: Monibee Fudgekins <menoisback@proton.me >
* chore: regenerate dotnet capabilities for nuget PURL type
regenerated after emitting canonical nuget PURL type for dotnet packages.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Monibee Fudgekins <menoisback@proton.me >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-13 16:43:34 -04:00
Christopher Angelo Phillips and Alex Goodman
f6b5d3e736
perf: group golang symbols by package path to reduce the sbom size ( #5064 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-13 16:40:16 -04:00
ChrisJr404 and Chris
4312699dd6
cyclonedx: import firmware-typed components as packages ( #4855 )
...
The CycloneDX decoder was filtering on a hard-coded set of component
types (application/framework/library/machine-learning-model). Anything
else — including "firmware" — fell through silently, so a BOM
describing u-boot or other firmware ended up with no packages and
grype reported no matches (anchore/grype#2537 ).
@kzantow confirmed in the issue thread that firmware should be
included and gave this section as the spot to update.
Add ComponentTypeFirmware to the case list and a regression test that
constructs a single-firmware-component BOM and asserts the decoded
SBOM contains the package.
Closes anchore/grype#2537
Signed-off-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
2026-07-13 19:33:51 +00:00
fabd760914
fix: correct Spring LDAP group ID in purl generation ( #4908 )
...
* fix: correct Spring LDAP group ID in purl generation
The Spring LDAP artifacts use the group ID org.springframework.ldap
(not org.springframework). This caused syft to generate incorrect purls
like pkg:maven/spring-ldap-core/spring-ldap-core@3.1.4 instead of the
correct pkg:maven/org.springframework.ldap/spring-ldap-core@3.1.4.
Add all Spring LDAP artifacts to the DefaultArtifactIDToGroupID map:
- spring-ldap
- spring-ldap-core
- spring-ldap-core-tiger
- spring-ldap-ldif-core
- spring-ldap-odm
- spring-ldap-test
Closes #4030
Signed-off-by: Jonas Boos <jonasboos@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix formatting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Jonas Boos <jonasboos@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Jonas Boos <jonasboos@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-13 19:31:35 +00:00
M_C_J
e854078fb0
fix: use printf instead of echo to fix ANSI color output ( #4978 )
...
Signed-off-by: Jouini Mohamed Chaker <JouiniMohamedChaker@proton.me >
2026-07-13 19:29:30 +00:00
Mike Zolotarov and Alex Goodman
987ae7f26a
fix: PE case-insensitive extensions (Win32/ISO 9660 compatibility) ( #4996 )
...
* fix: PE case-insensitive extensions (Win32/ISO 9660 compatibility)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expand cases to bpl files and surrounding catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-13 19:25:31 +00:00
Keith Zantow
76ede661db
fix: allow more PEP440-compliant characters in python versions ( #4964 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-07-13 15:10:12 -04:00
Ali Asghar
da77ea388a
docs: fix stale commands in binary cataloger README ( #5047 )
...
Update the binary classifier cataloger developer README to match the
current workflow:
- Testing section used the non-existent flag -must-use-full-binaries
against .../testdata/...; the real flag is -must-use-original-binaries
and Test_Cataloger_PositiveCases lives in the binary package. Fix the
command and add a single-fixture variant.
- Point add-snippet references at the make target and note the (Y/n/q)
prompt requires y to write the snippet.
- Fix the test file name (classifier_cataloger_test.go) and document the
go generate ./internal/capabilities step for new classifiers.
Fixes #4510
Signed-off-by: alliasgher <alliasgher123@gmail.com >
2026-07-13 15:15:01 +00:00
Synvoya and Synvoya
3cc3ecb003
Fix panic on cabal.project.freeze 'installed' boot-lib constraints ( #5040 )
...
GHC boot-lib constraints (any.base installed) have no ' ==', so fields[1] panicked with index out of range and the recover dropped all Haskell packages. Skip constraint lines without a version.
Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com >
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com >
2026-07-13 10:57:32 -04:00
Arpit Jain
7745e450fa
fix panic parsing a rockspec comment that ends at EOF ( #5053 )
...
The hand-written rockspec parser reads a byte past the end of the buffer
in two spots when a comment runs right up to the end of the file.
In parseRockspecBlock, when a block starts with a leading comment that
consumes the rest of the file, the SkipWhitespace afterward leaves the
index at len(data) and the following `c = data[*i]` reads out of range.
In parseComment, `data[*i]` is read after the index is advanced to check
for a CR/LF pair, so a bare carriage return as the last byte reads past
the end.
Both cases show up with a rockspec whose final line is a comment ending
in a lone \r with no trailing newline. That is malformed but harmless
input, and the panic aborts the whole Lua cataloger, so every valid Lua
package in the same scan gets dropped. Guard both reads with a length
check and return cleanly at EOF. Added table cases covering a
comment-only file and a trailing comment, both ending in a bare CR.
Signed-off-by: arpitjain099 <arpitjain099@gmail.com >
2026-07-13 14:45:12 +00:00
Synvoya and Synvoya
bd0917fe93
fix(javascript): strip peer-dep suffix from deno.lock npm keys ( #5055 )
...
deno.lock npm keys append resolved peer dependencies after the version,
separated by "_" (e.g. "typedoc@0.28 .19_typescript@6.0.3" or the scoped
"@scope/name@1.2.3_@scope+peer@4.5.6"). parseDenoNpmNameVersion split on the
last "@", capturing a peer's "@" and producing a garbage package name plus
the peer's version (and a corrupt PURL that breaks vulnerability matching).
Strip the peer suffix (the first "_" after the version "@") before splitting
name@version; a semver version never contains "_".
Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com >
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com >
2026-07-13 14:38:32 +00:00
Christopher Angelo Phillips and Alex Goodman
1dcac54b0e
feat: optionally capture golang binary symbols ( #4988 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-13 10:30:23 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
3252b6f806
chore(deps): update CPE dictionary index ( #5063 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-07-13 10:07:00 -04:00
dependabot[bot]
c4a0b6f647
chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 ( #5050 )
...
Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress ) from 1.18.6 to 1.19.0.
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.6...v1.19.0 )
---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
dependency-version: 1.19.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 13:31:42 +00:00
dependabot[bot]
5b630ec61c
chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 ( #5049 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 4.2.0 to 4.4.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/650006c6eb7dba73a995cc03b0b2d7f5ca915bee...af1e73f918a031802d376d3c8bbc3fe56130a9b0 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-10 13:29:34 +00:00
Sai Asish Y and Alex Goodman
e8abab2e77
swift: emit canonical purls without .git suffix or repeated name ( #4785 )
...
* swift: emit canonical purls without .git suffix or repeated name
Reported in anchore/syft#3961: the purl syft emits for Swift packages
parsed out of Package.resolved keeps the repository URLs .git suffix
and then re-appends the package name, producing
pkg:swift/github.com/apple/swift-nio-ssl.git/swift-nio-ssl@2.0.0
NVD / Grype cannot match that purl against the known
swift-nio-ssl@2.0.0 CVE (GHSA-frg3-gpcx-968f), so every Swift SBOM
produced by syft silently loses vulnerability coverage. cdxgen and
the wider purl ecosystem use the shorter form
pkg:swift/github.com/apple/swift-nio-ssl@2.0.0
which Grype does match.
Replace the ad-hoc strings.Replace with swiftNamespaceFromSourceURL,
which trims the common URL schemes, strips the ".git" suffix, and
drops a trailing /<name> segment so the namespace is only the
organisation path (e.g. github.com/apple). Existing test expectations
are updated to the new purl shape.
Fixes #3961
Signed-off-by: Sai Asish Y <say.apm35@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Revert unrelated consul binary classifier changes
The swift purl commit (ff5ffc37wagoodman@users.noreply.github.com >
* swift: strip repeated name segment case-insensitively
Package.resolved identities are lowercased while the repo URL path may be
mixed-case (e.g. github.com/Apple/Swift-NIO vs identity swift-nio). The
case-sensitive TrimSuffix left the repo segment in the namespace for such
repos, reintroducing the duplicated-name purl. Compare the trailing segment
with EqualFold and add unit coverage for swiftPackageManagerPackageURL.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sai Asish Y <say.apm35@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-08 12:55:13 -04:00
Alex Goodman
002a326c41
detect Ubuntu Pro/ESM extended support ( #5028 )
...
Mirrors the existing RHEL `ExtendedSupport` detector for Ubuntu so grype can
auto-enable its ESM distro channel on Pro/ESM-enabled scans.
`findUbuntuFeatures` sets `linux.Release.ExtendedSupport` when the scanned OS is
Ubuntu and any of these hold:
- an uncommented apt source (classic `.list` or DEB822 `.sources`, or the
ubuntu-advantage auth entry) referencing `esm.ubuntu.com`
- an enabled `esm-infra`/`esm-apps` service in the ubuntu-advantage
`status.json` cache
- an installed dpkg package whose version carries an `[~+]esm` pocket suffix
(the usual in-image signal, since containers are rarely Pro-attached)
The package fallback reads `s.Artifacts.Packages` from the `DetectFeatures`
SBOM callback, which runs after package cataloging, so no new plumbing was
needed. Conservative by design: plain Ubuntu and disabled/commented ESM
evidence stay false.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-07 10:11:15 -04:00
OsamaSE
3e399256b3
fix(debian): supplement point release from /etc/debian_version ( #4997 )
...
Debian's /etc/os-release declares only the major version in VERSION_ID (e.g. "13"), while /etc/debian_version carries the point release (e.g. "13.5"). The cataloger previously skipped debian_version whenever os-release already had a Version/VersionID, so point releases were lost.
Signed-off-by: Osama Elhindawy <25825931+OsamaSE@users.noreply.github.com >
2026-07-06 15:18:37 +00:00
Marcus
ebac92a86e
fix: conanfile comments in [requires] no longer stop dependency detection ( #5020 )
...
The [requires] section parser set inRequirements=false when it
encountered a comment line (#) inside the section, because the comment
check was OR'd with the section-change check. Any dependency listed
after a comment was silently skipped.
Skip blank lines and comments before evaluating section state so they
never toggle inRequirements. Add a regression test fixture with a
comment inside [requires].
Fixes #5017
Signed-off-by: jeff <jfjrh2014@gmail.com >
2026-07-06 15:17:42 +00:00
Synvoya and Synvoya
aebdf4bff4
Fix mix.lock git/path deps mislabeled as hex.pm with bogus PURL ( #5041 )
...
parseMixLock read the version from a hex-only token position and hardcoded a pkg:hex PURL, so git/path deps got a URL-fragment version and a false hex.pm PURL (false CVE matches). Branch on the source atom: git uses the commit SHA, path an empty version, and pkg:hex PURLs are emitted only for hex deps.
Signed-off-by: Synvoya <16019863+Synvoya@users.noreply.github.com >
Co-authored-by: Synvoya <16019863+Synvoya@users.noreply.github.com >
2026-07-06 15:13:20 +00:00
Alex Goodman
f1457f2554
pin php apache fixture to debian snapshot ( #5043 )
...
the plain version pin drifted out from under us: debian mirrors only keep
the latest point release, so 8.2.31 became uninstallable once 8.2.32 shipped
and apt pulled the unpinned transitive php8.2-cli at 8.2.32. pointing apt at
snapshot.debian.org keeps the exact point release installable so the fixture
(and its test expectations) stay reproducible.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-06 11:01:44 -04:00
dependabot[bot]
e4f5df936c
chore(deps): bump anchore/workflows/.github/workflows/release-install-script.yaml ( #5031 )
...
Bumps [anchore/workflows/.github/workflows/release-install-script.yaml](https://github.com/anchore/workflows ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b0c30a80409130d329aaa356fd64a34d8c0b3375...7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/release-install-script.yaml
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-06 10:59:47 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
8c0d21e147
chore(deps): update CPE dictionary index ( #5042 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-07-06 10:56:45 -04:00
dependabot[bot]
6f5c83a558
chore(deps): bump actions/checkout from 6.0.3 to 7.0.0 ( #5024 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.3 to 7.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/df4cb1c069e1874edd31b4311f1884172cec0e10...9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:42:48 +00:00
dependabot[bot]
ee48c01c06
chore(deps): bump actions/cache/restore in /.github/actions/bootstrap ( #5037 )
...
Bumps [actions/cache/restore](https://github.com/actions/cache ) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9 )
---
updated-dependencies:
- dependency-name: actions/cache/restore
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:31:51 +00:00
dependabot[bot]
f6bf15bb3c
chore(deps): bump golang.org/x/tools from 0.46.0 to 0.47.0 ( #5038 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.46.0 to 0.47.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.46.0...v0.47.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.47.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:31:03 +00:00
dependabot[bot]
312f2532d0
chore(deps): bump modernc.org/sqlite from 1.51.0 to 1.53.0 ( #5039 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.51.0 to 1.53.0.
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.51.0...v1.53.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.53.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:30:45 +00:00
dependabot[bot]
f2c9463e76
chore(deps): bump anchore/go-make/.github/actions/setup ( #5036 )
...
Bumps [anchore/go-make/.github/actions/setup](https://github.com/anchore/go-make ) from 0.6.0 to 0.8.0.
- [Release notes](https://github.com/anchore/go-make/releases )
- [Commits](https://github.com/anchore/go-make/compare/39fe5f71112d4dceb3ff0a92a40f272f067fc457...430e2175bb166bfd138ef75466adbcc8ddab875f )
---
updated-dependencies:
- dependency-name: anchore/go-make/.github/actions/setup
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:30:15 +00:00
dependabot[bot]
4eb61fc104
chore(deps): bump anchore/workflows/.github/workflows/check-gate.yaml ( #5034 )
...
Bumps [anchore/workflows/.github/workflows/check-gate.yaml](https://github.com/anchore/workflows ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b0c30a80409130d329aaa356fd64a34d8c0b3375...7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/check-gate.yaml
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:50 +00:00
dependabot[bot]
832d96c1dd
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #5035 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.5 to 6.1.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/27d5ce7f107fe9357f9df03efb73ab90386fccae...55cc8345863c7cc4c66a329aec7e433d2d1c52a9 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:37 +00:00
dependabot[bot]
5a7a72b53e
chore(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 ( #5030 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.5.6 to 0.5.7.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/5f14fd08f7cf1cb1609c1e344975f152c7ee938d...192e21d79ab29983730a13d1382995c2307fbcaa )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:27 +00:00
dependabot[bot]
df1fc98e7a
chore(deps): bump anchore/workflows/.github/workflows/codeql.yaml ( #5032 )
...
Bumps [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows ) from 0.7.2 to 0.8.0.
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b0c30a80409130d329aaa356fd64a34d8c0b3375...7212994dc8fc3a53fe9c8e766ab5b4ddd16ea3d4 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/codeql.yaml
dependency-version: 0.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-07-03 13:26:04 +00:00
gab and Alex Goodman
656a4d46d7
Vcpkg Cataloger ( #4081 )
...
* Vcpkg cataloger for vcpkg "Manifest Mode"
Find and parse vcpkg-lock.json to get HEAD commit hash
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* just use local vcpkg git repo if it exists, clone it if it doesn't
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Config opt for git remote clones for vcpkg and README update
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* Look in vcpkg cache git repo for custom git repos
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add triplet to metadata and support overlay-ports from config file
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Add PURL to packages (not sure if this is correct)
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* flatten structs in pkg module and move vcpkg structs to resolver
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* account for overriden versions in toplevel manifest
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema for vcpkg metadata
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* test for basic vcpkg project
dependencies for vcpkg registry to be pulled in
add tree hashes and use correct git hash in builtin-baseline for helloworld test
vcpkg-registry for testing that uses object hashes from syft repo
fix broken tests
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* formatting
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* fix static-analysis violations
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration test failure
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* remove uneeded files from vcpkg test fixture and use custom registry
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* change vcpkg registry to anchore one
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* purl spec based on open PR
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate-json-schema
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rebased and generate json schema 16.0.40
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
* address low hanging fruit
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* handle additional comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve docs and testing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove license from pkg metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix capabilities claim
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Gabriel Rau <gabetrau@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-07-01 09:11:33 -04:00
Rez Moss and Alex Goodman
148fe572bc
added macOS .app cataloger ( #4490 )
...
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* added macOS .app cataloger, fixed #4010
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump schema to 16.1.7
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address static analysis failures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expand fields and improve test coverage
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-30 10:32:57 -04:00
Keith Zantow
deee79411a
fix: composite action version parsing ( #4616 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-29 15:23:47 -04:00
e7f1a803e7
fixed dotnet cataloger can't find packages from deps.json in linux el… ( #4517 )
...
* fixed dotnet cataloger can't find packages from deps.json in linux elf, fixed #4514
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split bundle and PE concerns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* limit resource usage of readall call
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* removed duplicat
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* make sure the first 4 bytes in elf arent lostt
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert readelfbundle func, check size of readdeps json
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert readelfbundle func, check size of readdeps json, fixed #4514
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move dotnet net8 linux fixture to testdata convention
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address malformed elf size claims + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont key off of cataloger name in testing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-29 13:52:55 -04:00
sputnik-mac and Alex Goodman
a34f86fba1
fix(template): expose sprig date/time functions in Go templates ( #4644 )
...
* fix(template): expose sprig date functions in Go templates
Replace HermeticTxtFuncMap with TxtFuncMap to expose date/time
functions (now, date, dateInZone, etc.) while still excluding
security-sensitive env/expandenv functions.
Users can now use date functions in templates, e.g.:
{{ now | unixEpoch }}
{{ now | date "2006-01-02" }}
Fixes #2372
Signed-off-by: Sputnik-MAC <sputnik.mac.001@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* invert to add functions to the hermetic set, not the other way around
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sputnik-MAC <sputnik.mac.001@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-29 11:55:51 -04:00
e388b5249d
Add support for MIT and Heimdal Kerberos 5 library detection ( #4781 )
...
* Add support for MIT and Heimdal Kerberos 5 library detection
Signed-off-by: Nadim Zubidat <nadimz@users.noreply.github.com >
* support 2-component case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Nadim Zubidat <nadimz@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Nadim Zubidat <nadimz@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-29 11:54:44 -04:00
Archy
1746e96ad3
fix: correct typos and update examples README ( #4703 )
...
Signed-off-by: Artem Muterko <artem@sopho.tech >
2026-06-29 11:16:50 -04:00
Sai Asish Y and Alex Goodman
956858fc11
ruby/gemspec: resolve simple #{s.name}/#{s.version} interpolation ( #4782 )
...
* ruby/gemspec: resolve simple #{s.name}/#{s.version} interpolation
Reported in anchore/syft#4720 : scanning projects that depend on gems
like formatador leaks literal Ruby interpolation into the emitted
SBOM, e.g.
"externalReferences": [
{ "url": "https://github.com/geemus/#{s.name} ", "type": "website" }
]
because formatador.gemspec uses
s.homepage = "https://github.com/geemus/#{s.name} "
and parseGemSpecEntries reads the file as plain text instead of
evaluating it. The interpolation leaks through the captured homepage
field and on into any externalReferences entry the cataloger produces.
Dependency Track then rejects the whole BOM because '{' and '}' are
not valid IRI-reference characters (RFC 3987).
Add a post-parse pass that substitutes the common interpolation forms
(#{s.name}, #{gem.name}, #{name}, and the matching #{*.version}
variants) in captured string fields using values already parsed from
the same gemspec. Anything still containing '#{' after best-effort
substitution is an unresolvable Ruby expression, and for URL-like
fields (currently just homepage) we drop the field entirely so the
SBOM is always schema-valid; callers would rather miss a homepage URL
than emit one that breaks downstream tools.
Adds testdata/formatador.gemspec, a minimal real-world gemspec using
the #{s.name} pattern, plus a new parser test asserting that the
homepage field comes out fully resolved.
Fixes #4720
Signed-off-by: Sai Asish Y <say.apm35@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve test cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sai Asish Y <say.apm35@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-29 11:00:48 -04:00
Chris Greeno
37fee88b5c
feat(elixir): emit dependency relationships from mix.lock ( #4985 )
...
adds dependency-of relationships between elixir locked packages, matching how other
ecosystem catalogers (alpine, arch, debian, redhat, python) express the
dependency graph via the shared dependency.Processor/Specifier mechanism.
Signed-off-by: Chris Greeno <cgreeno@gmail.com >
2026-06-29 10:22:38 -04:00
sputnik-mac
1143c12a97
fix: add .bpl file extension support to PE/DLL cataloger ( closes #4664 ) ( #4688 )
...
Borland Package Library (.bpl) files are standard Windows PE/DLL files
used in Delphi and C++Builder ecosystems. This adds the .bpl glob
pattern to the PE file discovery so these files are cataloged alongside
.dll and .exe files.
2026-06-29 10:17:52 -04:00
b15c5dbfe2
chore(deps): update anchore dependencies ( #4960 )
...
* chore(deps): update anchore dependencies
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
* update snapshots
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-25 15:26:14 -04:00
Alex Goodman
35d56bfb99
Update go-make to v0.8.0 ( #5010 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-25 15:01:40 -04:00
Alex Goodman
abf6d78dfc
fixes the wrapped taskfile-tasks ( #5013 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-24 11:22:16 -04:00
Will Murphy
fe42bcec38
fix(purl-backfill): respect arch qualifier ( #4987 )
...
* fix(purl-backfill): respect arch qualifier
Previously, when constructing rpm, alpm, and apk metadata struct from a
PURL, Syft would ignore the arch qualifier. Start respecting that
qualifier.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: fix static analysis
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* Clean up control flow in PURL backfill code
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-06-23 15:23:46 -04:00
Rez Moss and Christopher Phillips
fea4a50124
feat: deno cataloger #4417 ( #4523 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-23 10:58:22 -04:00
dependabot[bot]
5eefd73ac7
chore(deps): bump golang.org/x/tools from 0.45.0 to 0.46.0 ( #5008 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.45.0 to 0.46.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.45.0...v0.46.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.46.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:50:24 +00:00
dependabot[bot]
684c7018be
chore(deps): bump golang.org/x/net from 0.55.0 to 0.56.0 ( #5004 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.55.0 to 0.56.0.
- [Commits](https://github.com/golang/net/compare/v0.55.0...v0.56.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.56.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:34:47 +00:00
dependabot[bot]
f827f91ec1
chore(deps): bump golang.org/x/mod from 0.36.0 to 0.37.0 ( #5007 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.36.0 to 0.37.0.
- [Commits](https://github.com/golang/mod/compare/v0.36.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:19:47 +00:00
dependabot[bot]
e9af7d218c
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.10 to 6.8.1 ( #5006 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.10 to 6.8.1.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.10...v6.8.1 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.8.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 18:18:54 +00:00
Alex Goodman
506ad5d6a7
refactor release pipeline: TAG_TOKEN, skip-checks gate, dependabot/zizmor cleanup ( #5003 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 14:04:48 -04:00
Rez Moss
1f4f9332c5
feat: support envoy bin classifier
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-22 13:16:33 -04:00
Rez Moss
52a4c3b594
feat: elastic beats bin classifier ( #4969 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-22 11:49:44 -04:00
Keith Zantow
9c321691d4
feat: SPDX 3 ( #4269 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-22 10:59:34 -04:00
Alex Goodman
0e8d6deabe
require tmpdir to exist for fingerprints ( #5002 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 10:54:26 -04:00
dependabot[bot]
deb2fd92ef
chore(deps): bump github.com/containerd/containerd/v2 ( #5001 )
...
Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd ) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v2.3.1...v2.3.2 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
dependency-version: 2.3.2
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-22 14:12:11 +00:00
Alex Goodman
80d3b62de4
bump go-make to v0.7.0 ( #4999 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-22 09:47:58 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
b71afc87fc
chore(deps): update tool versions ( #4994 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-06-19 11:51:05 +00:00
Alex Goodman
efe3174b5f
Preserve dependency edges when a compliance stub changes a package ID ( #4993 )
...
* fix relationship rewrites for isolated nodes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* cover dangling pointers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-18 19:50:30 -04:00
Rez Moss
58e4dbbf01
feat: added bin classifier elastic-agent ( #4968 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-17 15:29:07 +00:00
Sebastiaan van Stijn
b70fa899cb
golangci-lint: enable gci formatter ( #4828 )
...
This allows linting the imports to be grouped correctly, and provides
an auto-fix (`golangci-lint run --fix`).
Signed-off-by: Sebastiaan van Stijn <github@gone.nl >
2026-06-17 10:34:22 -04:00
Alex Goodman
951fbd454a
add purl types to cataloger info cmd ( #4984 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-16 12:13:34 -04:00
Rez Moss
92ae4d44c5
fix: .net deps.json cataloger no longer shows phantom pkgs ( #4971 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-06-16 12:02:42 -04:00
Alex Goodman
8d48a8b8c2
ensure we have a snapshot build for cli tests ( #4981 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-16 10:41:33 -04:00
David Dashti and Alex Goodman
cff5a05681
fix(dpkg): extract License field for opkg/ipkg entries ( #4963 )
...
* fix(dpkg): extract License field for opkg/ipkg entries
opkg and ipkg use the dpkg cataloger but declare the package License
inline in the status DB (unlike Debian dpkg, where licenses live in
copyright files). The cataloger silently dropped the License field at
mapstructure decode time, so all opkg-managed packages reported empty
licenses.
This adds the field to the intermediate decode struct and the public
DpkgDBEntry, and populates licenses in newDpkgPackage using the alpine
cataloger's pattern: try license.ParseExpression first to keep valid
SPDX expressions whole, fall back to whitespace splitting for
space-separated lists.
Standard Debian dpkg status files never carry a License field per
Debian policy, so the new path is a no-op for them; the existing
copyright-file lookup in addLicenses is unaffected.
Closes #4940
Signed-off-by: David Dashti <47575784+Dashtid@users.noreply.github.com >
* remove license from dpkg metadata struct
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore format snapshot files
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add additional tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: David Dashti <47575784+Dashtid@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-06-15 16:15:32 -04:00
Kursat Topcuoglu and Kursat Topcuoglu
00ca43d24a
fix: catalog uv PEP 723 script lockfiles (*.py.lock) ( #4950 )
...
Signed-off-by: Kursat Topcuoglu <7313835+ktopcuoglu@users.noreply.github.com >
Co-authored-by: Kursat Topcuoglu <7313835+ktopcuoglu@users.noreply.github.com >
2026-06-15 11:34:02 -04:00
dependabot[bot]
6a27678036
chore(deps): bump the actions-minor-patch group across 2 directories with 6 updates ( #4975 )
...
Bumps the actions-minor-patch group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
| [anchore/workflows/.github/workflows/check-version-available.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
| [anchore/workflows/.github/workflows/check-gate.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
| [actions/checkout](https://github.com/actions/checkout ) | `6.0.2` | `6.0.3` |
| [anchore/workflows/.github/workflows/release-install-script.yaml](https://github.com/anchore/workflows ) | `0.7.0` | `0.7.2` |
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [anchore/go-make](https://github.com/anchore/go-make ).
Updates `anchore/workflows/.github/workflows/codeql.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `anchore/workflows/.github/workflows/check-version-available.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `anchore/workflows/.github/workflows/check-gate.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `actions/checkout` from 6.0.2 to 6.0.3
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd...df4cb1c069e1874edd31b4311f1884172cec0e10 )
Updates `anchore/workflows/.github/workflows/release-install-script.yaml` from 0.7.0 to 0.7.2
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5...b0c30a80409130d329aaa356fd64a34d8c0b3375 )
Updates `anchore/go-make` from 0.5.0 to 0.6.0
- [Release notes](https://github.com/anchore/go-make/releases )
- [Commits](https://github.com/anchore/go-make/compare/9de27be11ed73e2f9d5406a836a492b7d8aa1225...39fe5f71112d4dceb3ff0a92a40f272f067fc457 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/codeql.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-version-available.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-gate.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: actions/checkout
dependency-version: 6.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/release-install-script.yaml
dependency-version: 0.7.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/go-make
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-12 13:29:23 +00:00
Keith Zantow
89773c0a12
fix: support CycloneDX 1.7 ( #4967 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-11 09:40:42 -04:00
Yoonho Hann and Christopher Phillips
b08d3c2970
feat: add support for Bun lockfile ( #4625 )
...
---------
Signed-off-by: Yoonho Hann <hnnynh125@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-09 13:22:43 -04:00
Keith Zantow
63232bf725
fix: local version identifiers in python requirements parsing ( #4959 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-06-08 11:12:47 -04:00
Marcus and Christopher Phillips
908eb57890
feat: add .bpl extension to PE cataloger ( #4954 )
...
BPL (Borland Package Library) files are standard PE/DLL format used by
Delphi and C++Builder. Adding the extension to the glob list so syft
picks them up during directory scans without users needing to rename
to .dll first.
---------
Signed-off-by: jfjrh2014 <jfjrh2014@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-08 10:07:15 -04:00
Arpit Jain
c5c423ab37
fix: detect mariadb version from RHEL build path ( #4952 )
...
Signed-off-by: Arpit Jain <arpitjain099@gmail.com >
2026-06-07 13:28:18 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
d4496b05aa
chore(deps): update anchore dependencies ( #4934 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-06-05 13:55:57 +00:00
dependabot[bot]
adc55cdb3a
chore(deps): bump the go-minor-patch group across 1 directory with 3 updates ( #4957 )
...
Bumps the go-minor-patch group with 3 updates in the / directory: [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ), [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go ) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ).
Updates `github.com/gkampitakis/go-snaps` from 0.5.21 to 0.5.22
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.21...v0.5.22 )
Updates `github.com/gpustack/gguf-parser-go` from 0.24.0 to 0.24.1
- [Release notes](https://github.com/gpustack/gguf-parser-go/releases )
- [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.24.0...v0.24.1 )
Updates `modernc.org/sqlite` from 1.50.1 to 1.51.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.50.1...v1.51.0 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.22
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/gpustack/gguf-parser-go
dependency-version: 0.24.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.51.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-06-05 13:28:05 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
00d0bb59cc
chore(deps): update tool versions ( #4724 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-06-05 11:22:28 +00:00
dependabot[bot] and Christopher Phillips
f474308783
chore(deps): bump the go-minor-patch group across 2 directories with 14 updates ( #4947 )
...
* chore(deps): bump the go-minor-patch group across 2 directories with 14 updates
Bumps the go-minor-patch group with 9 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) | `0.10.0` | `0.11.0` |
| [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver ) | `3.4.0` | `3.5.0` |
| [github.com/diskfs/go-diskfs](https://github.com/diskfs/go-diskfs ) | `1.7.0` | `1.9.3` |
| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) | `2.4.0` | `2.7.0` |
| [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) | `0.21.5` | `0.21.6` |
| [github.com/gookit/color](https://github.com/gookit/color ) | `1.6.0` | `1.6.1` |
| [github.com/invopop/jsonschema](https://github.com/invopop/jsonschema ) | `0.13.0` | `0.14.0` |
| [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) | `6.7.8` | `6.7.10` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) | `1.46.2` | `1.50.1` |
Bumps the go-minor-patch group with 1 update in the /.make directory: [github.com/anchore/go-make](https://github.com/anchore/go-make ).
Updates `github.com/CycloneDX/cyclonedx-go` from 0.10.0 to 0.11.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.10.0...v0.11.0 )
Updates `github.com/Masterminds/semver/v3` from 3.4.0 to 3.5.0
- [Release notes](https://github.com/Masterminds/semver/releases )
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Masterminds/semver/compare/v3.4.0...v3.5.0 )
Updates `github.com/diskfs/go-diskfs` from 1.7.0 to 1.9.3
- [Commits](https://github.com/diskfs/go-diskfs/compare/v1.7.0...v1.9.3 )
Updates `github.com/github/go-spdx/v2` from 2.4.0 to 2.7.0
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.4.0...v2.7.0 )
Updates `github.com/google/go-containerregistry` from 0.21.5 to 0.21.6
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.21.5...v0.21.6 )
Updates `github.com/gookit/color` from 1.6.0 to 1.6.1
- [Release notes](https://github.com/gookit/color/releases )
- [Commits](https://github.com/gookit/color/compare/v1.6.0...v1.6.1 )
Updates `github.com/invopop/jsonschema` from 0.13.0 to 0.14.0
- [Release notes](https://github.com/invopop/jsonschema/releases )
- [Commits](https://github.com/invopop/jsonschema/compare/v0.13.0...v0.14.0 )
Updates `github.com/jedib0t/go-pretty/v6` from 6.7.8 to 6.7.10
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.8...v6.7.10 )
Updates `github.com/klauspost/compress` from 1.18.5 to 1.18.6
- [Release notes](https://github.com/klauspost/compress/releases )
- [Commits](https://github.com/klauspost/compress/compare/v1.18.5...v1.18.6 )
Updates `golang.org/x/mod` from 0.35.0 to 0.36.0
- [Commits](https://github.com/golang/mod/compare/v0.35.0...v0.36.0 )
Updates `golang.org/x/net` from 0.53.0 to 0.54.0
- [Commits](https://github.com/golang/net/compare/v0.53.0...v0.54.0 )
Updates `golang.org/x/tools` from 0.44.0 to 0.45.0
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.44.0...v0.45.0 )
Updates `modernc.org/sqlite` from 1.46.2 to 1.50.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.46.2...v1.50.1 )
Updates `github.com/anchore/go-make` from 0.4.0 to 0.5.0
- [Release notes](https://github.com/anchore/go-make/releases )
- [Commits](https://github.com/anchore/go-make/compare/v0.4.0...v0.5.0 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-version: 0.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/Masterminds/semver/v3
dependency-version: 3.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/diskfs/go-diskfs
dependency-version: 1.9.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/github/go-spdx/v2
dependency-version: 2.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.21.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/gookit/color
dependency-version: 1.6.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/invopop/jsonschema
dependency-version: 0.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/klauspost/compress
dependency-version: 1.18.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: golang.org/x/mod
dependency-version: 0.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/net
dependency-version: 0.54.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/tools
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.50.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/anchore/go-make
dependency-version: 0.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* fix: update signatures to return fs.FileInfo after breaking changes
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* fix: lint-fix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-06-04 17:06:25 -04:00
Will Murphy
bf67072246
chore: bump golang.org/x/crypto ( #4955 )
...
* chore: bump golang.org/x/crypto
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* also bump golang.org/x/net
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-06-04 16:06:08 -04:00
Will Murphy
9673f867e5
Pass contents: read to check-gate ( #4951 )
...
Otherwise check-gate doesn't have enough permissions to do its job and
fails.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-06-02 16:05:42 -04:00
Matias Insaurralde
a4fb2c0396
perf(python): hoist name normalization regexp to package level ( #4926 )
...
Avoid recompiling the separator pattern on every normalize() call during cataloging.
Signed-off-by: Matías Insaurralde <matias@insaurral.de >
2026-06-01 21:17:43 -04:00
witchcraze
cf2ce643c3
update helm classifier ( #4922 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-06-01 10:21:57 -04:00
dependabot[bot]
524a44b70d
chore(deps): bump the actions-minor-patch group across 1 directory with 6 updates ( #4946 )
...
Bumps the actions-minor-patch group with 6 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows ) | `0.6.0` | `0.7.0` |
| [anchore/workflows/.github/workflows/check-version-available.yaml](https://github.com/anchore/workflows ) | `0.6.0` | `0.7.0` |
| [anchore/workflows/.github/workflows/check-gate.yaml](https://github.com/anchore/workflows ) | `0.6.0` | `0.7.0` |
| [docker/login-action](https://github.com/docker/login-action ) | `4.1.0` | `4.2.0` |
| [anchore/workflows/.github/workflows/release-install-script.yaml](https://github.com/anchore/workflows ) | `0.6.0` | `0.7.0` |
| [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) | `0.5.5` | `0.5.6` |
Updates `anchore/workflows/.github/workflows/codeql.yaml` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/15122524ced7906bfa9685eeae12e22647773ea6...b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5 )
Updates `anchore/workflows/.github/workflows/check-version-available.yaml` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/15122524ced7906bfa9685eeae12e22647773ea6...b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5 )
Updates `anchore/workflows/.github/workflows/check-gate.yaml` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/15122524ced7906bfa9685eeae12e22647773ea6...b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5 )
Updates `docker/login-action` from 4.1.0 to 4.2.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/4907a6ddec9925e35a0a9e82d7399ccc52663121...650006c6eb7dba73a995cc03b0b2d7f5ca915bee )
Updates `anchore/workflows/.github/workflows/release-install-script.yaml` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/anchore/workflows/releases )
- [Commits](https://github.com/anchore/workflows/compare/15122524ced7906bfa9685eeae12e22647773ea6...b3e328b5ae31ba96297e2ed9a6124e5e6352a4c5 )
Updates `zizmorcore/zizmor-action` from 0.5.5 to 0.5.6
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/a16621b09c6db4281f81a93cb393b05dcd7b7165...5f14fd08f7cf1cb1609c1e344975f152c7ee938d )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/codeql.yaml
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-version-available.yaml
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-gate.yaml
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: docker/login-action
dependency-version: 4.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/release-install-script.yaml
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-29 16:35:04 +00:00
witchcraze
4e86715c1a
fix: improve julia classifier to find shared libs and beta versions ( #4945 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-05-29 12:05:46 -04:00
Alex Goodman
e8c6b7151e
swap postgres signature check for rocky linux baseline rpm ( #4941 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-26 10:11:38 -04:00
witchcraze
0fb8762f41
fix: improve deno classifier ( #4939 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-05-25 11:58:10 -04:00
dependabot[bot]
58ddf74140
chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates ( #4936 )
...
Bumps the actions-minor-patch group with 1 update in the / directory: [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [anchore/go-make](https://github.com/anchore/go-make ).
Updates `zizmorcore/zizmor-action` from 0.5.3 to 0.5.5
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/b1d7e1fb5de872772f31590499237e7cce841e8e...a16621b09c6db4281f81a93cb393b05dcd7b7165 )
Updates `anchore/go-make` from 0.4.0 to 0.5.0
- [Release notes](https://github.com/anchore/go-make/releases )
- [Commits](https://github.com/anchore/go-make/compare/88c36505984649108439f13fb35dcaea4ce61d94...9de27be11ed73e2f9d5406a836a492b7d8aa1225 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: anchore/go-make
dependency-version: 0.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-22 13:42:36 +00:00
dependabot[bot]
b5d828ee14
chore(deps): bump github.com/containerd/containerd/v2 ( #4935 )
...
Bumps [github.com/containerd/containerd/v2](https://github.com/containerd/containerd ) from 2.3.0 to 2.3.1.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v2.3.0...v2.3.1 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd/v2
dependency-version: 2.3.1
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-21 22:17:36 +00:00
Doug Clarke
1c4394fed0
fix: enhancement to java cataloger to consider .zap files as jar files ( #4932 )
...
* Enhancements to java cataloger to consider .zap files as jar files - Issue #4654
Signed-off-by: Doug Clarke <douglas.clarke@oracle.com >
2026-05-21 15:24:38 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
f5c1a0befc
chore(deps): update anchore dependencies ( #4821 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-05-20 19:50:47 +00:00
dependabot[bot]
b1287d45d8
chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 ( #4930 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.19.0 to 5.19.1.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md )
- [Commits](https://github.com/go-git/go-git/compare/v5.19.0...v5.19.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.19.1
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-19 16:11:18 +00:00
Alex Goodman
d97216ff70
Remediate audit ( #4929 )
...
* remove slack notification on release
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict cache usage
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-18 15:01:37 -04:00
dependabot[bot]
c09a009bda
chore(deps): bump the actions-minor-patch group across 1 directory with 4 updates ( #4927 )
...
Bumps the actions-minor-patch group with 4 updates in the / directory: [anchore/workflows/.github/workflows/codeql.yaml](https://github.com/anchore/workflows ), [anchore/workflows/.github/workflows/check-version-available.yaml](https://github.com/anchore/workflows ), [anchore/workflows/.github/workflows/check-gate.yaml](https://github.com/anchore/workflows ) and [anchore/workflows/.github/workflows/release-install-script.yaml](https://github.com/anchore/workflows ).
Updates `anchore/workflows/.github/workflows/codeql.yaml` from 0.5.0 to 0.6.0
- [Commits](https://github.com/anchore/workflows/compare/e8cee3a5916cebb68cda68b54c180f43394c1910...15122524ced7906bfa9685eeae12e22647773ea6 )
Updates `anchore/workflows/.github/workflows/check-version-available.yaml` from 0.4.0 to 0.6.0
- [Commits](https://github.com/anchore/workflows/compare/8b2b1caf40e03933c6807e03b99e883e2ceb5ac8...15122524ced7906bfa9685eeae12e22647773ea6 )
Updates `anchore/workflows/.github/workflows/check-gate.yaml` from 0.4.0 to 0.6.0
- [Commits](https://github.com/anchore/workflows/compare/8b2b1caf40e03933c6807e03b99e883e2ceb5ac8...15122524ced7906bfa9685eeae12e22647773ea6 )
Updates `anchore/workflows/.github/workflows/release-install-script.yaml` from 0.4.0 to 0.6.0
- [Commits](https://github.com/anchore/workflows/compare/8b2b1caf40e03933c6807e03b99e883e2ceb5ac8...15122524ced7906bfa9685eeae12e22647773ea6 )
---
updated-dependencies:
- dependency-name: anchore/workflows/.github/workflows/codeql.yaml
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-version-available.yaml
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/check-gate.yaml
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/workflows/.github/workflows/release-install-script.yaml
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-18 16:13:54 +00:00
Alex Goodman
d61af0abab
Port to go-make ( #4923 )
...
* port to go-make
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refresh fixtures on running unit tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address refresh cache issues with old now-gitignored files
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-18 11:59:55 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
89cda82263
chore(deps): update CPE dictionary index ( #4925 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-05-18 10:21:30 -04:00
dependabot[bot]
ee6ace36d1
chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates ( #4920 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [runs-on/action](https://github.com/runs-on/action ) and [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ).
Updates `runs-on/action` from 2.1.0 to 2.1.2
- [Release notes](https://github.com/runs-on/action/releases )
- [Commits](https://github.com/runs-on/action/compare/742bf56072eb4845a0f94b3394673e4903c90ff0...d141ef83eb66d096ce8afc767e09115a65c63b60 )
Updates `sigstore/cosign-installer` from 4.1.1 to 4.1.2
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003...6f9f17788090df1f26f669e9d70d6ae9567deba6 )
---
updated-dependencies:
- dependency-name: runs-on/action
dependency-version: 2.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: sigstore/cosign-installer
dependency-version: 4.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-15 13:34:58 +00:00
witchcraze
e2e5e223ab
feat: mysqld, ndbd, ndbmtd and ndb_mgmd classifier ( #4907 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-05-14 11:29:42 -04:00
4579d11abc
fix: detect compressed kernel modules (.ko.gz, .ko.xz, .ko.zst) ( #4740 )
...
* fix: detect compressed kernel modules (.ko.gz, .ko.xz, .ko.zst)
The linux-kernel-cataloger only matched plain *.ko files, missing
compressed modules produced when CONFIG_MODULE_COMPRESS is enabled
(common on Debian 13 / Ubuntu 24.04+). This resulted in near-zero
module packages being reported for such filesystems.
Changes:
- Add *.ko.gz, *.ko.xz, *.ko.zst glob patterns to both the cataloger
and capabilities.yaml so the file resolver picks up compressed modules
- Add decompressedModuleReader() which detects the extension and
transparently decompresses via compress/gzip, ulikunitz/xz, or
klauspost/compress/zstd before handing the ELF bytes to the existing
parseLinuxKernelModuleMetadata parser
- Promote github.com/klauspost/compress from indirect to direct dependency
- Add unit tests covering all three compression formats plus the
uncompressed baseline, using a programmatically generated minimal ELF
Fixes #4721
Signed-off-by: Will Bates <william.bates11@outlook.com >
* address reading archives into memory
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Will Bates <william.bates11@outlook.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Bates <william.bates11@outlook.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-13 13:44:18 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
07ae2ca08d
chore(deps): update CPE dictionary index ( #4909 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-05-13 10:03:11 -04:00
36969bdeff
fix: Allow duplicates in Yarn "Berry" files ( #4691 ) ( #4838 )
...
* fix: Allow duplicates in Yarn "Berry" files (#4691 )
Yarn lockfiles can have multiple versions resolved for the same package
name. We correctly allow this in Yarn v1 lockfiles but the "Berry"
YAML-format lockfiles were doing deduplication by package name. This
change removes that deduplication.
Signed-off-by: Calum Leslie <cleslie@atlassian.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Calum Leslie <cleslie@atlassian.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Calum Leslie <cleslie@atlassian.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-11 21:10:17 +00:00
Alex Goodman
dfb6011083
pin and update fixture versions ( #4913 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-11 16:30:35 -04:00
Alex Goodman
997a486e22
use released shared workflow ( #4914 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-11 16:21:41 -04:00
dependabot[bot]
4f64fbc004
chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 ( #4911 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.18.0 to 5.19.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Changelog](https://github.com/go-git/go-git/blob/main/HISTORY.md )
- [Commits](https://github.com/go-git/go-git/compare/v5.18.0...v5.19.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.19.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-11 16:25:44 +00:00
Alex Goodman
87d6a288d7
Tighten workflow permissions and update release shape ( #4899 )
...
* Rework release workflow to canonical shape
Replace the custom quality-gate job with the reusable check-version-available
and check-gate workflows from anchore/workflows. Remove the phase
workflow_dispatch input; the install-script-only path is now a standalone
workflow (release-install-script.yaml) that can be triggered independently.
- add version-available and check-gate jobs using pinned anchore/workflows SHA
- remove phase input and quality-gate job
- release job now needs [check-gate, version-available]
- release-install-script job no longer conditionally skips based on phase
- add release-install-script.yaml for standalone install script runs
- set permissions: {} at workflow level (contents pushed to release job)
- add concurrency: group: release
Signed-off-by: wagoodman <wagoodman@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Tighten workflow-level permissions to {}
Change top-level permissions from contents: read to {} in validations.yaml
and validate-github-actions.yaml, pushing the needed contents: read down
to each job that performs a checkout.
Signed-off-by: wagoodman <wagoodman@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep install script phase, remove workflow
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove schema detection workflow
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: wagoodman <wagoodman@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-08 17:16:31 -04:00
dependabot[bot]
20987d30d0
chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates ( #4897 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action ) and [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action ).
Updates `github/codeql-action` from 4.35.2 to 4.35.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/95e58e9a2cdfd71adc6e0353d5c52f41a045d225...e46ed2cbd01164d986452f91f178727624ae40d7 )
Updates `slackapi/slack-github-action` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/slackapi/slack-github-action/releases )
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/slackapi/slack-github-action/compare/03ea5433c137af7c0495bc0cad1af10403fc800c...45a88b9581bfab2566dc881e2cd66d334e621e2c )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: slackapi/slack-github-action
dependency-version: 3.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-08 13:38:31 +00:00
witchcraze
e2007d9bf2
feat: add aws-lc classifier ( #4882 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-05-06 16:43:34 -04:00
ChrisJr404 and Chris
4f0e32ab51
binary classifier: detect elixir release-candidate versions ( #4851 )
...
The elixir-binary and elixir-library classifiers' regexes only matched
the bare semver triplet (and a single sub-segment for the library), so
release-candidate elixir images were either missed entirely or had
their version truncated:
$ syft -q elixir:1.12.0-rc | grep elixir # nothing
$ syft -q elixir:1.13.0-rc.0 | grep elixir
elixir 1.13.0 binary # truncated, "-rc.0" lost
Extend the version capture group to optionally include
"-<a-z0-9>+(\\.<digits>)?" so "1.12.0-rc.1", "1.13.0-rc.0", etc. match
exactly as the elixir.app and the binary's ELIXIR_VERSION line have
them.
Add a logical fixture under testdata/classifiers/snippets/elixir/
1.12.0-rc.1/linux-amd64 (cloned from the existing 1.19.1 fixture with
just the version strings changed) and register it in
Test_Cataloger_PositiveCases.
Closes #4819
Signed-off-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
Co-authored-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
2026-05-06 15:14:09 +00:00
witchcraze
605391114c
add ingress-nginx classifier ( #4857 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-05-06 14:54:20 +00:00
ChrisJr404
1caf243d29
fix(source): treat exclude paths with trailing slash as directories ( #4892 )
...
A trailing slash on --exclude (e.g. './lib/') is dropped during pattern
normalization but doublestar.Match still requires an exact string match,
so the resulting pattern silently matches nothing and the directory is
not excluded. Strip a trailing slash so './lib/' and './lib' behave the
same.
Fixes #4839
Signed-off-by: ChrisJr404 <chris@hacknow.com >
2026-05-06 14:51:41 +00:00
PGray and PGray
48e91312e8
fix(dotnet): align runtime CPEs with NVD ( #4743 )
...
Signed-off-by: PGray <PGrayCS@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: PGray <PGrayCS@users.noreply.github.com >
2026-05-06 13:07:49 +00:00
d81df67493
fix(debian): only parse machine-readable copyright files with Format header ( #4754 )
...
* fix(debian): only parse machine-readable copyright files with Format header
Only parse debian/copyright files as machine-readable DEP-5 format when
they contain the mandatory Format header field pointing to the copyright
specification URI. Files without this header are free-form text and
should not have License: regex patterns applied to them, which previously
produced nonsensical results like "#", "Permission", "This", "see" for
non-machine-readable files.
The fallback license classifier in the debian cataloger will handle
non-machine-readable files by doing full-text license identification.
Closes #4708
Signed-off-by: Bahtya <bahtya@users.noreply.github.com >
Signed-off-by: Bahtya <bahtayr@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* decompose parseLicensesFromCopyright to address linting issues
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Bahtya <bahtya@users.noreply.github.com >
Signed-off-by: Bahtya <bahtayr@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Bahtya <bahtayr@gmail.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-06 13:02:27 +00:00
dependabot[bot]
47cda2b5ef
chore(deps): bump the actions-minor-patch group across 2 directories with 5 updates ( #4846 )
...
Bumps the actions-minor-patch group with 4 updates in the / directory: [github/codeql-action](https://github.com/github/codeql-action ), [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ), [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [actions/cache](https://github.com/actions/cache ).
Updates `github/codeql-action` from 4.35.1 to 4.35.2
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/c10b8064de6f491fea524254123dbe5e09572f13...95e58e9a2cdfd71adc6e0353d5c52f41a045d225 )
Updates `marocchino/sticky-pull-request-comment` from 3.0.3 to 3.0.4
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/d4d6b0936434b21bc8345ad45a440c5f7d2c40ff...0ea0beb66eb9baf113663a64ec522f60e49231c0 )
Updates `slackapi/slack-github-action` from 3.0.1 to 3.0.2
- [Release notes](https://github.com/slackapi/slack-github-action/releases )
- [Changelog](https://github.com/slackapi/slack-github-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/slackapi/slack-github-action/compare/af78098f536edbc4de71162a307590698245be95...03ea5433c137af7c0495bc0cad1af10403fc800c )
Updates `zizmorcore/zizmor-action` from 0.5.2 to 0.5.3
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/71321a20a9ded102f6e9ce5718a2fcec2c4f70d8...b1d7e1fb5de872772f31590499237e7cce841e8e )
Updates `actions/cache` from 5.0.4 to 5.0.5
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/668228422ae6a00e4ad889ee87cd7109ec5666a7...27d5ce7f107fe9357f9df03efb73ab90386fccae )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.35.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: marocchino/sticky-pull-request-comment
dependency-version: 3.0.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: slackapi/slack-github-action
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: actions/cache
dependency-version: 5.0.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-05-05 11:42:04 -04:00
Rayan Salhab and cyphercodes
ae711963d1
fix: parse arbitrary equality python requirements ( #4835 )
...
Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: cyphercodes <cyphercodes@users.noreply.github.com >
2026-05-05 13:49:03 +00:00
Alex Goodman
f878197150
chore: remove common workflows ( #4881 )
...
Removes deprecated common workflows now centralized elsewhere.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-05-04 14:31:07 -04:00
witchcraze
514efb03e0
fix: prevent redis classifier from detecting valkey ( #4619 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-05-04 14:07:29 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
1e4f424f09
chore(deps): update CPE dictionary index ( #4831 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-05-04 10:14:08 -04:00
ChrisJr404
b5f0877967
fix: map "nuget" purl type to DotnetPkg in TypeByName ( #4848 )
...
Signed-off-by: Chris (ChrisJr404) <11917633+ChrisJr404@users.noreply.github.com >
2026-05-04 08:51:19 -04:00
Rayan Salhab
8cb78ce40c
fix: resolve yarn lock aliases to source package ( #4836 )
...
Signed-off-by: cyphercodes <cyphercodes@users.noreply.github.com >
2026-04-29 09:50:09 -04:00
witchcraze
3b046b3787
chore: move snippet files from test-fixtures to testdata ( #4830 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-04-27 11:09:21 -04:00
Ludovic Henry
05cc8ee5f4
Add support for linux-riscv64 ( #4757 )
2026-04-27 10:21:41 +00:00
Akihiko Komada
3562dab445
fix(lua-rockspec): handle empty and whitespace-only rockspec files gracefully ( #4827 )
...
Empty or whitespace-only .rockspec files cause parseRockspecBlock to
panic with "index out of range" because the existing end-of-data guard
requires len(out) > 0 before returning the "unexpected end of block"
error, letting the bare data[*i] access on the next line crash.
Split the guard so that:
- partial content at end of data still returns the existing error
- empty data (or whitespace-only) returns an empty block cleanly
Closes #4824 .
Signed-off-by: Akihiko Komada <aki1770@gmail.com >
2026-04-24 12:44:25 -04:00
Sebastiaan van Stijn
014a4c9c59
chore: tidy go.mod ( #4823 )
...
Signed-off-by: Sebastiaan van Stijn <github@gone.nl >
2026-04-23 18:07:11 -04:00
Rez Moss
3cb838eacf
fixed pe dotnet wrong ver , fixed #4813 ( #4814 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-04-22 20:55:56 -04:00
Sai Asish Y
758324b3e8
fix: propagate non-EOF errors out of safeCopy ( #4807 )
...
Signed-off-by: SAY-5 <SAY-5@users.noreply.github.com >
2026-04-22 12:06:03 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
390cf6cce0
chore(deps): update anchore dependencies ( #4797 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-22 15:09:10 +00:00
Will Murphy and anchore-oss-update-bot
4393654d03
Chore fix sync bump ( #4809 )
...
* chore(deps): update anchore dependencies
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
* chore: update test to account for sync wrapping panic
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-22 08:48:30 -04:00
Weston Steimel
d179724f42
fix: improve redhat-release parsing fallback for RHEL clones ( #4808 )
...
Ensures the correct distro id for AlmaLinux and Rocky Linux when falling
back to parsing distro information from the redhat-release file. Also
sets the idlike to `rhel` for these instances as that is necessary to
ensure correct vulnerability data matching.
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2026-04-22 08:48:08 -04:00
Alex Goodman
2ddaaac706
restore go minimum version to 1.25.8 ( #4805 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-21 15:20:14 -04:00
Alex Goodman
073b4c5d55
chore(deps): restore Go version to 1.25.8 ( #4804 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-21 19:02:26 +00:00
witchcraze
ff6c34de7e
fix: improve haskell classifiers ( #4793 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-04-20 12:23:35 -04:00
dependabot[bot]
66ba575ae2
chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates ( #4790 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) and [actions/upload-artifact](https://github.com/actions/upload-artifact ).
Updates `marocchino/sticky-pull-request-comment` from 3.0.2 to 3.0.3
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/70d2764d1a7d5d9560b100cbea0077fc8f633987...d4d6b0936434b21bc8345ad45a440c5f7d2c40ff )
Updates `actions/upload-artifact` from 7.0.0 to 7.0.1
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/bbbca2ddaa5d8feaa63e36b76fdaad77386f024f...043fb46d1a93c77aae656e7c1c64a875d1fc6a0a )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-version: 3.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: actions/upload-artifact
dependency-version: 7.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 10:13:26 -04:00
dependabot[bot]
ed306c2a6d
chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.18.0 ( #4792 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.17.0 to 5.18.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.17.0...v5.18.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.18.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-20 10:09:31 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
33bc4b8397
chore(deps): update Go version ( #4798 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-20 10:03:15 -04:00
Alex Goodman
89e4e609d5
fix: update jruby download URLs from S3 to GitHub Releases ( #4799 )
...
The JRuby project migrated their downloads from S3 to GitHub Releases,
causing the old S3 URLs to return HTTP 403 Forbidden and breaking test
fixture image builds.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-20 13:12:09 +00:00
David Dashti
076fb211cc
fix(cyclonedx): conditionally exclude group from package name ( #4791 )
...
Signed-off-by: David Dashti <david.dashti@hermesmedical.com >
2026-04-17 20:21:21 -04:00
witchcraze
26175d74f8
fix: consul classifier ( #4741 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-04-17 10:38:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
9b58efed0c
chore(deps): update tools to latest versions ( #4701 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-04-16 15:39:39 -04:00
Yoav Alon
30fe53e629
fix(javascript): accept scalar people fields in package.json ( #4779 )
...
Signed-off-by: Yoav Alon <yoav@orca.security >
2026-04-15 14:21:49 -04:00
witchcraze
952469f0f0
update vault classifier ( #4742 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-04-15 14:41:37 +00:00
4321ecc66f
fix(javascript): ensure deterministic pnpm lockfile parsing ( #4765 )
...
* fix(javascript): ensure deterministic pnpm lockfile parsing
Replace nondeterministic Go map iteration with sorted key iteration
in both v6 and v9 pnpm lockfile parsers. When multiple lockfile keys
collapse to the same package key after peer dependency stripping, the
unsorted map iteration caused different entries to win on each run,
producing unstable artifact IDs and non-reproducible SBOM output.
Fixes #4648
Signed-off-by: lawrence3699 <lawrence3699@users.noreply.github.com >
* add regression test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: lawrence3699 <lawrence3699@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: lawrence3699 <lawrence3699@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-15 14:39:57 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
5b58ec96b7
chore(deps): update Go version ( #4773 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-15 10:01:39 -04:00
Will Murphy
26e87c7cd3
fix format string in search results ( #4775 )
...
Passing '%q' to format strings for integer types is a go vet error in
recent go versions, and likely a bug.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-04-14 12:59:44 -04:00
Rez Moss
722e3f267b
added deno bin classifiers ( #4677 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-04-14 11:33:26 -04:00
nadimz
c09f42e024
feat: support zImage and bzImage in linux-kernel-cataloger ( #4751 )
...
Signed-off-by: Nadim Zubidat <nadimz@users.noreply.github.com >
2026-04-14 10:02:20 -04:00
Alex Goodman
19b4f41270
pin wolfi cache version ( #4774 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-14 09:15:24 -04:00
nadimz
bcc1f15ceb
feat: OpenLDAP binary classifier ( #4755 )
...
Signed-off-by: Nadim Zubidat <nadimz@users.noreply.github.com >
2026-04-13 16:27:48 -04:00
dependabot[bot]
ce2c56bf06
chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 ( #4750 )
...
Bumps [github.com/aws/aws-sdk-go-v2/service/s3](https://github.com/aws/aws-sdk-go-v2 ) from 1.96.0 to 1.97.3.
- [Release notes](https://github.com/aws/aws-sdk-go-v2/releases )
- [Commits](https://github.com/aws/aws-sdk-go-v2/compare/service/s3/v1.96.0...service/s3/v1.97.3 )
---
updated-dependencies:
- dependency-name: github.com/aws/aws-sdk-go-v2/service/s3
dependency-version: 1.97.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-13 15:47:17 -04:00
dependabot[bot]
532fbafe36
chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 ( #4752 )
...
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ) from 1.40.0 to 1.43.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.40.0...v1.43.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.43.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-13 15:22:53 -04:00
dependabot[bot]
8835af66b0
chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 ( #4737 )
...
Bumps [github.com/go-jose/go-jose/v4](https://github.com/go-jose/go-jose ) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/go-jose/go-jose/releases )
- [Commits](https://github.com/go-jose/go-jose/compare/v4.1.3...v4.1.4 )
---
updated-dependencies:
- dependency-name: github.com/go-jose/go-jose/v4
dependency-version: 4.1.4
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-13 14:58:53 -04:00
dependabot[bot]
f4290cb876
chore(deps): bump the actions-minor-patch group across 2 directories with 7 updates ( #4763 )
...
Bumps the actions-minor-patch group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [docker/login-action](https://github.com/docker/login-action ) | `4.0.0` | `4.1.0` |
| [anchore/sbom-action](https://github.com/anchore/sbom-action ) | `0.23.0` | `0.24.0` |
| [runs-on/action](https://github.com/runs-on/action ) | `2.0.3` | `2.1.0` |
| [actions/download-artifact](https://github.com/actions/download-artifact ) | `8.0.0` | `8.0.1` |
| [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) | `4.0.0` | `4.1.1` |
Bumps the actions-minor-patch group with 2 updates in the /.github/actions/bootstrap directory: [actions/setup-go](https://github.com/actions/setup-go ) and [actions/cache](https://github.com/actions/cache ).
Updates `docker/login-action` from 4.0.0 to 4.1.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/b45d80f862d83dbcd57f89517bcf500b2ab88fb2...4907a6ddec9925e35a0a9e82d7399ccc52663121 )
Updates `anchore/sbom-action` from 0.23.0 to 0.24.0
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/17ae1740179002c89186b61233e0f892c3118b11...e22c389904149dbc22b58101806040fa8d37a610 )
Updates `runs-on/action` from 2.0.3 to 2.1.0
- [Release notes](https://github.com/runs-on/action/releases )
- [Commits](https://github.com/runs-on/action/compare/cd2b598b0515d39d78c38a02d529db87d2196d1e...742bf56072eb4845a0f94b3394673e4903c90ff0 )
Updates `actions/download-artifact` from 8.0.0 to 8.0.1
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3...3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c )
Updates `sigstore/cosign-installer` from 4.0.0 to 4.1.1
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/faadad0cce49287aee09b3a48701e75088a2c6ad...cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 )
Updates `actions/setup-go` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...4a3601121dd01d1626a1e23e37211e3254c1c06c )
Updates `actions/setup-go` from 6.3.0 to 6.4.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4b73464bb391d4059bd26b0524d20df3927bd417...4a3601121dd01d1626a1e23e37211e3254c1c06c )
Updates `actions/cache` from 5.0.3 to 5.0.4
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/cdf6c1fa76f9f475f3d7449005a359c84ca0f306...668228422ae6a00e4ad889ee87cd7109ec5666a7 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/sbom-action
dependency-version: 0.24.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: runs-on/action
dependency-version: 2.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: actions/download-artifact
dependency-version: 8.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: sigstore/cosign-installer
dependency-version: 4.1.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: actions/setup-go
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: actions/setup-go
dependency-version: 6.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: actions/cache
dependency-version: 5.0.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-13 11:39:21 -04:00
dependabot[bot]
990cc3c599
chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 ( #4764 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.5 to 1.8.6.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.5...v1.8.6 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.6
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-04-13 11:39:08 -04:00
witchcraze
03d6399b0c
fix: update erlang classifier ( #4766 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-04-13 11:31:19 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
1e08f703d0
chore(deps): update CPE dictionary index ( #4767 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-13 11:28:50 -04:00
witchcraze
e420322494
fix: more istio classifier matching ( #4645 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-04-12 10:54:08 -04:00
Benjamin Grandfond
cc3b8eb48f
fix(json): use value alias in Document.UnmarshalJSON to prevent infinite recursion with encoding/json/v2 ( #4748 )
...
The pattern 'type Alias *Document' does not strip methods under
encoding/json/v2 (GOEXPERIMENT=jsonv2), causing UnmarshalJSON to call
itself infinitely until the goroutine stack overflows (1GB limit).
Change to 'type Alias Document' with (*Alias)(d) cast — the standard
Go pattern that works correctly with both encoding/json v1 and v2.
Adds a regression test that uses debug.SetMaxStack to shrink the
goroutine stack limit to 8MB, making the overflow happen in milliseconds
rather than minutes if the recursion is reintroduced.
Ref: https://github.com/golang/go/issues/75361
Signed-off-by: Benjamin Grandfond <benjamin.grandfond@docker.com >
2026-04-10 13:36:07 -04:00
Alex Goodman
d0ee9098cf
bump version ( #4756 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-09 21:11:47 +00:00
Alex Goodman
344d1f47a1
support single arch images without manifests when checking platform ( #4753 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-09 15:54:41 +00:00
anchore-oss-update-bot and anchore-oss-update-bot
f618917527
chore(deps): update CPE dictionary index ( #4745 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-08 13:06:28 -04:00
Will Murphy and Alex Goodman
99158be0ba
chore: move test fixtures to oss-cache repo ( #4733 )
...
* chore: move test fixtures to oss-cache repo
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* pr feedback: sort vars in taskfile
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-02 20:50:43 +00:00
Alex Goodman
2089d086fe
chore: update zizmor workflow triggers ( #4732 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-02 14:56:46 -04:00
Alex Goodman
b0dc65a4fb
improve automation ( #4730 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-02 12:44:54 -04:00
Alex Goodman
611a24fcae
(chore): removing automations ( #4727 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-04-01 14:27:29 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
da601363ed
chore(deps): update CPE dictionary index ( #4726 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-04-01 10:24:27 -04:00
Will Murphy
0d748ec700
chore: cpe index update job needs tools ( #4725 )
...
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-04-01 09:35:17 -04:00
Will Murphy
d60e43f822
chore: move CPE cache to oss-cache repo ( #4723 )
...
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-04-01 06:57:47 -04:00
anchore-actions-token-generator[bot] and wagoodman
2884cc77fc
chore(deps): update CPE dictionary index ( #4715 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-03-31 14:28:15 -04:00
anchore-oss-update-bot and anchore-oss-update-bot
c11a79ef19
chore(deps): update tool versions ( #4706 )
...
Signed-off-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
Co-authored-by: anchore-oss-update-bot <anchore-oss-update-bot@users.noreply.github.com >
2026-03-31 14:06:07 -04:00
Josh Bressers
90198da04d
Add a trust boundary section ( #4716 )
...
Signed-off-by: Josh Bressers <josh@bress.net >
2026-03-30 11:29:37 -05:00
dependabot[bot]
d71b747cd1
chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 ( #4684 )
...
Bumps [slackapi/slack-github-action](https://github.com/slackapi/slack-github-action ) from 2.1.1 to 3.0.1.
- [Release notes](https://github.com/slackapi/slack-github-action/releases )
- [Commits](https://github.com/slackapi/slack-github-action/compare/91efab103c0de0a537f72a35f6b8cda0ee76bf0a...af78098f536edbc4de71162a307590698245be95 )
---
updated-dependencies:
- dependency-name: slackapi/slack-github-action
dependency-version: 3.0.1
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-26 11:12:33 -04:00
dependabot[bot]
58a8a95e26
chore(deps): bump marocchino/sticky-pull-request-comment ( #4685 )
...
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) from 2.9.4 to 3.0.2.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/773744901bac0e8cbb5a0dc842800d45e9b2b405...70d2764d1a7d5d9560b100cbea0077fc8f633987 )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-version: 3.0.2
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-25 19:27:59 -04:00
dependabot[bot]
78a21b9c88
chore(deps): bump the go-minor-patch group with 2 updates ( #4697 )
...
Bumps the go-minor-patch group with 2 updates: [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ).
Updates `github.com/gkampitakis/go-snaps` from 0.5.20 to 0.5.21
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.20...v0.5.21 )
Updates `modernc.org/sqlite` from 1.46.1 to 1.46.2
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.46.1...v1.46.2 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.21
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.46.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-25 19:27:50 -04:00
dependabot[bot]
7d3882a425
chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 ( #4699 )
...
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token ) from 2.2.1 to 3.0.0.
- [Release notes](https://github.com/actions/create-github-app-token/releases )
- [Commits](https://github.com/actions/create-github-app-token/compare/29824e69f54612133e76f7eaac726eef6c875baf...f8d387b68d61c58ab83c6c016672934102569859 )
---
updated-dependencies:
- dependency-name: actions/create-github-app-token
dependency-version: 3.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-25 19:27:31 -04:00
anchore-actions-token-generator[bot] and wagoodman
673c85754c
chore(deps): update CPE dictionary index ( #4689 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-03-25 08:38:49 -04:00
Will Murphy
c5114fd745
chore(deps): ignore some dependabot deps ( #4696 )
...
Prevent some packages from being updated.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-03-24 08:12:50 -04:00
Weston Steimel
f68a7cc899
ci: further pr target code checkout assurances ( #4695 )
...
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2026-03-24 07:16:16 -04:00
witchcraze
7800b16529
fix: update arangodb classifier and capture-snippet.sh ( #4662 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-03-23 16:29:39 -04:00
Keith Zantow
834ddcb1c0
fix: golang version file regex ( #4694 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-03-23 15:56:29 -04:00
Weston Steimel
f5d318d934
ci: add explicit ref to main and warning for pull_request_target workflow ( #4693 )
...
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2026-03-23 16:45:18 +00:00
anchore-actions-token-generator[bot] and spiffcs
8531e1917b
chore(deps): update tools to latest versions ( #4690 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-03-23 12:01:27 -04:00
anchore-actions-token-generator[bot] and willmurphyscode
860126c650
chore(deps): update anchore dependencies ( #4681 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-03-19 16:44:55 +00:00
Will Murphy
36639f136b
chore(deps): bump github.com/buger/jsonsparser to v1.1.2 ( #4680 )
...
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-03-19 15:08:18 +00:00
dependabot[bot]
f32238c268
chore(deps): bump the go-minor-patch group with 2 updates ( #4678 )
...
Bumps the go-minor-patch group with 2 updates: [golang.org/x/net](https://github.com/golang/net ) and [golang.org/x/tools](https://github.com/golang/tools ).
Updates `golang.org/x/net` from 0.51.0 to 0.52.0
- [Commits](https://github.com/golang/net/compare/v0.51.0...v0.52.0 )
Updates `golang.org/x/tools` from 0.42.0 to 0.43.0
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.52.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/tools
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-19 10:25:19 -04:00
dependabot[bot]
0c8eef65f0
chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 ( #4675 )
...
Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go ) from 1.78.0 to 1.79.3.
- [Release notes](https://github.com/grpc/grpc-go/releases )
- [Commits](https://github.com/grpc/grpc-go/compare/v1.78.0...v1.79.3 )
---
updated-dependencies:
- dependency-name: google.golang.org/grpc
dependency-version: 1.79.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 16:55:30 -04:00
dependabot[bot]
4d42f8af32
chore(deps): bump the go-minor-patch group with 2 updates ( #4674 )
...
Bumps the go-minor-patch group with 2 updates: [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) and [golang.org/x/mod](https://github.com/golang/mod ).
Updates `github.com/hashicorp/go-getter` from 1.8.4 to 1.8.5
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.4...v1.8.5 )
Updates `golang.org/x/mod` from 0.33.0 to 0.34.0
- [Commits](https://github.com/golang/mod/compare/v0.33.0...v0.34.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.5
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: golang.org/x/mod
dependency-version: 0.34.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-18 16:13:35 -04:00
Will Murphy
e38851143e
chore: centralize temp files and prefer streaming IO ( #4668 )
...
* chore: centralize temp files and prefer streaming IO
Catalogers that create temp files ad-hoc can easily forget cleanup,
leaking files on disk. Similarly, io.ReadAll is convenient but risks
OOM on large or malicious inputs.
Introduce internal/tmpdir to manage all cataloger temp storage under
a single root directory with automatic cleanup. Prefer streaming
parsers (bufio.Scanner, json/yaml.NewDecoder, io.LimitReader) over
buffering entire inputs into memory. Add ruleguard rules to enforce
both practices going forward.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: go back to old release parsing
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* simplify to limit reader in version check
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: regex change postponed
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* simplify supplement release to limitreader
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-03-18 10:53:51 -04:00
anchore-actions-token-generator[bot] and spiffcs
a3dacf5ecd
chore(deps): update tools to latest versions ( #4663 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-03-16 11:26:06 -04:00
dependabot[bot]
cccc9bf7f9
chore(deps): bump the go-minor-patch group with 3 updates ( #4669 )
...
Bumps the go-minor-patch group with 3 updates: [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ), [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter ) and [golang.org/x/time](https://github.com/golang/time ).
Updates `github.com/google/go-containerregistry` from 0.21.1 to 0.21.2
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.21.1...v0.21.2 )
Updates `github.com/olekukonko/tablewriter` from 1.1.3 to 1.1.4
- [Release notes](https://github.com/olekukonko/tablewriter/releases )
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.3...v1.1.4 )
Updates `golang.org/x/time` from 0.14.0 to 0.15.0
- [Commits](https://github.com/golang/time/compare/v0.14.0...v0.15.0 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.21.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/olekukonko/tablewriter
dependency-version: 1.1.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: golang.org/x/time
dependency-version: 0.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 11:25:41 -04:00
dependabot[bot]
59f7725d0d
chore(deps): bump github/codeql-action ( #4670 )
...
Bumps the actions-minor-patch group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action ).
Updates `github/codeql-action` from 4.32.3 to 4.32.6
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/9e907b5e64f6b83e7804b09294d44122997950d6...0d579ffd059c29b07949a3cce3983f0780820c98 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 11:25:27 -04:00
dependabot[bot]
7a6b1575ae
chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 ( #4671 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.7.0 to 4.0.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/c94ce9fb468520275223c153574b00df6fe4bcc9...b45d80f862d83dbcd57f89517bcf500b2ab88fb2 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-16 11:25:16 -04:00
anchore-actions-token-generator[bot] and wagoodman
92a6b36e89
chore(deps): update CPE dictionary index ( #4673 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-03-16 11:25:05 -04:00
Will Murphy
7158535fe6
chore(tests): fix test fixture build on modern ARM Mac ( #4666 )
...
BUILDPLATFORM is automatically set to the host's platform in new Docker,
so having it defined as an arg results in it being overridden by this
automatic value. Since it was always assigned to a literal string in the
test files, just use that string.
Additionally, image platform is better pulled from the manifest, not the
image config, in containerd store, so try that first.
Additionally, python3 is on PATH on new macs by default, but not python.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-03-11 09:37:40 -04:00
anchore-actions-token-generator[bot] and willmurphyscode
75455f050a
chore(deps): update anchore dependencies ( #4631 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-03-09 18:10:53 +00:00
22e78c7be1
chore(deps): update tools to latest versions ( #4630 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore(lint): fix errors in new golangci-lint
Two fixes:
First, replace sb.WriteString(fmt.Sprintf(...)) with fmt.Fprintf(&sb, ...)
Second, suppress errors where we read from the local file system at a
user provided path. This is a CLI tool, and reads from user provided
paths on the local file system by design.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-03-09 12:17:09 -04:00
anchore-actions-token-generator[bot] and wagoodman
d2461a9e0a
chore(deps): update SPDX license list ( #4637 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-03-09 11:02:47 -04:00
dependabot[bot]
01f0e332c2
chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 ( #4658 )
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 7.0.0 to 8.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3 )
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 10:37:33 -04:00
dependabot[bot]
c88051d74e
chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 ( #4638 )
...
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl ) from 1.6.1 to 1.6.3.
- [Release notes](https://github.com/cloudflare/circl/releases )
- [Commits](https://github.com/cloudflare/circl/compare/v1.6.1...v1.6.3 )
---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
dependency-version: 1.6.3
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 10:34:11 -04:00
dependabot[bot]
7d3d1c6237
chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates ( #4657 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [actions/setup-go](https://github.com/actions/setup-go ) and [anchore/sbom-action](https://github.com/anchore/sbom-action ).
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [actions/setup-go](https://github.com/actions/setup-go ).
Updates `actions/setup-go` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5...4b73464bb391d4059bd26b0524d20df3927bd417 )
Updates `anchore/sbom-action` from 0.22.2 to 0.23.0
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/28d71544de8eaf1b958d335707167c5f783590ad...17ae1740179002c89186b61233e0f892c3118b11 )
Updates `actions/setup-go` from 6.2.0 to 6.3.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5...4b73464bb391d4059bd26b0524d20df3927bd417 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: anchore/sbom-action
dependency-version: 0.23.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: actions/setup-go
dependency-version: 6.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 10:33:14 -04:00
dependabot[bot]
dcba765d86
chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 ( #4659 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 10:32:22 -04:00
dependabot[bot]
2c201469c3
chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 ( #4646 )
...
Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go ) from 1.39.0 to 1.40.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases )
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md )
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.39.0...v1.40.0 )
---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
dependency-version: 1.40.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 10:29:46 -04:00
anchore-actions-token-generator[bot] and wagoodman
c583da1c15
chore(deps): update CPE dictionary index ( #4647 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-03-09 10:26:42 -04:00
dependabot[bot]
22014b6022
chore(deps): bump the go-minor-patch group across 1 directory with 5 updates ( #4661 )
...
Bumps the go-minor-patch group with 5 updates in the / directory:
| Package | From | To |
| --- | --- | --- |
| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) | `2.3.6` | `2.4.0` |
| [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) | `5.7.0` | `5.8.0` |
| [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) | `5.16.5` | `5.17.0` |
| [golang.org/x/net](https://github.com/golang/net ) | `0.50.0` | `0.51.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) | `1.45.0` | `1.46.1` |
Updates `github.com/github/go-spdx/v2` from 2.3.6 to 2.4.0
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.3.6...v2.4.0 )
Updates `github.com/go-git/go-billy/v5` from 5.7.0 to 5.8.0
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.7.0...v5.8.0 )
Updates `github.com/go-git/go-git/v5` from 5.16.5 to 5.17.0
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.16.5...v5.17.0 )
Updates `golang.org/x/net` from 0.50.0 to 0.51.0
- [Commits](https://github.com/golang/net/compare/v0.50.0...v0.51.0 )
Updates `modernc.org/sqlite` from 1.45.0 to 1.46.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.45.0...v1.46.1 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/go-git/go-billy/v5
dependency-version: 5.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.17.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/net
dependency-version: 0.51.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.46.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-03-09 10:20:06 -04:00
Alex Goodman
b5e85c3ea5
chore: migrate fixtures to testdata ( #4651 )
...
* migrate fixtures to testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: correct broken symlinks after testdata migration
The migration from test-fixtures to testdata broke several symlinks:
- elf-test-fixtures symlinks pointed to old test-fixtures paths
- elf-test-fixtures needed to be renamed to elf-testdata
- image-pkg-coverage symlink pointed to test-fixtures instead of testdata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: handle missing classifiers/bin directory in Makefile
The clean-fingerprint target was failing when classifiers/bin doesn't
exist (e.g., on fresh clone without downloaded binaries).
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: add gitignore negation for jar/zip fixtures in test/cli
The jar and zip files in test/cli/testdata/image-unknowns were being
gitignored by the root .gitignore patterns. This caused them to be
untracked and not included when building docker images in CI, resulting
in Test_Unknowns failures since the test expects errors from corrupt
archive files that weren't present.
Add a .gitignore in test/cli/testdata to negate the exclusions for
these specific test fixture files.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* switch fixture cache to v2
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: update expected versions for rebuilt fixtures
Update test expectations for packages that have been updated in
upstream repositories when docker images are rebuilt:
- glibc: 2.42-r4 → 2.43-r1 (wolfi)
- php: 8.2.29 → 8.2.30 (ubuntu/apache)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* upgrade go
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: add go-shlex dependency for testdata manager tool
The manager tool in syft/pkg/cataloger/binary/testdata/ imports
go-shlex, but since it's in a testdata directory, Go doesn't track
its dependencies. This caused CI failures when go.mod didn't
explicitly list the dependency.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor: move binary classifier manager to internal/
Move the manager tool from testdata/manager to internal/manager so
that Go properly tracks its dependencies. Code in testdata directories
is ignored by Go for dependency tracking, which caused CI failures
when go.mod didn't explicitly list transitive dependencies.
This is a cleaner solution than manually adding dependencies to go.mod
for code that happens to live in testdata.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: add gitignore negations for test fixtures blocked by root patterns
Multiple test fixtures were being blocked by root-level gitignore patterns
like bin/, *.jar, *.tar, and *.exe. This adds targeted .gitignore files with
negation patterns to allow these specific test fixtures to be tracked:
- syft/linux/testdata/os/busybox/bin/busybox (blocked by bin/)
- syft/pkg/cataloger/java/testdata/corrupt/example.{jar,tar} (blocked by *.jar, *.tar)
- syft/pkg/cataloger/binary/testdata/classifiers/snippets/go-version-hint/**/bin/go (blocked by bin/)
- syft/pkg/cataloger/bitnami/testdata/no-rel/.../bin/redis-server (blocked by bin/)
Also updates the bitnami test expectation to include the newly required
.gitignore files in the test fixture.
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test: update glibc version expectation (2.43-r1 -> 2.43-r2)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add capability drift check as unit step
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont clear test observations before drift detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump stereoscope commit to main
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-03-06 19:42:04 +00:00
Dimitri John Ledkov and Keith Zantow
35278f3d3d
fix(java): improve lz4 detection ( #4642 )
...
Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2026-02-27 14:38:05 -05:00
Paweł Pałucha
db76d85d51
fix: use correct hashes for empty files ( #4620 )
...
Signed-off-by: Paweł Pałucha <pawel.palucha@chainguard.dev >
2026-02-24 09:52:29 -05:00
witchcraze
e9e7e20cc8
fix: grafana classifier ( #4635 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-02-23 09:38:02 -05:00
anchore-actions-token-generator[bot] and wagoodman
eb072deb9c
chore(deps): update CPE dictionary index ( #4636 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-02-23 08:19:30 -05:00
dependabot[bot]
f4fc2d669a
chore(deps): bump github/codeql-action ( #4634 )
...
Bumps the actions-minor-patch group with 1 update in the / directory: [github/codeql-action](https://github.com/github/codeql-action ).
Updates `github/codeql-action` from 4.31.10 to 4.32.3
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/cdefb33c0f6224e58673d9004f47f7cb3e328b89...9e907b5e64f6b83e7804b09294d44122997950d6 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.32.3
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-20 08:41:46 -05:00
dependabot[bot]
f5110f109a
chore(deps): bump github.com/charmbracelet/bubbles from 0.21.1 to 1.0.0 ( #4633 )
...
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles ) from 0.21.1 to 1.0.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases )
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.21.1...v1.0.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
dependency-version: 1.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-20 08:41:21 -05:00
dependabot[bot]
612eadb22e
chore(deps): bump the go-minor-patch group with 5 updates ( #4632 )
...
Bumps the go-minor-patch group with 5 updates:
| Package | From | To |
| --- | --- | --- |
| [golang.org/x/mod](https://github.com/golang/mod ) | `0.32.0` | `0.33.0` |
| [golang.org/x/net](https://github.com/golang/net ) | `0.49.0` | `0.50.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) | `1.44.3` | `1.45.0` |
| [golang.org/x/tools](https://github.com/golang/tools ) | `0.41.0` | `0.42.0` |
| [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go ) | `0.23.1` | `0.24.0` |
Updates `golang.org/x/mod` from 0.32.0 to 0.33.0
- [Commits](https://github.com/golang/mod/compare/v0.32.0...v0.33.0 )
Updates `golang.org/x/net` from 0.49.0 to 0.50.0
- [Commits](https://github.com/golang/net/compare/v0.49.0...v0.50.0 )
Updates `modernc.org/sqlite` from 1.44.3 to 1.45.0
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.44.3...v1.45.0 )
Updates `golang.org/x/tools` from 0.41.0 to 0.42.0
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.41.0...v0.42.0 )
Updates `github.com/gpustack/gguf-parser-go` from 0.23.1 to 0.24.0
- [Release notes](https://github.com/gpustack/gguf-parser-go/releases )
- [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.23.1...v0.24.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.33.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/net
dependency-version: 0.50.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/tools
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/gpustack/gguf-parser-go
dependency-version: 0.24.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-20 08:40:09 -05:00
Will Murphy
0a3f7bb06e
chore: call cleanup on tmpfile and replace some io.ReadAlls with streams ( #4629 )
...
* fix(deb and snaps): prevent excess reads
Previously, Syft could allocate excess memory or tempfile space if there
were highly compressed objects in deb archives, or at paths where the
kernel changelog was expected by the snap cataloger. Use io.LimitReaders
for extracting parts of deb archives, and refactor the snap cataloger's
reading of the kernel changelog to use a streaming parsing, eliminating
the possibility of excess allocation.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* fix: always cleanup temp file from file source
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* use streaming strategy for deb archives
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-02-17 17:32:35 -05:00
Christopher Angelo Phillips
2fe5f9c7b8
fix: bumps go mod version to 1.25; ci takes latest patch ( #4628 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-02-17 12:04:51 -05:00
anchore-actions-token-generator[bot] and spiffcs
f70631a719
chore(deps): update tools to latest versions ( #4614 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: ci rules revive
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-02-17 11:19:37 -05:00
dependabot[bot]
0bb3741c87
chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates ( #4622 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `anchore/sbom-action` from 0.21.1 to 0.22.2
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/0b82b0b1a22399a1c542d4d656f70cd903571b5c...28d71544de8eaf1b958d335707167c5f783590ad )
Updates `zizmorcore/zizmor-action` from 0.4.1 to 0.5.0
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/135698455da5c3b3e55f73f4419e481ab68cdd95...0dce2577a4760a2749d8cfb7a84b7d5585ebcb7d )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.22.2
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-17 11:16:26 -05:00
dependabot[bot]
458ebbbff8
chore(deps): bump the go-minor-patch group with 2 updates ( #4621 )
...
Bumps the go-minor-patch group with 2 updates: [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) and [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles ).
Updates `github.com/CycloneDX/cyclonedx-go` from 0.9.3 to 0.10.0
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.9.3...v0.10.0 )
Updates `github.com/charmbracelet/bubbles` from 0.21.0 to 0.21.1
- [Release notes](https://github.com/charmbracelet/bubbles/releases )
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.21.0...v0.21.1 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-version: 0.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/charmbracelet/bubbles
dependency-version: 0.21.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-17 10:14:13 -05:00
anchore-actions-token-generator[bot] and wagoodman
fb3f560e43
chore(deps): update CPE dictionary index ( #4623 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-02-17 09:50:12 -05:00
Scott Hebert
89b901b20b
Use redhat as namespace for hummingbird rpms ( #4615 )
...
The namespace value of `redhat` signifies this as an RPM package
produced and distributed by Red Hat.
Signed-off-by: Scott Hebert <scoheb@gmail.com >
2026-02-11 14:19:20 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
9872ff36ba
chore(deps): update anchore dependencies ( #4613 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-02-10 17:19:56 +00:00
dependabot[bot]
31c503124f
chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 ( #4612 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.16.4 to 5.16.5.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.16.4...v5.16.5 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.16.5
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-10 08:25:31 -05:00
Christopher Angelo Phillips and Alex Goodman
2c5e193f7a
feat: Add support for scanning GGUF models from OCI registries ( #4335 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-02-09 16:05:52 -05:00
anchore-actions-token-generator[bot] and wagoodman
3a23cfff1d
chore(deps): update CPE dictionary index ( #4610 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2026-02-08 22:02:34 -05:00
dependabot[bot]
443de210ca
chore(deps): bump github.com/bmatcuk/doublestar/v4 ( #4606 )
...
Bumps the go-minor-patch group with 1 update: [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar ).
Updates `github.com/bmatcuk/doublestar/v4` from 4.9.2 to 4.10.0
- [Release notes](https://github.com/bmatcuk/doublestar/releases )
- [Commits](https://github.com/bmatcuk/doublestar/compare/v4.9.2...v4.10.0 )
---
updated-dependencies:
- dependency-name: github.com/bmatcuk/doublestar/v4
dependency-version: 4.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-06 13:20:24 -05:00
dependabot[bot]
1af8b1acaa
chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates ( #4607 )
...
Bumps the actions-minor-patch group with 1 update in the / directory: [docker/login-action](https://github.com/docker/login-action ).
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [actions/cache](https://github.com/actions/cache ).
Updates `docker/login-action` from 3.6.0 to 3.7.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/5e57cd118135c172c3672efd75eb46360885c0ef...c94ce9fb468520275223c153574b00df6fe4bcc9 )
Updates `actions/cache` from 5.0.1 to 5.0.3
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/9255dc7a253b0ccc959486e2bca901246202afeb...cdf6c1fa76f9f475f3d7449005a359c84ca0f306 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: actions/cache
dependency-version: 5.0.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-06 13:20:12 -05:00
Rez Moss and Christopher Phillips
c185657d71
feat: add yarn lock dev dep detection; fixed #4548
...
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-02-05 22:27:17 +00:00
Will Murphy
48ee12be0c
ci(generate-capabilities): serialize writing and reading yaml ( #4602 )
...
Otherwise sometimes the test that reads will run during the test that
writes and fail because the yaml file is in a partially written state.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-02-05 11:35:45 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
0b05f0ed69
chore(deps): update CPE dictionary index ( #4601 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-02-05 15:29:00 +00:00
Will Murphy
138cb1be0e
fix(cpe-generation): set start and end date ( #4600 )
...
* fix(cpe-generation): set start and end date
Previously, the update job was silently failing because the NVD API
returns a 404 with no body if a start date is specified but not an end
date. Further, the API returns an error if more than 120 days are in
range of the start and end date.
Update the API client to:
1. Return a non-nil error on http 404
2. Chunk the date range into 120 day chunks
3. Pass start and end date to avoid errors.
Also add more tolerant timestamp parsing since the previous update job
would fail with timestamp format errors.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* refactor(cpe-generator): remove callbacks
Previously, this job had callbacks that were there to make sure that
incremental progress could be written to disk. However, incremental
progress was not being written to disk, and there were issues related to
the callbacks like double logging. Therefore, just remove the callbacks
and do simple imperative code to page through the API results.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-02-05 09:54:24 -05:00
Peter Bücker
6755377554
fix: CPE detection for APK libavif to use aomedia vendor ( #4597 )
...
NVD uses "aomedia" as the vendor for libavif CVEs. This change adds
libavif to the APK package CPE candidate additions with "aomedia" as
an additional vendor, enabling Syft/Grype to match CVEs like
CVE-2025-48174 and CVE-2025-48175.
Signed-off-by: Peter Bücker <peter.buecker@gmail.com >
2026-02-05 09:11:44 +00:00
anchore-actions-token-generator[bot] and spiffcs
540c08a41b
chore(deps): update tools to latest versions ( #4594 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-02-04 09:26:09 -05:00
Keith Zantow
add2629446
fix: further improve go binary classifier, including windows ( #4593 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-02-03 10:29:00 -05:00
anchore-actions-token-generator[bot] and spiffcs
d22139ef1a
chore(deps): update tools to latest versions ( #4589 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-02-02 12:59:57 -05:00
Christopher Angelo Phillips
c94d1ccf1c
fix: lookup alternate scheme on url->licenseID ( #4588 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-01-30 14:25:27 -05:00
dependabot[bot]
69d0898918
chore(deps): bump the go-minor-patch group with 2 updates ( #4583 )
...
Bumps the go-minor-patch group with 2 updates: [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter ) and [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ).
Updates `github.com/olekukonko/tablewriter` from 1.1.2 to 1.1.3
- [Release notes](https://github.com/olekukonko/tablewriter/releases )
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.2...v1.1.3 )
Updates `modernc.org/sqlite` from 1.44.1 to 1.44.3
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.44.1...v1.44.3 )
---
updated-dependencies:
- dependency-name: github.com/olekukonko/tablewriter
dependency-version: 1.1.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.44.3
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-30 11:24:34 -05:00
Rez Moss and Christopher Phillips
94c8088542
feat: add Qt6 binary detection ( #4550 )
...
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-01-30 15:35:33 +00:00
dependabot[bot]
e136ebc44f
chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates ( #4584 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `peter-evans/create-pull-request` from 8.0.0 to 8.1.0
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/98357b18bf14b5342f975ff684046ec3b2a07725...c0f553fe549906ede9cf27b5156039d195d2ece0 )
Updates `zizmorcore/zizmor-action` from 0.3.0 to 0.4.1
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/e639db99335bc9038abc0e066dfcd72e23d26fb4...135698455da5c3b3e55f73f4419e481ab68cdd95 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.4.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-30 10:33:32 -05:00
Alan Pope and Christopher Phillips
0bca34f986
fix: snap cataloger incorrectly identifies snap container as deb package ( #4500 )
...
Signed-off-by: Alan Pope <alan@popey.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-01-30 10:19:26 -05:00
anchore-actions-token-generator[bot] and spiffcs
8d836fb8b0
chore(deps): update tools to latest versions ( #4577 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-27 15:18:18 -05:00
Christopher Angelo Phillips
9a250a4b4b
fix: update mixed case dependencies in python to be normalized ( #4573 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2026-01-27 15:16:32 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
e8b4527bfb
chore(deps): update anchore dependencies ( #4575 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-01-27 10:14:26 +00:00
anchore-actions-token-generator[bot] and spiffcs
d0bb042d74
chore(deps): update tools to latest versions ( #4570 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-26 12:25:31 -05:00
Keith Zantow
c65d023668
feat: detect Debian version from /etc/debian_version ( #4569 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-01-23 17:52:21 -05:00
Keith Zantow
836f358cd4
fix: correctly report supporting evidence for binary packages ( #4558 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2026-01-23 13:01:12 -05:00
dependabot[bot]
27b1219e98
chore(deps): bump the actions-minor-patch group across 2 directories with 3 updates ( #4568 )
...
Bumps the actions-minor-patch group with 3 updates in the / directory: [actions/checkout](https://github.com/actions/checkout ), [actions/setup-go](https://github.com/actions/setup-go ) and [github/codeql-action](https://github.com/github/codeql-action ).
Bumps the actions-minor-patch group with 1 update in the /.github/actions/bootstrap directory: [actions/setup-go](https://github.com/actions/setup-go ).
Updates `actions/checkout` from 6.0.1 to 6.0.2
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/8e8c483db84b4bee98b60c0593521ed34d9990e8...de0fac2e4500dabe0009e67214ff5f5447ce83dd )
Updates `actions/setup-go` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4dc6199c7b1a012772edbd06daecab0f50c9053c...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 )
Updates `github/codeql-action` from 4.31.9 to 4.31.10
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5d4e8d1aca955e8d8589aabd499c5cae939e33c7...cdefb33c0f6224e58673d9004f47f7cb3e328b89 )
Updates `actions/setup-go` from 6.1.0 to 6.2.0
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/4dc6199c7b1a012772edbd06daecab0f50c9053c...7a3fe6cf4cb3a834922a1244abfce67bcef6a0c5 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: actions/setup-go
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: github/codeql-action
dependency-version: 4.31.10
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
- dependency-name: actions/setup-go
dependency-version: 6.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-23 10:37:23 -05:00
dependabot[bot]
c0e0058c86
chore(deps): bump the go-minor-patch group with 6 updates ( #4567 )
...
Bumps the go-minor-patch group with 6 updates:
| Package | From | To |
| --- | --- | --- |
| [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) | `2.3.5` | `2.3.6` |
| [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure ) | `2.4.0` | `2.5.0` |
| [golang.org/x/mod](https://github.com/golang/mod ) | `0.31.0` | `0.32.0` |
| [golang.org/x/net](https://github.com/golang/net ) | `0.48.0` | `0.49.0` |
| [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) | `1.43.0` | `1.44.1` |
| [golang.org/x/tools](https://github.com/golang/tools ) | `0.40.0` | `0.41.0` |
Updates `github.com/github/go-spdx/v2` from 2.3.5 to 2.3.6
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.3.5...v2.3.6 )
Updates `github.com/go-viper/mapstructure/v2` from 2.4.0 to 2.5.0
- [Release notes](https://github.com/go-viper/mapstructure/releases )
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md )
- [Commits](https://github.com/go-viper/mapstructure/compare/v2.4.0...v2.5.0 )
Updates `golang.org/x/mod` from 0.31.0 to 0.32.0
- [Commits](https://github.com/golang/mod/compare/v0.31.0...v0.32.0 )
Updates `golang.org/x/net` from 0.48.0 to 0.49.0
- [Commits](https://github.com/golang/net/compare/v0.48.0...v0.49.0 )
Updates `modernc.org/sqlite` from 1.43.0 to 1.44.1
- [Changelog](https://gitlab.com/cznic/sqlite/blob/master/CHANGELOG.md )
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.43.0...v1.44.1 )
Updates `golang.org/x/tools` from 0.40.0 to 0.41.0
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.40.0...v0.41.0 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-version: 2.3.6
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/go-viper/mapstructure/v2
dependency-version: 2.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/mod
dependency-version: 0.32.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/net
dependency-version: 0.49.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.44.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: golang.org/x/tools
dependency-version: 0.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-23 10:37:10 -05:00
anchore-actions-token-generator[bot] and spiffcs
a9fabb6c0f
chore(deps): update tools to latest versions ( #4565 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-22 13:04:45 -05:00
dependabot[bot]
7954324417
chore(deps): bump github.com/spdx/tools-golang ( #4557 )
...
Bumps the go-minor-patch group with 1 update in the / directory: [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang ).
Updates `github.com/spdx/tools-golang` from 0.5.6 to 0.5.7
- [Release notes](https://github.com/spdx/tools-golang/releases )
- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md )
- [Commits](https://github.com/spdx/tools-golang/compare/v0.5.6...v0.5.7 )
---
updated-dependencies:
- dependency-name: github.com/spdx/tools-golang
dependency-version: 0.5.7
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-16 13:04:13 -05:00
Will Murphy
3e563d90d5
ci: enable zizmor to fail PRs ( #4556 )
...
* ci: enable zizmor to fail PRs
Enable zizmor (gh actions yaml linter) to fail builds in PRs. Fix any
outstanding linting errors found by this tool.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* fix outdated version comments
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-01-16 10:49:00 -05:00
Will Murphy
5987f46353
Chore new slack action ( #4553 )
...
* chore: new slack action
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* TEMP: exit 1 to test slack notify
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* new slack integration everywhere
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-01-16 11:26:40 +00:00
anchore-actions-token-generator[bot] and willmurphyscode
63927ab49f
chore(deps): update anchore dependencies ( #4552 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-01-15 21:33:35 +00:00
anchore-actions-token-generator[bot] and spiffcs
308b8030e7
chore(deps): update tools to latest versions ( #4551 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-15 07:30:10 -05:00
anchore-actions-token-generator[bot] and spiffcs
6d8a03b375
chore(deps): update tools to latest versions ( #4545 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-12 11:05:17 -05:00
anchore-actions-token-generator[bot] and spiffcs
55a190aed1
chore(deps): update tools to latest versions ( #4542 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-09 13:14:13 -05:00
dependabot[bot]
695bbcc4f9
chore(deps): bump the go-minor-patch group with 4 updates ( #4543 )
...
Bumps the go-minor-patch group with 4 updates: [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree ), [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ), [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml ) and [github.com/gpustack/gguf-parser-go](https://github.com/gpustack/gguf-parser-go ).
Updates `github.com/vbatts/go-mtree` from 0.6.0 to 0.7.0
- [Release notes](https://github.com/vbatts/go-mtree/releases )
- [Changelog](https://github.com/vbatts/go-mtree/blob/main/releases.md )
- [Commits](https://github.com/vbatts/go-mtree/compare/v0.6.0...v0.7.0 )
Updates `modernc.org/sqlite` from 1.42.2 to 1.43.0
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.42.2...v1.43.0 )
Updates `github.com/goccy/go-yaml` from 1.19.1 to 1.19.2
- [Release notes](https://github.com/goccy/go-yaml/releases )
- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md )
- [Commits](https://github.com/goccy/go-yaml/compare/v1.19.1...v1.19.2 )
Updates `github.com/gpustack/gguf-parser-go` from 0.22.1 to 0.23.1
- [Release notes](https://github.com/gpustack/gguf-parser-go/releases )
- [Commits](https://github.com/gpustack/gguf-parser-go/compare/v0.22.1...v0.23.1 )
---
updated-dependencies:
- dependency-name: github.com/vbatts/go-mtree
dependency-version: 0.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: modernc.org/sqlite
dependency-version: 1.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/goccy/go-yaml
dependency-version: 1.19.2
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/gpustack/gguf-parser-go
dependency-version: 0.23.1
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-09 13:13:56 -05:00
dependabot[bot]
6d206910f0
chore(deps): bump anchore/sbom-action ( #4544 )
...
Bumps the actions-minor-patch group with 1 update in the / directory: [anchore/sbom-action](https://github.com/anchore/sbom-action ).
Updates `anchore/sbom-action` from 0.21.0 to 0.21.1
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/a930d0ac434e3182448fe678398ba5713717112a...0b82b0b1a22399a1c542d4d656f70cd903571b5c )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.21.1
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-09 13:13:44 -05:00
Rez Moss
2f3a504acf
Feat/catalog mongodb bin ( #4541 )
...
* fixed #4550 , catalog mongodb bin
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed #4550 , catalog mongodb bin
Signed-off-by: Rez Moss <hi@rezmoss.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-01-08 12:18:51 -05:00
anchore-actions-token-generator[bot] and spiffcs
d24e843c45
chore(deps): update tools to latest versions ( #4537 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-08 11:56:50 -05:00
Will Murphy
83a4528fff
chore: sync generated file immediately ( #4538 )
...
A CI failure was observed where a generated file was only partly written
when the CI job immediately tried to read it. Put in an fs.Sync call to
eliminate this flakiness.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2026-01-08 09:01:17 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
11e871566b
chore(deps): update anchore dependencies ( #4535 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2026-01-08 12:16:49 +00:00
promalert
cc1a7dfae8
chore: fix some comments to improve readability ( #4533 )
...
Signed-off-by: promalert <promalert@outlook.com >
2026-01-07 15:48:40 +00:00
Rez Moss and Alex Goodman
3a3a86eb01
fixed #4430 exclude dev pnpm pkg ( #4487 )
...
* fixed #4430 exclude dev pnpm pkg
Signed-off-by: Rez Moss <hi@rezmoss.com >
* use existing dev deps option
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fixed #4430 exclude dev pnpm pkg, add test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed #4430 exclude dev pnpm pkg, add test
Signed-off-by: Rez Moss <hi@rezmoss.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-07 10:39:16 -05:00
witchcraze
6509b7079e
add istio classifier ( #4521 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-01-07 10:36:39 -05:00
Rez Moss
7f1d57d06f
feat: detect older bitnami img packages ( #4532 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-01-07 10:07:33 -05:00
Alex Goodman
ed339e4fed
fix: ensure java image build failures stop the build ( #4531 )
...
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-06 11:43:51 -05:00
dependabot[bot] and Alex Goodman
3ea6a03cd0
chore(deps): bump the go-minor-patch group with 3 updates ( #4524 )
...
* chore(deps): bump the go-minor-patch group with 3 updates
Bumps the go-minor-patch group with 3 updates: [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml ), [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) and [github.com/invopop/jsonschema](https://github.com/invopop/jsonschema ).
Updates `github.com/BurntSushi/toml` from 1.5.0 to 1.6.0
- [Release notes](https://github.com/BurntSushi/toml/releases )
- [Commits](https://github.com/BurntSushi/toml/compare/v1.5.0...v1.6.0 )
Updates `github.com/go-git/go-git/v5` from 5.16.3 to 5.16.4
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.16.3...v5.16.4 )
Updates `github.com/invopop/jsonschema` from 0.7.0 to 0.13.0
- [Commits](https://github.com/invopop/jsonschema/compare/v0.7.0...v0.13.0 )
---
updated-dependencies:
- dependency-name: github.com/BurntSushi/toml
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.16.4
dependency-type: direct:production
update-type: version-update:semver-patch
dependency-group: go-minor-patch
- dependency-name: github.com/invopop/jsonschema
dependency-version: 0.13.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: go-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* port breaking jsonschema lib changes
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate the existing json schema with new generation code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-06 15:25:43 +00:00
witchcraze
81dd955871
add envoy binary classifier ( #4530 )
...
* add envoy classifier
Signed-off-by: witchcraze <witchcraze@gmail.com >
* add envoy classifier
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-01-06 08:45:01 -05:00
Alex Goodman
48948ddb8f
add container support for graalvm fixture ( #4528 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-05 14:18:12 -05:00
dependabot[bot]
63273b1b00
chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates ( #4525 )
...
Bumps the actions-minor-patch group with 2 updates in the / directory: [docker/login-action](https://github.com/docker/login-action ) and [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ).
Updates `docker/login-action` from 3.5.0 to 3.6.0
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/184bdaa0721073962dff0199f1fb9940f07167d1...5e57cd118135c172c3672efd75eb46360885c0ef )
Updates `zizmorcore/zizmor-action` from 0.2.0 to 0.3.0
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/e673c3917a1aef3c65c972347ed84ccd013ecda4...e639db99335bc9038abc0e066dfcd72e23d26fb4 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: actions-minor-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 12:48:30 -05:00
dependabot[bot]
92e523caa6
chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 ( #4526 )
...
Bumps [actions/download-artifact](https://github.com/actions/download-artifact ) from 6.0.0 to 7.0.0.
- [Release notes](https://github.com/actions/download-artifact/releases )
- [Commits](https://github.com/actions/download-artifact/compare/018cc2cf5baa6db3ef3c5f8a56943fffe632ef53...37930b1c2abaa49bbe596cd826c3c89aef350131 )
---
updated-dependencies:
- dependency-name: actions/download-artifact
dependency-version: 7.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 12:48:20 -05:00
dependabot[bot]
9b33b8a3d6
chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 ( #4527 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.4.3 to 6.0.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882...b7c566a772e6b6bfb58ed0dc250532a479d7789f )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 12:48:13 -05:00
Alex Goodman
29a0b19a21
Group dependabot updates ( #4522 )
...
* group dependabot updates
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use directories key
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-05 16:57:38 +00:00
Luis Miguel Santos and Luis M. Santos
ea43506196
fix: corrects handling of UNC root paths in windows.
...
---------
Signed-off-by: Luis M. Santos <luis.santos2@nih.gov >
Co-authored-by: Luis M. Santos <luis.santos2@nih.gov >
2026-01-05 11:32:07 -05:00
Rez Moss
2c96279df9
fix: traefik binary classifier ( #4499 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2026-01-05 11:14:00 -05:00
dependabot[bot]
488511f69d
chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2 ( #4513 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.41.0 to 1.42.2.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.41.0...v1.42.2 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.42.2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 10:46:39 -05:00
Alex Goodman
11fed90075
Migrate CI to runs-on ( #4351 )
...
* migrate to runs-on runners
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep validations on x64
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct ubuntu arm refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bust cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use artifacts api between jobs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* download individual artifacts
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* troubleshoot artifact upload
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* disable magic cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix deps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* attempt to replicate layout
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change asset names and remove extras
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* better artifact filters
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use action to get artifacts working
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add sboms
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simpler artifacts
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add logging
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove logging
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* make artifacts executable
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve workflow dispatch calls
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* attempt to bring down ci times
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update repo path
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use local config instead of shared one
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use runner labels instead of config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use valid alias
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use compute instances for build
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* small comment on concurrency
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fixes from review
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove parallelism
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2026-01-05 09:53:06 -05:00
witchcraze
c8184bdb4c
add grafana classifier ( #4516 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-01-05 09:51:41 -05:00
witchcraze
15af992225
add valkey classifier ( #4509 )
...
* add valkey classifier
Signed-off-by: witchcraze <witchcraze@gmail.com >
* fix test path
Signed-off-by: witchcraze <witchcraze@gmail.com >
* Run 'go generate ./internal/capabilities'
Signed-off-by: witchcraze <witchcraze@gmail.com >
2026-01-05 09:40:35 -05:00
dependabot[bot]
1e15428c6f
chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 ( #4501 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.11 to 0.21.0.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/43a17d6e7add2b5535efe4dcae9952337c479a93...a930d0ac434e3182448fe678398ba5713717112a )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:19:40 -05:00
dependabot[bot]
d1adfdc3a6
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8 ( #4502 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.7 to 6.7.8.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.7...v6.7.8 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:19:34 -05:00
dependabot[bot]
0028165062
chore(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 ( #4503 )
...
Bumps [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang ) from 0.5.5 to 0.5.6.
- [Release notes](https://github.com/spdx/tools-golang/releases )
- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md )
- [Commits](https://github.com/spdx/tools-golang/compare/v0.5.5...v0.5.6 )
---
updated-dependencies:
- dependency-name: github.com/spdx/tools-golang
dependency-version: 0.5.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:19:29 -05:00
anchore-actions-token-generator[bot] and spiffcs
997a76712f
chore(deps): update tools to latest versions ( #4504 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2026-01-05 09:19:24 -05:00
dependabot[bot]
e44ef53489
chore(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 ( #4518 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.3 to 1.8.4.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.3...v1.8.4 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:17:46 -05:00
dependabot[bot]
e0708e725f
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.18 to 0.5.19 ( #4520 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.18 to 0.5.19.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.18...v0.5.19 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.19
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-01-05 09:17:39 -05:00
Alex Goodman
e9e3494853
remove debug output ( #4496 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-22 14:51:39 -05:00
b3c70da3ea
Add experimental cataloger capabilities command ( #4317 )
...
* add info command from generated capabilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct gentoo and arch ecosystems
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename os pkg types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* better binary cataloger description
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expose metadata and pacakge types in json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* expose json schema types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add completeness tests for metadata types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* latest generation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* improve testing a docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests and linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore goreleaser config
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tweak diagram
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix pdm
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: java binary data
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* new capability descriptions for gguf and python
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct poetry lock integrity hash claim
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix compile error
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix: remove purl version from overrides
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* fix lua deps ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep gguf as ai ecosystem
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split packages.yaml to multiple files by go package
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure tests do not use go test cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* sort json output for info command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* docs: fix ocaml, php, and portage capabilities yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: update erlang capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update java capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update javascript capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update linux kernel capabilities
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* remove missing tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix package.yaml references
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* revert license list change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* check for drift in capability descriptions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate capabilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* test cleanup
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use fixture cache in static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* claim fixtures pre-req for cap generation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update documentation with correct regeneration procedure
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: ruby-gemspec-cataloger finds no dependencies
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: fix python docs and config comment
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: commit re-generated java yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* add cataloger selection to caps command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* re-generate cap yamls
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests for cataloger selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename cmd to `cataloger info`
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] change capability description locations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] continued
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] adjust for import cycles
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-22 19:34:10 +00:00
Alex Goodman
ae1a247f3d
Unpin fixture dependencies that will always float ( #4495 )
...
* unpin dependencies for package dedup case
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* prevent make from blocking tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add check
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-22 19:17:58 +00:00
Alex Goodman
0ea920ba6d
Decompress UPX packed binaries to extract golang build info (ELF formatted binaries with lzma method only) ( #4480 )
...
* decompress upx packed binaries
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting and remove dead code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-22 14:17:38 +00:00
anchore-actions-token-generator[bot] and spiffcs
7ef4703454
chore(deps): update tools to latest versions ( #4491 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-22 09:15:51 -05:00
dependabot[bot]
8334fb04ec
chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0 ( #4489 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.40.1 to 1.41.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.1...v1.41.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-19 11:00:31 -05:00
VictorHuu
c9760d2341
feat: snap can be queried by revision and ``track/risk/branch`` ( #4439 )
...
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-12-18 15:41:36 -05:00
Rez Moss and Christopher Phillips
74c9380248
fix: 4423 dotnet-deps cataloger skips project type by def
...
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-12-18 13:38:47 -05:00
Alex Goodman
7ed733c3fb
signpost to docs site ( #4483 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-17 18:00:38 +00:00
dependabot[bot]
a39c600913
chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 ( #4481 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.8 to 4.31.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/1b168cd39490f61582a9beae412bb7057a6b2c4e...5d4e8d1aca955e8d8589aabd499c5cae939e33c7 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-17 10:20:52 -05:00
dependabot[bot]
a2020fe1c7
chore(deps): bump github.com/goccy/go-yaml from 1.19.0 to 1.19.1 ( #4482 )
...
Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml ) from 1.19.0 to 1.19.1.
- [Release notes](https://github.com/goccy/go-yaml/releases )
- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md )
- [Commits](https://github.com/goccy/go-yaml/compare/v1.19.0...v1.19.1 )
---
updated-dependencies:
- dependency-name: github.com/goccy/go-yaml
dependency-version: 1.19.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-17 10:20:43 -05:00
Rez Moss and Alex Goodman
c79a57b6a1
Detect embedded deps.json in .NET binaries ( #4375 )
...
* syft detect embedded deps.json,dotnet , fixed #4344
Signed-off-by: Rez Moss <hi@rezmoss.com >
* [wip] have pe utils process embedded dep.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] add PoC bundler processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] search for bundle marker within pe sections
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* put bundle parsing for multiple .net versions under test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-16 08:35:19 -05:00
dependabot[bot]
2c97ff1b24
chore(deps): bump actions/cache from 5.0.0 to 5.0.1 ( #4476 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...9255dc7a253b0ccc959486e2bca901246202afeb )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-16 08:28:51 -05:00
dependabot[bot]
e760a7cad4
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #4477 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/a7833574556fa59680c1b7cb190c1735db73ebf0...9255dc7a253b0ccc959486e2bca901246202afeb )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-16 08:28:48 -05:00
anchore-actions-token-generator[bot] and spiffcs
e1ae4e1112
chore(deps): update tools to latest versions ( #4473 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-16 08:28:44 -05:00
Alex Goodman
beb70891e5
unapply base path for resolver inbound requests ( #4478 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-16 08:28:12 -05:00
Rez Moss and Keith Zantow
e0b61a3ae3
fix: golang PURL should include full module ( #4395 )
...
* fixed #4316 go mod with ver purl
Signed-off-by: Rez Moss <hi@rezmoss.com >
* go mod purl fixed, added func to handle go.mod
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fix: use module name in PURL string everywhere
Signed-off-by: Keith Zantow <kzantow@gmail.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-12-12 14:19:26 -05:00
VictorHuu and Alex Goodman
4c38ee1932
fix:best effort to get the os info of an ELF binary ( #4438 )
...
* fix:the os of an elf binary should be detected even when the os version is empty
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:revoke the update of appCpe
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:resume the testcase
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* fix:revoke the possible compromise to the json schema
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* fix:align with the json schema
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add a json schema(pre-relase,may be in conflict with others')
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:add a json schema
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:revert the accidental change to 16.1.0
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* regression/fix:best effort to get the os info
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:resume the previous json file
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* update the schema ver to 16.2.0
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore:no breaking behavior
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* chore: follow the guide of the README.md
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* appCpe is temporarily unused
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* preserve json field for osCPE
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-12 19:13:59 +00:00
Alex Goodman
6be0a9abc4
Improve PR template ( #4472 )
...
* improve pr template
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* incorporate feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-12-12 15:45:29 +00:00
Alexandre Steppé
ea1f4cba38
feat: add support for Gemfile.next.lock ( #4457 )
...
Signed-off-by: Alexandre Steppé <alexandre.steppe@gmail.com >
2025-12-12 10:20:53 -05:00
VictorHuu
c8982b887d
chore:cancel in-progress workflows for new commits on same PR ( #4465 )
...
Signed-off-by: VictorHuu <victorhu493@gmail.com >
2025-12-12 10:20:20 -05:00
anchore-actions-token-generator[bot] and spiffcs
6ad4873a33
chore(deps): update tools to latest versions ( #4466 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-12 08:49:02 -05:00
dependabot[bot]
052e4ca9a3
chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 ( #4468 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.7 to 4.31.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/cf1bb45a277cb3c205638b2cd5c984db1c46a412...1b168cd39490f61582a9beae412bb7057a6b2c4e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:36 -05:00
dependabot[bot]
41e133e2cf
chore(deps): bump actions/cache from 4.3.0 to 5.0.0 ( #4469 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.3.0 to 5.0.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...a7833574556fa59680c1b7cb190c1735db73ebf0 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:32 -05:00
dependabot[bot]
a85e034afc
chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to 0.1.16 ( #4470 )
...
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.1.14 to 0.1.16.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/stereoscope/compare/v0.1.14...v0.1.16 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-version: 0.1.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:28 -05:00
dependabot[bot]
d5380013ae
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #4471 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.3.0 to 5.0.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0057852bfaa89a56745cba8c7296529d2fc39830...a7833574556fa59680c1b7cb190c1735db73ebf0 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-12 08:48:22 -05:00
anchore-actions-token-generator[bot] and spiffcs
5ea3387cbc
chore(deps): update tools to latest versions ( #4462 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-11 09:55:34 -05:00
Chris Greeno
568b7601bb
fix(javascript): remove debug print statement in dependency parser ( #4412 )
...
Removes an accidental `fmt.Println("error", err)` that was left in
the javascript dependency parser. This causes noisy output to stdout
when parsing npm package-lock.json files that contain dependency
specifiers that aren't valid PURLs.
Signed-off-by: Chris Greeno <chris@fresha.com >
2025-12-10 13:42:09 -05:00
Kendrick
7fdb08c0b6
Validating download_url for github repositories, and updating if necessary ( #4390 )
...
* Adding a second function to validate/correct urls that are just github repositories
Signed-off-by: Kendrick <kmartinix@gmail.com >
* Adding test case to capture github repositories
Signed-off-by: Kendrick <kmartinix@gmail.com >
---------
Signed-off-by: Kendrick <kmartinix@gmail.com >
2025-12-10 13:41:00 -05:00
anchore-actions-token-generator[bot] and spiffcs
47e1cee5a5
chore(deps): update tools to latest versions ( #4456 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-10 13:34:42 -05:00
dependabot[bot]
a0c5b8aa8d
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7 ( #4460 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.5 to 6.7.7.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.5...v6.7.7 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:32:56 -05:00
dependabot[bot]
ab5fa0a664
chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 ( #4459 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.11 to 8.0.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/22a9089034f40e5a961c8808d113e2c98fb63676...98357b18bf14b5342f975ff684046ec3b2a07725 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 8.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:32:51 -05:00
dependabot[bot]
07ad8a5573
chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 ( #4458 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.10 to 0.20.11.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/fbfd9c6c189226748411491745178e0c2017392d...43a17d6e7add2b5535efe4dcae9952337c479a93 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-10 13:32:47 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
bfe63f83db
chore(deps): update anchore dependencies ( #4440 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2025-12-09 20:56:03 +00:00
f01056d111
chore(deps): update tools to latest versions ( #4442 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: suppress revive on internal/os package name
golangci-lint has started flagging internal/os package name for
shadowing the stdlib package named "os". Suppress this.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-09 11:00:08 -05:00
dependabot[bot]
09b24bdb47
chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.11 ( #4447 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.8 to 7.0.11.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/271a8d0340265f705b14b6d32b9829c1cb33d45e...22a9089034f40e5a961c8808d113e2c98fb63676 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-version: 7.0.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:59:32 -05:00
dependabot[bot]
ae1fa09e02
chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.1 ( #4445 )
...
Bumps [actions/create-github-app-token](https://github.com/actions/create-github-app-token ) from 2.1.4 to 2.2.1.
- [Release notes](https://github.com/actions/create-github-app-token/releases )
- [Commits](https://github.com/actions/create-github-app-token/compare/67018539274d69449ef7c02e8e71183d1719ab42...29824e69f54612133e76f7eaac726eef6c875baf )
---
updated-dependencies:
- dependency-name: actions/create-github-app-token
dependency-version: 2.2.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:57:48 -05:00
dependabot[bot]
6b0f924426
chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0 ( #4448 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.6.2 to 5.7.0.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.6.2...v5.7.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-version: 5.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:56:00 -05:00
dependabot[bot]
6d56087289
chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 ( #4446 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.6 to 4.31.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/fe4161a26a8629af62121b670040955b330f9af2...cf1bb45a277cb3c205638b2cd5c984db1c46a412 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:47:52 -05:00
dependabot[bot]
1d718f3311
chore(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 ( #4453 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.39.0 to 0.40.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.39.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-09 09:46:52 -05:00
Keith Zantow
9e3150b7ee
fix: java archives excluded due to incorrect license glob results ( #4449 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-12-08 15:58:13 -05:00
Will Murphy
d950ac1fae
fix: use vercel for vendor in nextjs CPE ( #4450 )
...
The recent react / next CVE uses "vercel" as the vendor, see
https://nvd.nist.gov/vuln/detail/CVE-2025-55182
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-08 20:23:36 +00:00
VictorHuu
baca32f04a
fix:after compliance applied,the relationship concerning the original one should be omitted ( #4419 )
...
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-12-04 15:30:16 -05:00
dependabot[bot]
155738aba7
chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to 2.3.5 ( #4434 )
...
Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) from 2.3.4 to 2.3.5.
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.3.4...v2.3.5 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-version: 2.3.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-04 13:42:59 -05:00
dependabot[bot]
2b72158b0b
chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 ( #4435 )
...
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra ) from 1.10.1 to 1.10.2.
- [Release notes](https://github.com/spf13/cobra/releases )
- [Commits](https://github.com/spf13/cobra/compare/v1.10.1...v1.10.2 )
---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
dependency-version: 1.10.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-04 13:42:50 -05:00
dependabot[bot]
a80679beba
chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 ( #4431 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/1af3b93b6815bc44a9784bd300feb67ff0d1eeb3...8e8c483db84b4bee98b60c0593521ed34d9990e8 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-03 20:18:45 -05:00
dependabot[bot]
b0c74d4104
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.17 to 0.5.18 ( #4432 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.17 to 0.5.18.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/0.5.17...0.5.18 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-03 13:20:11 -05:00
VictorHuu and Christopher Phillips
afe28a2fc0
fix:handle compound aliases like ``.tgz`` when cataloging archives ( #4421 )
...
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-12-02 16:55:32 -05:00
Will Murphy
d37ed567a8
chore: use git ls-files instead of find to list files ( #4425 )
...
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-01 16:46:42 -05:00
dependabot[bot]
e556ceb4a8
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.15 to 0.5.17 ( #4413 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.15 to 0.5.17.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.15...0.5.17 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 16:34:38 -05:00
anchore-actions-token-generator[bot] and spiffcs
d8538e7d8b
chore(deps): update tools to latest versions ( #4420 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-12-01 16:34:18 -05:00
dependabot[bot]
cd19ac956c
chore(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1.2 ( #4427 )
...
Bumps [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter ) from 1.1.1 to 1.1.2.
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.1.1...v1.1.2 )
---
updated-dependencies:
- dependency-name: github.com/olekukonko/tablewriter
dependency-version: 1.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 16:34:07 -05:00
dependabot[bot]
d1a523fef5
chore(deps): bump github/codeql-action from 4.31.4 to 4.31.6 ( #4424 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.4 to 4.31.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e12f0178983d466f2f6028f5cc7a6d786fd97f4b...fe4161a26a8629af62121b670040955b330f9af2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 16:34:03 -05:00
dependabot[bot]
e1e3d002bc
chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 ( #4426 )
...
Bumps [github.com/goccy/go-yaml](https://github.com/goccy/go-yaml ) from 1.18.0 to 1.19.0.
- [Release notes](https://github.com/goccy/go-yaml/releases )
- [Changelog](https://github.com/goccy/go-yaml/blob/master/CHANGELOG.md )
- [Commits](https://github.com/goccy/go-yaml/compare/v1.18.0...v1.19.0 )
---
updated-dependencies:
- dependency-name: github.com/goccy/go-yaml
dependency-version: 1.19.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-12-01 16:33:48 -05:00
Will Murphy
a0f7148608
chore: ignore .DS_Store in test fixtures ( #4422 )
...
Otherwise, we get test failures on macOS if macOS has decided to put
.DS_Store entries in the test fixtures.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-12-01 10:15:35 -05:00
Adam Chovanec and Adam Chovanec
5b96d1d69d
chore: rename test func for CPE decoder ( #4379 )
...
Signed-off-by: Adam Chovanec <git@adamchovanec.cz >
Co-authored-by: Adam Chovanec <git@adamchovanec.cz >
2025-11-25 23:05:31 -05:00
dependabot[bot]
6c666383e7
chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 ( #4381 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.9 to 0.20.10.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/8e94d75ddd33f69f691467e42275782e4bfefe84...fbfd9c6c189226748411491745178e0c2017392d )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-25 23:05:05 -05:00
dependabot[bot]
b9710a1e79
chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1 ( #4382 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.40.0 to 1.40.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.40.0...v1.40.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.40.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-25 23:04:56 -05:00
dependabot[bot]
023a14f869
chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 ( #4396 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 5.0.0 to 6.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/08c6903cd8c0fde910a37f88322edcfb5dd907a8...1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-25 23:03:02 -05:00
dependabot[bot]
439a063d08
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.3 to 6.7.5 ( #4397 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.3 to 6.7.5.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.3...v6.7.5 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-25 10:20:59 -05:00
Will Murphy
c95893209d
fix: normalize python package names from dependency lists ( #4408 )
...
Because package names in METADATA files may have upper case like
Werkzeug or Jinja2, but Syft artifacts have normalized names and are
lower case, like werkzeug or jinja2, Syft would miss emitting dependency
relationships. Therefore, normalize dependency names before comparing
with existing artifacts.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-11-25 10:20:21 -05:00
anchore-actions-token-generator[bot] and spiffcs
7e02bdfe45
chore(deps): update tools to latest versions ( #4398 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-11-25 10:17:33 -05:00
dependabot[bot]
479cf5aff2
chore(deps): bump github.com/google/go-containerregistry ( #4409 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.6 to 0.20.7.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.6...v0.20.7 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.20.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-25 10:16:54 -05:00
dependabot[bot]
f12788da78
chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 ( #4386 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.3 to 4.31.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/014f16e7ab1402f30e7c3329d33797e7948572db...e12f0178983d466f2f6028f5cc7a6d786fd97f4b )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:40:21 -05:00
dependabot[bot]
67709362b6
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to 6.7.3 ( #4387 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.2 to 6.7.3.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.2...v6.7.3 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:01:21 -05:00
dependabot[bot]
55526dbde0
chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 ( #4391 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/crypto/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-version: 0.45.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:01:05 -05:00
dependabot[bot]
af167ba0c1
chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 ( #4392 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6.0.0 to 6.1.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:00:56 -05:00
dependabot[bot]
00e1329bd1
chore(deps): bump actions/setup-go in /.github/actions/bootstrap ( #4393 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 6.0.0 to 6.1.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/44694675825211faa026b3c33043df3e48a5fa00...4dc6199c7b1a012772edbd06daecab0f50c9053c )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.1.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-20 12:00:44 -05:00
Christopher Angelo Phillips
9aca8167b8
chore: drop cpe from gguf ( #4383 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-11-19 05:37:40 -05:00
Will Murphy
759909f611
fix: emit lua rockspec dependencies in metadata ( #4376 )
...
The types / schema allowed for this field to begin with but it wasn't
set.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-11-18 09:19:41 -05:00
Keith Zantow
7014cb023f
chore: options to run release-install-script without release ( #4377 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-11-17 22:12:04 +00:00
anchore-actions-token-generator[bot]
a033ae525f
chore(deps): update anchore dependencies ( #4374 )
2025-11-17 12:17:15 -05:00
Will Murphy
1c22325385
ci: output oras path ( #4373 )
...
* ci: output oras path
Some workflows expect bootstrap to output the oras path. This seems like
a reasonable thing for it to do.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* ci: use path to oras from binny
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-11-17 15:36:45 +00:00
dependabot[bot]
75ad5c6c74
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.1 to 6.7.2 ( #4372 )
2025-11-17 08:47:47 -05:00
dependabot[bot] and Keith Zantow
d2641dfa39
chore(deps): bump golang.org/x/tools from 0.38.0 to 0.39.0 ( #4364 )
...
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-11-17 13:41:45 +00:00
anchore-actions-token-generator[bot] and spiffcs
365325376a
chore(deps): update tools to latest versions ( #4370 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-11-15 06:47:23 -05:00
Alex Goodman
153f2321ce
Fix test-fixture publish ( #4369 )
...
* pin python dependencies
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* pin rust dependencies
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* pin php deps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update and pin http and curl fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-14 15:41:23 -05:00
Alex Goodman
7bf7bcc461
Support extras statements in Python PDM cataloger ( #4352 )
...
* fix pdm
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add test for metadata construction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing test fixture
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* conserve markers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add additional tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-14 15:13:10 -05:00
anchore-actions-token-generator[bot] and spiffcs
6a21b5e5e2
chore(deps): update tools to latest versions ( #4365 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-11-14 09:25:27 -05:00
dependabot[bot]
6480c8a425
chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 ( #4366 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.2 to 4.31.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/0499de31b99561a6d14a36a5f662c2a54f91beee...014f16e7ab1402f30e7c3329d33797e7948572db )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-14 09:25:08 -05:00
Kudryavcev Nikolay
89842bd2f6
chore: migrate syft to use mholt/archives instead of anchore fork ( #4029 )
...
---------
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-13 23:04:43 +00:00
Christopher Angelo Phillips
4a60c41f38
feat: 4184 gguf parser (ai artifact cataloger) part 1 ( #4279 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-11-13 17:43:48 -05:00
anchore-actions-token-generator[bot] and spiffcs
2e100f33f3
chore(deps): update tools to latest versions ( #4358 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-11-12 13:27:47 -05:00
dependabot[bot]
b444f0c2ed
chore(deps): bump golang.org/x/mod from 0.29.0 to 0.30.0 ( #4359 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.29.0 to 0.30.0.
- [Commits](https://github.com/golang/mod/compare/v0.29.0...v0.30.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.30.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-12 13:27:33 -05:00
Adam Chovanec
102d362daf
feat: CPEs format decoder ( #4207 )
...
Signed-off-by: Adam Chovanec <git@adamchovanec.cz >
2025-11-12 10:45:09 -05:00
Alex Goodman
66c78d44af
Document additional json schema fields ( #4356 )
...
* add documentation to key fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-10 16:29:06 -05:00
dependabot[bot]
78a4ab8ced
chore(deps): bump github.com/olekukonko/tablewriter from 1.0.9 to 1.1.1 ( #4354 )
...
Bumps [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter ) from 1.0.9 to 1.1.1.
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.0.9...v1.1.1 )
---
updated-dependencies:
- dependency-name: github.com/olekukonko/tablewriter
dependency-version: 1.1.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-10 13:31:15 -05:00
dependabot[bot]
25ca33d20e
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.0 to 6.7.1 ( #4355 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.7.0 to 6.7.1.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.7.0...v6.7.1 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-10 13:30:56 -05:00
anchore-actions-token-generator[bot] and spiffcs
60ca241593
chore(deps): update tools to latest versions ( #4347 )
...
* chore: new tool checks
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-11-07 20:56:44 +00:00
dependabot[bot]
0f475c8bcd
chore(deps): bump github.com/opencontainers/selinux ( #4349 )
...
Bumps [github.com/opencontainers/selinux](https://github.com/opencontainers/selinux ) from 1.11.0 to 1.13.0.
- [Release notes](https://github.com/opencontainers/selinux/releases )
- [Commits](https://github.com/opencontainers/selinux/compare/v1.11.0...v1.13.0 )
---
updated-dependencies:
- dependency-name: github.com/opencontainers/selinux
dependency-version: 1.13.0
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-07 15:21:35 -05:00
Alex Goodman
199394934d
preserve --from order ( #4350 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-07 10:17:10 -05:00
dependabot[bot]
8a22d394ed
chore(deps): bump golang.org/x/time from 0.12.0 to 0.14.0 ( #4348 )
...
Bumps [golang.org/x/time](https://github.com/golang/time ) from 0.12.0 to 0.14.0.
- [Commits](https://github.com/golang/time/compare/v0.12.0...v0.14.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/time
dependency-version: 0.14.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-07 08:48:20 -05:00
Tim Olshansky
bbef262b8f
feat: Add license enrichment from pypi to python packages ( #4295 )
...
* feat: Add license enrichment from pypi to python packages
* Implement license caching and improve test coverage
---------
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
2025-11-06 16:05:08 -05:00
Tim Olshansky
4e06a7ab32
feat(javascript): Add dependency parsing ( #4304 )
...
* feat: Add dependency parsing to javascript package locks
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Bump schema version
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Add support for yarn and pnpm, excl. yarn v1
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Add support for dependencies for v1 yarn lock files
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Ensure schema is correctly generated
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* Fix tests
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
* PR feedback
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
---------
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
2025-11-06 16:03:43 -05:00
Alex Goodman
e5711e9b42
Update CPE processing to use NVD API ( #4332 )
...
* update NVD CPE dictionary processor to use API
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* pass linting with exceptions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-06 16:02:26 -05:00
Rez Moss
f69b1db099
feat: detect elixir bin ( #4334 )
...
* Elixir detection, fixed #4333
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
2025-11-06 16:02:02 -05:00
dependabot[bot]
fe1ea443c2
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to 6.7.0 ( #4337 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.9 to 6.7.0.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.9...v6.7.0 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-06 15:47:49 -05:00
dependabot[bot]
bfcbf266df
chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 ( #4340 )
...
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd ) from 1.7.28 to 1.7.29.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v1.7.28...v1.7.29 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
dependency-version: 1.7.29
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-06 15:46:32 -05:00
Keith Zantow
a400c675fc
feat: license file search ( #4327 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-11-03 14:16:05 -05:00
Alex Goodman
7c154e7c37
use official action for token generation ( #4331 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-11-03 13:08:42 -05:00
anchore-actions-token-generator[bot] and spiffcs
4c93394bc2
chore(deps): update anchore dependencies ( #4330 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-11-03 12:44:07 -05:00
kdt523
3e4e82f03e
Canonicalize Ghostscript CPE/PURL for ghostscript packages from PE Binaries ( #4308 )
...
* binary(pe): canonicalize Ghostscript CPE to artifex:ghostscript and add generic purl for PE (#4275 )\n\n- Detect Ghostscript via PE version resources and set purl pkg:generic/ghostscript@<version>\n- Add PE-specific CPE candidates: vendor 'artifex', product 'ghostscript'\n- Add focused unit tests for purl and CPE generation
Signed-off-by: kdt523 <krushna.datir231@vit.edu >
* fix: gofmt formatting for static analysis pass (pe-ghostscript-cpe-purl-4275)
Signed-off-by: kdt523 <krushna.datir231@vit.edu >
---------
Signed-off-by: kdt523 <krushna.datir231@vit.edu >
2025-11-03 14:54:48 +00:00
dependabot[bot]
793b0a346f
chore(deps): bump github/codeql-action from 4.31.1 to 4.31.2 ( #4325 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.1 to 4.31.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5fe9434cd24fe243e33e7f3305f8a5b519b70280...0499de31b99561a6d14a36a5f662c2a54f91beee )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-03 09:11:20 -05:00
dependabot[bot]
a0dac519db
chore(deps): bump github.com/hashicorp/go-getter from 1.8.2 to 1.8.3 ( #4326 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.2 to 1.8.3.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.2...v1.8.3 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-03 09:11:12 -05:00
dependabot[bot]
34f5e521c1
chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0 ( #4329 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.39.1 to 1.40.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.39.1...v1.40.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-11-03 09:11:05 -05:00
dependabot[bot]
774b1e97b9
chore(deps): bump github/codeql-action from 4.31.0 to 4.31.1 ( #4321 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.31.0 to 4.31.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4e94bd11f71e507f7f87df81788dff88d1dacbfb...5fe9434cd24fe243e33e7f3305f8a5b519b70280 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-30 13:19:57 -04:00
Alex Goodman
538430d65d
describe cataloger capabilities via test observations ( #4318 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-30 13:19:42 -04:00
Alex Goodman
5db3a9bf55
add workflow to create PR for spdx license list updates ( #4319 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-30 12:14:13 -04:00
Stepan and Alex Goodman
efc2f0012c
fix: go binary replace handling in path ( #4156 )
...
* Fix issue with relative paths on go binary
Signed-off-by: Stepan <stepworm@yandex.ru >
* Linting
Signed-off-by: Stepan <stepworm@yandex.ru >
---------
Signed-off-by: Stepan <stepworm@yandex.ru >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-29 15:59:47 +00:00
kyounghoonJang and Alex Goodman
c5c1454848
feat(java): Add support for .far (Feature Archive) files ( #4193 )
...
* feat(java): add support for .far archivesEnables the Java cataloger to recognize and catalog dependencies within .far files, which are used in Apache Sling applications.
Signed-off-by: Kyounghoon Jang <matkimchi_@naver.com >
* feat(java): Add tests for .far (Feature Archive) file support
Signed-off-by: Kyounghoon Jang <matkimchi_@naver.com >
---------
Signed-off-by: Kyounghoon Jang <matkimchi_@naver.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-29 15:41:27 +00:00
Kudryavcev Nikolay
f5c765192c
Refactor fileresolver to not require base path ( #4298 )
...
* ref: close source in test and examples
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
* ref: pretty file/directory source resolver (make them more similar)
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
* ref: move absoluteSymlinkFreePathToParent to file resolver
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
* revert breaking change
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
---------
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
2025-10-29 10:41:18 -04:00
Will Murphy
728feea620
ci: use apple creds before pushing tags ( #4313 )
...
We have had a few releases fail because the Apple credentials needed
some sort of fix. These release were operationally more interesting
because they failed after pushing a git tag (which effectively releases
the golagn package). Therefore, try to use these creds early, before
there's a tag pushed.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-10-29 10:07:47 -04:00
dependabot[bot]
45fb52dca1
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8 to 6.6.9 ( #4315 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.8 to 6.6.9.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.8...v6.6.9 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-version: 6.6.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-29 10:06:37 -04:00
Rez Moss
45bf8b14ab
fix: omit records with empty PURL in GitHub format ( #4312 )
...
Signed-off-by: Rez Moss <hi@rezmoss.com >
2025-10-28 18:34:10 -04:00
Brian Muenzenmeyer
9478cd974b
docs: update template link in README.md ( #4306 )
...
Signed-off-by: Brian Muenzenmeyer <brian.muenzenmeyer@gmail.com >
2025-10-28 11:29:07 -04:00
Will Murphy
0d9ea69a66
Respect "rpmmod" PURL qualifier ( #4314 )
...
Red Hat purls the RPM modularity info in a query param in the PURLs in
their vulnerability data. It would be nice if Syft respected this
qualifier so that Grype can use it when a Red Hat purl is passed.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-10-28 09:35:11 -04:00
dependabot[bot]
bee78c0b16
chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 ( #4310 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.30.9 to 4.31.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/16140ae1a102900babc80a33c44059580f687047...4e94bd11f71e507f7f87df81788dff88d1dacbfb )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.31.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-27 10:43:04 -04:00
dependabot[bot]
88bbcbe9c6
chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 ( #4305 )
2025-10-27 02:03:09 -04:00
anchore-actions-token-generator[bot]
e0680eb704
chore(deps): update tools to latest versions ( #4307 )
2025-10-27 02:02:47 -04:00
Marc
16f851c5d9
feat: include .rar files as Java archives for Java resource adapters ( #4137 )
...
Signed-off-by: Marc Thomas <marc.thomas@t-systems.com >
2025-10-24 11:55:02 -04:00
Ross Kirk
d5ca1ad543
fix: ignore dpkg entries with "deinstall" status ( #4231 )
...
Signed-off-by: Ross Kirk <ross.kirk@upwind.io >
2025-10-23 16:23:58 -04:00
anchore-actions-token-generator[bot] and spiffcs
8be463911c
chore(deps): update tools to latest versions ( #4302 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-10-22 09:38:18 -04:00
dependabot[bot]
44b7b0947c
chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to 2.3.4 ( #4301 )
2025-10-21 09:34:26 -04:00
dependabot[bot]
675075e882
chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 ( #4299 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 4.30.8 to 4.30.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f443b600d91635bebf5b0d9ebc620189c0d6fba5...16140ae1a102900babc80a33c44059580f687047 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.30.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-20 10:08:39 -04:00
JoeyShapiro
31b2c4c090
support universal (fat) mach-o binary files ( #4278 )
...
Signed-off-by: Joseph Shapiro <joeyashapiro@gmail.com >
2025-10-17 13:41:59 -04:00
dependabot[bot]
07029ead8a
chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 ( #4296 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.10.0 to 4.0.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/d7543c93d881b35a8faa02e8e3605f69b7a1ce62...faadad0cce49287aee09b3a48701e75088a2c6ad )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 4.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-17 10:22:20 -04:00
dependabot[bot]
f4de1e863c
chore(deps): bump anchore/sbom-action from 0.20.7 to 0.20.8 ( #4297 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.7 to 0.20.8.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/d8a2c0130026bf585de5c176ab8f7ce62d75bf04...aa0e114b2e19480f157109b9922bda359bd98b90 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-17 10:22:10 -04:00
JoeyShapiro
538b4a2194
convert posix path back to windows ( #4285 )
...
Signed-off-by: Joseph Shapiro <joeyashapiro@gmail.com >
2025-10-17 09:29:06 -04:00
Kudryavcev Nikolay
fc74b07369
Remove duplicate image source providers ( #4289 )
...
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
2025-10-16 16:19:11 -04:00
dependabot[bot]
6627c5214c
chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.7 ( #4293 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.6 to 0.20.7.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/f8bdd1d8ac5e901a77a92f111440fdb1b593736b...d8a2c0130026bf585de5c176ab8f7ce62d75bf04 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-16 13:57:17 -04:00
Tim Olshansky
c0f32e1dba
feat: add option to fetch remote licenses for pnpm-lock.yaml files ( #4286 )
...
Signed-off-by: Tim Olshansky <456103+timols@users.noreply.github.com >
2025-10-16 12:23:06 -04:00
Pavel Buchart and Keith Zantow
e923db2a94
Add PDM parser ( #4234 )
...
Signed-off-by: Pavel Buchart <pavel@buchart.cz >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-10-16 08:50:44 -04:00
anchore-actions-token-generator[bot] and spiffcs
0c98a364d5
chore(deps): update tools to latest versions ( #4291 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-10-16 07:02:32 -04:00
Keith Zantow
4343d04652
fix: panic during java archive maven resolution ( #4290 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-10-16 07:00:31 -04:00
Kudryavcev Nikolay
065ac13ab7
Extract zip archive with multiple entries ( #4283 )
...
* extract zip archive with multiple entries
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
* set OverwriteExisting by type assertion switch case
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
---------
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
2025-10-15 12:05:05 -04:00
Christopher Angelo Phillips
e9a8bc5ab9
chore: update to use old configuration on new cosign ( #4287 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-10-15 15:12:20 +00:00
anchore-actions-token-generator[bot] and spiffcs
6d790ec6ec
chore(deps): update anchore dependencies ( #4282 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-10-14 22:09:17 +00:00
dependabot[bot] and Will Murphy
1d5bcc553a
chore(deps): bump github.com/mholt/archives from 0.1.3 to 0.1.5 ( #4280 )
...
* chore(deps): bump github.com/mholt/archives from 0.1.3 to 0.1.5
Bumps [github.com/mholt/archives](https://github.com/mholt/archives ) from 0.1.3 to 0.1.5.
- [Release notes](https://github.com/mholt/archives/releases )
- [Commits](https://github.com/mholt/archives/compare/v0.1.3...v0.1.5 )
---
updated-dependencies:
- dependency-name: github.com/mholt/archives
dependency-version: 0.1.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
* chore: allow lzip-go in bouncer yaml
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-10-14 14:22:00 -04:00
Alex Goodman
d22914baf5
add docs to configs ( #4281 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-14 13:58:31 -04:00
Doug Clarke and Christopher Phillips
760bd9a50a
feat: Pom xml only archive parser ( #4272 )
...
fix: identifying jar files with a single pom.xml and no pom.properties file
fix: test works with pom.xml being found, used and reported in metadata
Signed-off-by: Doug Clarke <douglas.clarke@oracle.com >
test: check for current project path and use
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com >
---------
Signed-off-by: Doug Clarke <douglas.clarke@oracle.com >
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <spiffcs@users.noreply.github.com >
2025-10-13 15:59:08 -04:00
Hala Ali and Christopher Phillips
2d1ada1d00
fix: enhance setup.py parser to handle unquoted dependencies ( #4255 )
...
* fix: add support for unquoted Python dependencies in setup.py
- Add regex pattern to match unquoted package==version format
- Handles common .split() pattern used in projects like mayan-edms
- Maintains backward compatibility with quoted dependencies
- Prevents duplicate package detection
Signed-off-by: Hala Ali alih16@vcu.edu
Signed-off-by: HalaAli198 <alih16@vcu.edu >
* fix: apply gofmt formatting
Signed-off-by: HalaAli198 <alih16@vcu.edu >
* lint: incorporate new changes and refactor complexity
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com >
---------
Signed-off-by: HalaAli198 <alih16@vcu.edu >
Signed-off-by: Christopher Phillips <spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <spiffcs@users.noreply.github.com >
2025-10-13 15:10:42 -04:00
dependabot[bot]
8ffe15c710
chore(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 ( #4265 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.37.0 to 0.38.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-13 11:50:59 -04:00
dependabot[bot]
89948dfa51
chore(deps): bump golang.org/x/mod from 0.28.0 to 0.29.0 ( #4266 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.28.0 to 0.29.0.
- [Commits](https://github.com/golang/mod/compare/v0.28.0...v0.29.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.29.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-13 11:50:49 -04:00
anchore-actions-token-generator[bot] and spiffcs
1a58f27f87
chore(deps): update tools to latest versions ( #4274 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-10-13 11:50:41 -04:00
dependabot[bot]
450cd72da5
chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1 ( #4276 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.39.0 to 1.39.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.39.0...v1.39.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.39.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-13 11:50:25 -04:00
dependabot[bot]
5056c7f861
chore(deps): bump github/codeql-action from 4.30.7 to 4.30.8 ( #4277 )
2025-10-13 10:47:50 -04:00
Alex Goodman
4ae8f73583
migrate json schema generation ( #4270 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-10 14:16:28 +00:00
dependabot[bot]
18e789c4fd
chore(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to 0.6.0 ( #4267 )
...
Bumps [github.com/gohugoio/hashstructure](https://github.com/gohugoio/hashstructure ) from 0.5.0 to 0.6.0.
- [Release notes](https://github.com/gohugoio/hashstructure/releases )
- [Commits](https://github.com/gohugoio/hashstructure/compare/v0.5.0...v0.6.0 )
---
updated-dependencies:
- dependency-name: github.com/gohugoio/hashstructure
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 15:10:47 -04:00
dependabot[bot]
7d4680bc08
chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 ( #4268 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.45.0 to 0.46.0.
- [Commits](https://github.com/golang/net/compare/v0.45.0...v0.46.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.46.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-09 15:10:36 -04:00
Bernardo de Araujo
231f04ae0e
feat: Parse pnpm v9 lockfiles ( #4256 )
...
Signed-off-by: bernardoamc <bernardo.amc@gmail.com >
2025-10-09 15:07:59 -04:00
dependabot[bot]
3b82a3724a
chore(deps): bump github/codeql-action from 3.30.6 to 4.30.7 ( #4262 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.6 to 4.30.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/64d10c13136e1c5bce3e5fbde8d4906eeaafc885...e296a935590eb16afc0c0108289f68c87e2a89a5 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 4.30.7
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-08 16:44:21 -04:00
dependabot[bot]
337a2754e5
chore(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 ( #4263 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.44.0 to 0.45.0.
- [Commits](https://github.com/golang/net/compare/v0.44.0...v0.45.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.45.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-08 16:44:13 -04:00
anchore-actions-token-generator[bot] and spiffcs
190f3068d8
chore(deps): update tools to latest versions ( #4261 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-10-08 16:44:05 -04:00
Sebastien Dionne
bd013fe99a
docs: Fix typos and linguistic errors in documentation ( #4257 )
...
Signed-off-by: Sebastien Dionne <survivant00@gmail.com >
2025-10-06 14:22:22 +00:00
+1
c732052cf1
feat(cpegenerate): add support for binary package digit-suffix variations in CPE generation ( #4093 )
...
* feat(cpegenerate): add support for binary package digit-suffix variations in CPE generation
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.13 to 0.5.14 (#4089 )
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.13 to 0.5.14.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.13...v0.5.14 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump modernc.org/sqlite from 1.38.1 to 1.38.2 (#4088 )
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.38.1 to 1.38.2.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.1...v1.38.2 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.38.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump github.com/docker/docker (#4092 )
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 28.2.2+incompatible to 28.3.3+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v28.2.2...v28.3.3 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-version: 28.3.3+incompatible
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump github.com/anchore/stereoscope (#4091 )
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.1.7-0.20250716200927-94c6f92877d4 to 0.1.7.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/stereoscope/commits/v0.1.7 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-version: 0.1.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* migrate to get.anchore.io (#4095 )
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): update anchore dependencies (#4098 )
* chore(deps): update anchore dependencies
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* address reader close operations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): update anchore dependencies (#4104 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#4096 )
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.4 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4e828ff8d448a8a6e532957b1811f387a63867e8...51f77329afa6477de8c49fc9c7046c15b9a4e79d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): update tools to latest versions (#4108 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): update CPE dictionary index (#4112 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): update tools to latest versions (#4111 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump actions/cache in /.github/actions/bootstrap (#4120 )
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.3 to 4.2.4.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/5a3ec84eff668545956fd18022155c47e93e2684...0400d5f644dc74513175e3cd8d07132dd4860809 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 4.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump actions/cache from 4.2.3 to 4.2.4 (#4119 )
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.3 to 4.2.4.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/5a3ec84eff668545956fd18022155c47e93e2684...0400d5f644dc74513175e3cd8d07132dd4860809 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 4.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#4115 )
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/74a5d142397b4f367a81961eba4e8cd7edddf772...184bdaa0721073962dff0199f1fb9940f07167d1 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* fix: nondeterministic Java archive cataloging and improve groupID (#4118 )
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* feat: add binary classifier for hashicorp vault (#4121 )
* add binary classifier for hashicorp vault
The Go Binary Cataloger isn't able to parse the version out of the
binary shipped in the DockerHub images of hashicorp/vault because the
version of the main module isn't set in the binary. Therefore, add a
binary classifier cataloger for this binary.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: add test fixtures, update vault
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: set binary classifier package type based on PURL
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: use github.com/hashicorp/vault as package name
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update tests
Signed-off-by: Keith Zantow <kzantow@gmail.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump github/codeql-action from 3.29.7 to 3.29.8 (#4124 )
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.7 to 3.29.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/51f77329afa6477de8c49fc9c7046c15b9a4e79d...76621b61decf072c1cee8dd1ce2d2a82d33c17ed )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump golang.org/x/mod from 0.26.0 to 0.27.0 (#4123 )
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.26.0 to 0.27.0.
- [Commits](https://github.com/golang/mod/compare/v0.26.0...v0.27.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.27.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 (#4122 )
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.42.0 to 0.43.0.
- [Commits](https://github.com/golang/net/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): update CPE dictionary index (#4126 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore: update GoReleaser configurations (#4128 )
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#4130 )
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* fix: closed reader during java binary detection (#4129 )
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* fix: support multiple letters in openssl patch version (#4106 )
Signed-off-by: honigbot <thesoftbear@gmail.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 (#4134 )
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.8 to 3.29.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/76621b61decf072c1cee8dd1ce2d2a82d33c17ed...df559355d593797519d70b90fc8edd5db049e7a2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* feat: update syft license construction to be able to look up by URL (#4132 )
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* feat: add package supplier flag (#4131 )
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to 0.1.2 (#4135 )
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.1.1 to 0.1.2.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/f52a838cfabf134edcbaa7c8b3677dde20045018...5ca5fc7a4779c5263a3ffa0e1f693009994446d1 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* feat: add support for authors, maintainers, and contributors in package.json. (#4003 )
Fixes #2250
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* feat(cpegentereate): added test for the addBinaryPackageDigitVariation function
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* docs(cpegenerate): made the comment more verbose
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
* nit: separate digit variation concerns from case of use
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: Parthib Mukherjee <parthibmukherjee@gmail.com >
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com >
Signed-off-by: honigbot <thesoftbear@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Parthib Mukherjee <109328510+hawkaii@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Emmanuel Ferdman <emmanuelferdman@gmail.com >
Co-authored-by: honigbot <34426443+honigbot@users.noreply.github.com >
Co-authored-by: Alan Pope <alan.pope@anchore.com >
2025-10-06 10:09:38 -04:00
dependabot[bot]
8f1d45830d
chore(deps): bump github.com/iancoleman/orderedmap ( #4258 )
...
Bumps [github.com/iancoleman/orderedmap](https://github.com/iancoleman/orderedmap ) from 0.0.0-20190318233801-ac98e3ecb4b0 to 0.3.0.
- [Commits](https://github.com/iancoleman/orderedmap/commits/v0.3.0 )
---
updated-dependencies:
- dependency-name: github.com/iancoleman/orderedmap
dependency-version: 0.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:06:28 -04:00
dependabot[bot]
ea7dc8f468
chore(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.3 ( #4259 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.16.2 to 5.16.3.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.16.2...v5.16.3 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.16.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-06 10:06:17 -04:00
anchore-actions-token-generator[bot] and spiffcs
ff6a8b1802
chore(deps): update tools to latest versions ( #4248 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-10-03 14:53:27 -04:00
Alex Goodman
a77d24e379
Improve struct and field comments and incorporate into json schema ( #4252 )
...
* improve struct and field comments and incorporate into json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-10-03 17:01:56 +00:00
dependabot[bot]
b96d3d20af
chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 ( #4253 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.5 to 3.30.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/3599b3baa15b485a2e49ef411a7a4bb2452e7f93...64d10c13136e1c5bce3e5fbde8d4906eeaafc885 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-03 12:07:20 -04:00
dependabot[bot]
5461a92337
chore(deps): bump github.com/hashicorp/go-getter from 1.8.1 to 1.8.2 ( #4254 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.1 to 1.8.2.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.1...v1.8.2 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-10-03 12:07:13 -04:00
dependabot[bot]
b9604cbf30
chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.2 to 0.9.3 ( #4251 )
2025-10-02 13:24:25 +00:00
Keith Zantow
9217f2099f
chore: update ffmpeg tests ( #4249 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-10-01 13:11:36 +00:00
dependabot[bot]
605a275dd3
chore(deps): bump github/codeql-action from 3.30.4 to 3.30.5 ( #4246 )
2025-09-30 17:06:10 -04:00
Alan Pope
e1483e0285
Add support for identifying ffmpeg/libav libraries ( #4227 )
...
* Add support for identifying ffmpeg/libav libraries
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* Undo my snippet-based confusion
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* Put test fixture config back
Signed-off-by: Alan Pope <alan.pope@anchore.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2025-09-26 10:43:47 -04:00
Alan Pope and Christopher Phillips
0a36dabf23
feat(cataloger): add snap package cataloger for metadata extraction ( #4151 )
...
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-09-26 10:42:29 -04:00
dependabot[bot]
64b71ec04c
chore(deps): bump github.com/quasilyte/go-ruleguard/dsl ( #4245 )
...
Bumps [github.com/quasilyte/go-ruleguard/dsl](https://github.com/quasilyte/go-ruleguard ) from 0.3.22 to 0.3.23.
- [Release notes](https://github.com/quasilyte/go-ruleguard/releases )
- [Commits](https://github.com/quasilyte/go-ruleguard/compare/dsl/v0.3.22...dsl/v0.3.23 )
---
updated-dependencies:
- dependency-name: github.com/quasilyte/go-ruleguard/dsl
dependency-version: 0.3.23
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-26 10:27:13 -04:00
anchore-actions-token-generator[bot] and spiffcs
8629080e80
chore(deps): update tools to latest versions ( #4238 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-25 12:08:37 -04:00
dependabot[bot]
f0998de717
chore(deps): bump github/codeql-action from 3.30.3 to 3.30.4 ( #4239 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.3 to 3.30.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/192325c86100d080feab897ff886c34abd4c83a3...303c0aef88fc2fe5ff6d63d3b1596bfd83dfa1f9 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-25 12:06:49 -04:00
dependabot[bot]
261ab7c1fd
chore(deps): bump actions/cache from 4.2.4 to 4.3.0 ( #4240 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.4 to 4.3.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0400d5f644dc74513175e3cd8d07132dd4860809...0057852bfaa89a56745cba8c7296529d2fc39830 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-25 12:02:41 -04:00
dependabot[bot]
8232f5bd1b
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #4241 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.4 to 4.3.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0400d5f644dc74513175e3cd8d07132dd4860809...0057852bfaa89a56745cba8c7296529d2fc39830 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 4.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-25 12:02:30 -04:00
Saleem Abdulrasool
21d50d7c31
feat: add ARM64 Windows build target ( #4237 )
...
Signed-off-by: Saleem Abdulrasool <compnerd@compnerd.org >
2025-09-24 15:29:03 -04:00
anchore-actions-token-generator[bot] and spiffcs
c28b90717b
chore(deps): update tools to latest versions ( #4236 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-24 15:07:58 -04:00
Keith Zantow
323fd3e34c
docs: add GitHub actions to supported ecosystems ( #4235 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-09-23 10:08:41 -04:00
anchore-actions-token-generator[bot] and spiffcs
af4d19f81d
chore(deps): update tools to latest versions ( #4230 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-22 11:08:30 -04:00
dependabot[bot]
d820c3436b
chore(deps): bump github.com/charmbracelet/bubbletea ( #4228 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.3.9 to 1.3.10.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.3.9...v1.3.10 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-version: 1.3.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-18 15:15:52 -04:00
dependabot[bot]
409642c8f0
chore(deps): bump github.com/hashicorp/go-getter from 1.8.0 to 1.8.1 ( #4229 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.8.0...v1.8.1 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-18 15:15:43 -04:00
dependabot[bot]
3abbd940e3
chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 ( #4222 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.5 to 0.20.6.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/da167eac915b4e86f08b264dbdbc867b61be6f0c...f8bdd1d8ac5e901a77a92f111440fdb1b593736b )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-18 10:58:53 -04:00
anchore-actions-token-generator[bot] and spiffcs
22f6f8f880
chore(deps): update tools to latest versions ( #4221 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-18 07:16:16 -04:00
dependabot[bot]
6005fb3c20
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.14 to 0.5.15 ( #4225 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.14 to 0.5.15.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.14...v0.5.15 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-17 10:07:37 -04:00
anchore-actions-token-generator[bot] and spiffcs
b87b919149
chore(deps): update anchore dependencies ( #4220 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-15 20:22:09 +00:00
anchore-actions-token-generator[bot] and spiffcs
a51994d102
chore(deps): update tools to latest versions ( #4215 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-15 14:38:28 -04:00
dependabot[bot]
333b951be3
chore(deps): bump zizmorcore/zizmor-action from 0.1.2 to 0.2.0 ( #4216 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.1.2 to 0.2.0.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/5ca5fc7a4779c5263a3ffa0e1f693009994446d1...e673c3917a1aef3c65c972347ed84ccd013ecda4 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.2.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 14:30:16 -04:00
dependabot[bot]
90c733d24d
chore(deps): bump 8398a7/action-slack from 3.18.0 to 3.19.0 ( #4217 )
...
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.18.0 to 3.19.0.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/1750b5085f3ec60384090fb7c52965ef822e869e...77eaa4f1c608a7d68b38af4e3f739dcd8cba273e )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-version: 3.19.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 14:30:03 -04:00
dependabot[bot]
dacc2f61f9
chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 ( #4218 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.9.2 to 3.10.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/d58896d6a1865668819e1d91763c7751a165e159...d7543c93d881b35a8faa02e8e3605f69b7a1ce62 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 3.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 14:29:53 -04:00
dependabot[bot]
06b01aaa40
chore(deps): bump modernc.org/sqlite from 1.38.2 to 1.39.0 ( #4219 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.38.2 to 1.39.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.2...v1.39.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.39.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-15 14:29:45 -04:00
dependabot[bot]
e1762a2dda
chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.8 to 1.3.9 ( #4214 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.3.8 to 1.3.9.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.3.8...v1.3.9 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-version: 1.3.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-12 10:21:20 -04:00
Rafał Maj
c5cbc89cb1
fix: include RpmDBEntry modularityLabel in CycloneDX ( #4212 )
...
Signed-off-by: sfc-gh-rmaj <rafal.maj@snowflake.com >
2025-09-11 17:22:12 -04:00
Joel Rudsberg
7bc15e3d82
Native Image SBOM: Add Support for Locations Data ( #4186 )
...
Signed-off-by: Joel Rudsberg <joel.rudsberg@oracle.com >
2025-09-11 14:16:09 -04:00
dependabot[bot]
c6cd66357a
chore(deps): bump github.com/spf13/afero from 1.14.0 to 1.15.0 ( #4202 )
...
Bumps [github.com/spf13/afero](https://github.com/spf13/afero ) from 1.14.0 to 1.15.0.
- [Release notes](https://github.com/spf13/afero/releases )
- [Commits](https://github.com/spf13/afero/compare/v1.14.0...v1.15.0 )
---
updated-dependencies:
- dependency-name: github.com/spf13/afero
dependency-version: 1.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-11 13:27:42 -04:00
dependabot[bot]
04e989d761
chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.6 to 1.3.8 ( #4203 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.3.6 to 1.3.8.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.3.6...v1.3.8 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-version: 1.3.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-11 13:27:33 -04:00
dependabot[bot]
b6f7532b0f
chore(deps): bump github.com/vbatts/go-mtree from 0.5.4 to 0.6.0 ( #4204 )
...
Bumps [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree ) from 0.5.4 to 0.6.0.
- [Release notes](https://github.com/vbatts/go-mtree/releases )
- [Changelog](https://github.com/vbatts/go-mtree/blob/main/releases.md )
- [Commits](https://github.com/vbatts/go-mtree/compare/v0.5.4...v0.6.0 )
---
updated-dependencies:
- dependency-name: github.com/vbatts/go-mtree
dependency-version: 0.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-11 13:27:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
2531bfd8cb
chore(deps): update tools to latest versions ( #4200 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-11 12:55:39 -04:00
dependabot[bot]
1fcdb67698
chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 ( #4210 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.1 to 3.30.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f1f6e5f6af878fb37288ce1c627459e94dbf7d01...192325c86100d080feab897ff886c34abd4c83a3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-11 12:50:41 -04:00
dependabot[bot]
f986327257
chore(deps): bump golang.org/x/tools from 0.36.0 to 0.37.0 ( #4211 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.36.0 to 0.37.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.36.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.37.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-11 12:50:33 -04:00
anchore-actions-token-generator[bot] and spiffcs
67e0f7e3f9
chore(deps): update tools to latest versions ( #4194 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-08 09:55:06 -04:00
dependabot[bot]
169220ba81
chore(deps): bump github.com/hashicorp/go-getter from 1.7.10 to 1.8.0 ( #4197 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.7.10 to 1.8.0.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml )
- [Commits](https://github.com/hashicorp/go-getter/commits/v1.8.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.8.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 09:50:54 -04:00
dependabot[bot]
1df4779b48
chore(deps): bump golang.org/x/mod from 0.27.0 to 0.28.0 ( #4198 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.27.0 to 0.28.0.
- [Commits](https://github.com/golang/mod/compare/v0.27.0...v0.28.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.28.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 09:50:09 -04:00
dependabot[bot]
3a7f1f27a6
chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 ( #4182 )
...
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra ) from 1.9.1 to 1.10.1.
- [Release notes](https://github.com/spf13/cobra/releases )
- [Commits](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.1 )
---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
dependency-version: 1.10.1
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 02:36:59 -04:00
dependabot[bot]
8e78fd57b8
chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 ( #4188 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.5.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/d35c59abb061a4a6fb18e82ac0862c26744d6ab5...44694675825211faa026b3c33043df3e48a5fa00 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 02:35:22 -04:00
dependabot[bot]
b503690889
chore(deps): bump actions/setup-go in /.github/actions/bootstrap ( #4189 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.5.0 to 6.0.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/d35c59abb061a4a6fb18e82ac0862c26744d6ab5...44694675825211faa026b3c33043df3e48a5fa00 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 6.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 02:35:08 -04:00
dependabot[bot]
cc07df0347
chore(deps): bump github.com/hashicorp/go-getter from 1.7.9 to 1.7.10 ( #4190 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.7.9 to 1.7.10.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.7.9...v1.7.10 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.7.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 02:05:46 -04:00
dependabot[bot]
2b8f4bc028
chore(deps): bump github/codeql-action from 3.30.0 to 3.30.1 ( #4191 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.30.0 to 3.30.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d...f1f6e5f6af878fb37288ce1c627459e94dbf7d01 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 02:05:35 -04:00
dependabot[bot]
98c97e24a2
chore(deps): bump actions/github-script from 7 to 8 ( #4192 )
...
Bumps [actions/github-script](https://github.com/actions/github-script ) from 7 to 8.
- [Release notes](https://github.com/actions/github-script/releases )
- [Commits](https://github.com/actions/github-script/compare/v7...v8 )
---
updated-dependencies:
- dependency-name: actions/github-script
dependency-version: '8'
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-08 02:05:27 -04:00
dependabot[bot]
6f4da8c797
chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 ( #4173 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.11.0 to 1.11.1.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.11.0...v1.11.1 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.11.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-03 12:22:38 -04:00
anchore-actions-token-generator[bot] and spiffcs
647196055d
chore(deps): update tools to latest versions ( #4185 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-09-03 12:22:11 -04:00
dependabot[bot]
39441f1999
chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 ( #4178 )
...
Bumps [github.com/ulikunitz/xz](https://github.com/ulikunitz/xz ) from 0.5.12 to 0.5.14.
- [Commits](https://github.com/ulikunitz/xz/compare/v0.5.12...v0.5.14 )
---
updated-dependencies:
- dependency-name: github.com/ulikunitz/xz
dependency-version: 0.5.14
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-02 00:26:54 -04:00
dependabot[bot]
507987c193
chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.0 ( #4180 )
...
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra ) from 1.9.1 to 1.10.0.
- [Release notes](https://github.com/spf13/cobra/releases )
- [Commits](https://github.com/spf13/cobra/compare/v1.9.1...v1.10.0 )
---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
dependency-version: 1.10.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-02 00:26:42 -04:00
dependabot[bot]
7e4bf7f8c2
chore(deps): bump github/codeql-action from 3.29.11 to 3.30.0 ( #4181 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.11 to 3.30.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/3c3833e0f8c1c83d449a7478aa59c036a9165498...2d92b76c45b91eb80fc44c74ce3fce0ee94e8f9d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.30.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-09-02 00:26:33 -04:00
dependabot[bot]
bc18e3ab8c
chore(deps): bump github.com/anchore/stereoscope ( #4174 )
...
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.1.9-0.20250826202322-ef061ea78385 to 0.1.9.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/stereoscope/commits/v0.1.9 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-version: 0.1.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-28 13:43:20 -04:00
dependabot[bot]
c4eb071324
chore(deps): bump github.com/gookit/color from 1.5.4 to 1.6.0 ( #4176 )
...
Bumps [github.com/gookit/color](https://github.com/gookit/color ) from 1.5.4 to 1.6.0.
- [Release notes](https://github.com/gookit/color/releases )
- [Commits](https://github.com/gookit/color/compare/v1.5.4...v1.6.0 )
---
updated-dependencies:
- dependency-name: github.com/gookit/color
dependency-version: 1.6.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-28 13:42:38 -04:00
dependabot[bot]
cbcf8bd542
chore(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 ( #4172 )
...
Bumps [golang.org/x/tools](https://github.com/golang/tools ) from 0.35.0 to 0.36.0.
- [Release notes](https://github.com/golang/tools/releases )
- [Commits](https://github.com/golang/tools/compare/v0.35.0...v0.36.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/tools
dependency-version: 0.36.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-27 13:09:28 -04:00
anchore-actions-token-generator[bot] and spiffcs
2d8e337d34
chore(deps): update anchore dependencies ( #4169 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-08-26 17:04:20 -04:00
Christopher Angelo Phillips and Alex Goodman
13ffeeb3d0
feat: combine go module file and go source discovery into single cataloger ( #4127 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-08-26 19:35:44 +00:00
n-bes
170c4c41f4
use go.yaml.in/yaml ( #4157 )
...
Signed-off-by: Nikita Besperstov <n.bes@pm.me >
2025-08-26 11:24:23 -04:00
dependabot[bot]
7dc7c01c5c
chore(deps): bump github.com/diskfs/go-diskfs ( #4159 )
...
Bumps [github.com/diskfs/go-diskfs](https://github.com/diskfs/go-diskfs ) from 1.6.1-0.20250601133945-2af1c7ece24c to 1.7.0.
- [Commits](https://github.com/diskfs/go-diskfs/commits/v1.7.0 )
---
updated-dependencies:
- dependency-name: github.com/diskfs/go-diskfs
dependency-version: 1.7.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-26 09:00:02 -04:00
dependabot[bot]
9f07fa4a68
chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 ( #4160 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.10.0 to 1.11.0.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.10.0...v1.11.0 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-version: 1.11.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-26 08:59:49 -04:00
anchore-actions-token-generator[bot] and spiffcs
37b2c0391b
chore(deps): update tools to latest versions ( #4154 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-08-25 09:57:45 -04:00
Alan Pope
ada74a8121
Feature: Add ffmpeg binary cataloger ( #3994 )
...
* Add ffmpeg binary cataloger
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* add linux-amd64 snippet and test
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* Widen scope of regex to two digit version numbers
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* Add full test fixtures for ffmpeg
Signed-off-by: Alan Pope <alan.pope@anchore.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2025-08-25 07:50:04 -04:00
Keith Zantow
ca21ccf21d
chore: redhat cataloger error when sqlite not regsitered ( #4150 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-08-21 14:55:47 +00:00
dependabot[bot]
26792fc12d
chore(deps): bump github/codeql-action from 3.29.10 to 3.29.11 ( #4149 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.10 to 3.29.11.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/96f518a34f7a870018057716cc4d7a5c014bd61c...3c3833e0f8c1c83d449a7478aa59c036a9165498 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.11
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-21 10:43:25 -04:00
Simeon Stoykov and Christopher Phillips
a433045d51
feat: basic Conda ecosystem support ( #4002 )
...
----------------------------------------------------------------
Signed-off-by: Simeon Stoykov <simeon.stoykov@quantco.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-19 22:37:27 -04:00
dependabot[bot]
8e51e8d995
chore(deps): bump github/codeql-action from 3.29.9 to 3.29.10 ( #4145 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.9 to 3.29.10.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/df559355d593797519d70b90fc8edd5db049e7a2...96f518a34f7a870018057716cc4d7a5c014bd61c )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-18 15:29:36 -04:00
anchore-actions-token-generator[bot] and wagoodman
ba2eb5701f
chore(deps): update CPE dictionary index ( #4143 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-08-18 10:14:39 -04:00
dependabot[bot]
c4292ad79b
chore(deps): bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 ( #4144 )
...
Bumps [github.com/hashicorp/go-getter](https://github.com/hashicorp/go-getter ) from 1.7.8 to 1.7.9.
- [Release notes](https://github.com/hashicorp/go-getter/releases )
- [Changelog](https://github.com/hashicorp/go-getter/blob/main/.goreleaser.yml )
- [Commits](https://github.com/hashicorp/go-getter/compare/v1.7.8...v1.7.9 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/go-getter
dependency-version: 1.7.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-18 11:42:13 +01:00
dependabot[bot]
0e669faecd
chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 ( #4141 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.4 to 0.20.5.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/7b36ad622f042cab6f59a75c2ac24ccb256e9b45...da167eac915b4e86f08b264dbdbc867b61be6f0c )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-15 10:22:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
10ea022fe7
chore(deps): update tools to latest versions ( #4139 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-08-14 13:34:24 -04:00
Alan Pope and Christopher Phillips
87e1d8cb87
feat: add support for authors, maintainers, and contributors in package.json. ( #4003 )
...
Fixes #2250
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-13 17:55:15 -04:00
dependabot[bot]
ab9db0024e
chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to 0.1.2 ( #4135 )
...
Bumps [zizmorcore/zizmor-action](https://github.com/zizmorcore/zizmor-action ) from 0.1.1 to 0.1.2.
- [Release notes](https://github.com/zizmorcore/zizmor-action/releases )
- [Commits](https://github.com/zizmorcore/zizmor-action/compare/f52a838cfabf134edcbaa7c8b3677dde20045018...5ca5fc7a4779c5263a3ffa0e1f693009994446d1 )
---
updated-dependencies:
- dependency-name: zizmorcore/zizmor-action
dependency-version: 0.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-13 10:07:03 -04:00
Christopher Angelo Phillips
6b48bd4b5e
feat: add package supplier flag ( #4131 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-12 14:49:41 -04:00
Christopher Angelo Phillips
89470ecdd3
feat: update syft license construction to be able to look up by URL ( #4132 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-08-12 14:30:32 -04:00
dependabot[bot]
104df88143
chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 ( #4134 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.8 to 3.29.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/76621b61decf072c1cee8dd1ce2d2a82d33c17ed...df559355d593797519d70b90fc8edd5db049e7a2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.9
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-12 18:23:39 +00:00
honigbot
80e61175ad
fix: support multiple letters in openssl patch version ( #4106 )
...
Signed-off-by: honigbot <thesoftbear@gmail.com >
2025-08-12 10:30:41 -04:00
Keith Zantow
9f956dca8f
fix: closed reader during java binary detection ( #4129 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-08-12 08:58:28 -04:00
dependabot[bot]
6452a19009
chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 ( #4130 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.2 to 5.0.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/11bd71901bbe5b1630ceea73d27597364c9af683...08c6903cd8c0fde910a37f88322edcfb5dd907a8 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-version: 5.0.0
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-11 16:54:59 -04:00
Emmanuel Ferdman
21496e7a81
chore: update GoReleaser configurations ( #4128 )
...
Signed-off-by: Emmanuel Ferdman <emmanuelferdman@gmail.com >
2025-08-11 09:38:33 -04:00
anchore-actions-token-generator[bot] and wagoodman
3e5befc267
chore(deps): update CPE dictionary index ( #4126 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-08-10 23:48:24 -04:00
dependabot[bot]
49736e7c4a
chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 ( #4122 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.42.0 to 0.43.0.
- [Commits](https://github.com/golang/net/compare/v0.42.0...v0.43.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.43.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-08 17:51:06 +00:00
dependabot[bot]
7a9e1e06da
chore(deps): bump golang.org/x/mod from 0.26.0 to 0.27.0 ( #4123 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.26.0 to 0.27.0.
- [Commits](https://github.com/golang/mod/compare/v0.26.0...v0.27.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.27.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-08 13:35:44 -04:00
dependabot[bot]
7b92913a00
chore(deps): bump github/codeql-action from 3.29.7 to 3.29.8 ( #4124 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.7 to 3.29.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/51f77329afa6477de8c49fc9c7046c15b9a4e79d...76621b61decf072c1cee8dd1ce2d2a82d33c17ed )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-08 13:35:35 -04:00
Will Murphy and Keith Zantow
594b309cdf
feat: add binary classifier for hashicorp vault ( #4121 )
...
* add binary classifier for hashicorp vault
The Go Binary Cataloger isn't able to parse the version out of the
binary shipped in the DockerHub images of hashicorp/vault because the
version of the main module isn't set in the binary. Therefore, add a
binary classifier cataloger for this binary.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: add test fixtures, update vault
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: set binary classifier package type based on PURL
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: use github.com/hashicorp/vault as package name
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update tests
Signed-off-by: Keith Zantow <kzantow@gmail.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-08-08 13:26:15 -04:00
Keith Zantow
8c6a2bcbb6
fix: nondeterministic Java archive cataloging and improve groupID ( #4118 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-08-07 10:55:10 -04:00
dependabot[bot]
d4d311155f
chore(deps): bump docker/login-action from 3.4.0 to 3.5.0 ( #4115 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.4.0 to 3.5.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/74a5d142397b4f367a81961eba4e8cd7edddf772...184bdaa0721073962dff0199f1fb9940f07167d1 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-version: 3.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-07 10:48:53 -04:00
dependabot[bot]
118f564cf3
chore(deps): bump actions/cache from 4.2.3 to 4.2.4 ( #4119 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.3 to 4.2.4.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/5a3ec84eff668545956fd18022155c47e93e2684...0400d5f644dc74513175e3cd8d07132dd4860809 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 4.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-07 10:47:40 -04:00
dependabot[bot]
b59c902996
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #4120 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.3 to 4.2.4.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/5a3ec84eff668545956fd18022155c47e93e2684...0400d5f644dc74513175e3cd8d07132dd4860809 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-version: 4.2.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-08-07 10:47:25 -04:00
anchore-actions-token-generator[bot] and spiffcs
fad9340051
chore(deps): update tools to latest versions ( #4111 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-08-04 11:20:26 -04:00
anchore-actions-token-generator[bot] and wagoodman
3820cba0cd
chore(deps): update CPE dictionary index ( #4112 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-08-04 11:20:09 -04:00
anchore-actions-token-generator[bot] and spiffcs
5af72b6663
chore(deps): update tools to latest versions ( #4108 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-31 12:04:54 -04:00
dependabot[bot]
801b21bb37
chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 ( #4096 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.4 to 3.29.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4e828ff8d448a8a6e532957b1811f387a63867e8...51f77329afa6477de8c49fc9c7046c15b9a4e79d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-30 14:29:07 -04:00
anchore-actions-token-generator[bot] and wagoodman
386ef842d9
chore(deps): update anchore dependencies ( #4104 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-30 17:41:35 +00:00
bd79463e77
chore(deps): update anchore dependencies ( #4098 )
...
* chore(deps): update anchore dependencies
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* address reader close operations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-30 17:23:07 +00:00
Alex Goodman
8a7302c5cf
migrate to get.anchore.io ( #4095 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-30 10:54:22 -04:00
dependabot[bot]
28ba092375
chore(deps): bump github.com/anchore/stereoscope ( #4091 )
...
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.1.7-0.20250716200927-94c6f92877d4 to 0.1.7.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/stereoscope/commits/v0.1.7 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-version: 0.1.7
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-30 09:12:55 -04:00
dependabot[bot]
fa68af468d
chore(deps): bump github.com/docker/docker ( #4092 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 28.2.2+incompatible to 28.3.3+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v28.2.2...v28.3.3 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-version: 28.3.3+incompatible
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-29 16:29:03 -04:00
dependabot[bot]
700a777356
chore(deps): bump modernc.org/sqlite from 1.38.1 to 1.38.2 ( #4088 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.38.1 to 1.38.2.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.38.1...v1.38.2 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.38.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-29 10:29:57 -04:00
dependabot[bot]
71aa59a210
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.13 to 0.5.14 ( #4089 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.13 to 0.5.14.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.13...v0.5.14 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.14
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-29 10:29:45 -04:00
dependabot[bot]
d0d9c6a8e5
chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.9.0 to 4.9.1 ( #4087 )
2025-07-28 13:39:36 -04:00
dependabot[bot]
702b4358e9
chore(deps): bump github.com/olekukonko/tablewriter from 1.0.8 to 1.0.9 ( #4086 )
2025-07-28 13:39:22 -04:00
dependabot[bot]
4a69c00c23
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.7 to 6.6.8 ( #4085 )
2025-07-28 13:39:06 -04:00
dependabot[bot]
998742f38e
chore(deps): bump modernc.org/sqlite from 1.38.0 to 1.38.1 ( #4084 )
2025-07-28 17:38:42 +00:00
anchore-actions-token-generator[bot] and spiffcs
bb8ea024e1
chore(deps): update tools to latest versions ( #4082 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-28 12:01:09 -04:00
anchore-actions-token-generator[bot] and wagoodman
3f28480b3d
chore(deps): update CPE dictionary index ( #4083 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-28 10:51:16 -04:00
anchore-actions-token-generator[bot] and spiffcs
5465bf4227
chore(deps): update tools to latest versions ( #4079 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-24 15:18:12 -04:00
dependabot[bot]
8b2c4a134e
chore(deps): bump github/codeql-action from 3.29.3 to 3.29.4 ( #4080 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.3 to 3.29.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/d6bbdef45e766d081b84a2def353b0055f728d3e...4e828ff8d448a8a6e532957b1811f387a63867e8 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-24 15:17:49 -04:00
anchore-actions-token-generator[bot]
d7046099e9
chore(deps): update tools to latest versions ( #4076 )
2025-07-23 21:03:20 -04:00
Alex Goodman
f0a990b85f
chore: add source completion tester ( #4077 )
...
* add source completion tester
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing t.Helper calls
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-23 13:49:47 +00:00
Keith Zantow
48bf81cf7f
fix: align binary java detection with jvm cataloger + support IBM ( #4046 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-07-22 12:06:32 -04:00
anchore-actions-token-generator[bot] and spiffcs
78c7cd2cc2
chore(deps): update tools to latest versions ( #4072 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-22 09:49:58 -04:00
dependabot[bot]
a192787d44
chore(deps): bump github/codeql-action from 3.29.2 to 3.29.3 ( #4074 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.2 to 3.29.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/181d5eefc20863364f96762470ba6f862bdef56b...d6bbdef45e766d081b84a2def353b0055f728d3e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-22 09:49:43 -04:00
dependabot[bot]
d5a562c368
chore(deps): bump anchore/sbom-action from 0.20.2 to 0.20.4 ( #4073 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.2 to 0.20.4.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/cee1b8e05ae5b2593a75e197229729eabaa9f8ec...7b36ad622f042cab6f59a75c2ac24ccb256e9b45 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-22 09:49:40 -04:00
Christopher Angelo Phillips
6f36b586ba
chore: update release workflow to persist credentials for git tag step ( #4069 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-07-21 19:23:14 +00:00
anchore-actions-token-generator[bot] and spiffcs
a620baff90
chore(deps): update anchore dependencies ( #4068 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-21 14:12:47 -04:00
dependabot[bot]
5b14d160cf
chore(deps): bump pygments ( #4064 )
...
Bumps [pygments](https://github.com/pygments/pygments ) from 1.6 to 2.15.0.
- [Release notes](https://github.com/pygments/pygments/releases )
- [Changelog](https://github.com/pygments/pygments/blob/master/CHANGES )
- [Commits](https://github.com/pygments/pygments/compare/1.6...2.15.0 )
---
updated-dependencies:
- dependency-name: pygments
dependency-version: 2.15.0
dependency-type: direct:production
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-21 13:07:27 -04:00
anchore-actions-token-generator[bot] and spiffcs
0a9567e88c
chore(deps): update tools to latest versions ( #4065 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-21 13:07:18 -04:00
dependabot[bot]
af787d685c
chore(deps): bump sigstore/cosign-installer from 3.9.1 to 3.9.2 ( #4066 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.9.1 to 3.9.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/398d4b0eeef1380460a10c8013a76f728fb906ac...d58896d6a1865668819e1d91763c7751a165e159 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 3.9.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-21 13:06:59 -04:00
anchore-actions-token-generator[bot] and wagoodman
64b62c086c
chore(deps): update CPE dictionary index ( #4067 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-21 07:57:39 -04:00
c491dab35b
feat: add parsing for uv.lock ( #3763 )
...
* feat: add parsing for uv.lock (#3268 )
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Still no tests, but much more complete
Next up: start writing tests! :)
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: finish out functionality and write tests
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Merge the .NET deps.json and PE binary catalogers (#3563 )
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* better .NET cpe generation (#3764 )
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* Better represent .NET runtime packages (#3768 )
* clean up .NET runtime packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add runtime relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove runtime references from binary package name
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): update CPE dictionary index (#3769 )
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771 )
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767 )
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766 )
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: move/modify code for lint issues
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: make sure private structs are not exported
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: update readme to include uv
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
* chore: use uv as the package manager name
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
---------
Signed-off-by: Joshua Kugler <tek30584@adobe.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: anchore-actions-token-generator[bot] <102182147+anchore-actions-token-generator[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-17 18:26:56 +00:00
dependabot[bot]
0e5db45aad
chore(deps): bump marocchino/sticky-pull-request-comment ( #4063 )
...
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) from 2.9.3 to 2.9.4.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/d2ad0de260ae8b0235ce059e63f2949ba9e05943...773744901bac0e8cbb5a0dc842800d45e9b2b405 )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-version: 2.9.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-17 09:27:02 -04:00
Will Murphy
9cda2de2ad
chore: lint gh actions with zizmor ( #4062 )
...
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-07-16 17:12:38 -04:00
anchore-actions-token-generator[bot] and spiffcs
37c182d5be
chore(deps): update tools to latest versions ( #4060 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-15 11:32:27 -04:00
dependabot[bot]
cef2a38117
chore(deps): bump github.com/go-viper/mapstructure/v2 ( #4061 )
...
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure ) from 2.3.0 to 2.4.0.
- [Release notes](https://github.com/go-viper/mapstructure/releases )
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md )
- [Commits](https://github.com/go-viper/mapstructure/compare/v2.3.0...v2.4.0 )
---
updated-dependencies:
- dependency-name: github.com/go-viper/mapstructure/v2
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-15 11:32:11 -04:00
dependabot[bot]
75eda3976d
chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.8.1 to 4.9.0 ( #4059 )
...
Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar ) from 4.8.1 to 4.9.0.
- [Release notes](https://github.com/bmatcuk/doublestar/releases )
- [Commits](https://github.com/bmatcuk/doublestar/compare/v4.8.1...v4.9.0 )
---
updated-dependencies:
- dependency-name: github.com/bmatcuk/doublestar/v4
dependency-version: 4.9.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-14 17:14:11 +00:00
dependabot[bot]
2b1710b009
chore(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 ( #4054 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.25.0 to 0.26.0.
- [Commits](https://github.com/golang/mod/compare/v0.25.0...v0.26.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.26.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-14 14:43:04 +00:00
mikey strauss
9caad26ee5
Pkg Metadata type unmarshal bug ( #4043 )
...
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
2025-07-14 10:28:38 -04:00
anchore-actions-token-generator[bot] and spiffcs
d88ad07855
chore(deps): update tools to latest versions ( #4053 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-07-14 10:27:40 -04:00
dependabot[bot]
13986b7cea
chore(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 ( #4056 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.41.0 to 0.42.0.
- [Commits](https://github.com/golang/net/compare/v0.41.0...v0.42.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.42.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-14 10:27:10 -04:00
anchore-actions-token-generator[bot] and wagoodman
75db6527bc
chore(deps): update CPE dictionary index ( #4058 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-14 10:27:01 -04:00
dependabot[bot]
1c0ed133a3
chore(deps): bump github.com/olekukonko/tablewriter from 1.0.7 to 1.0.8 ( #4049 )
...
Bumps [github.com/olekukonko/tablewriter](https://github.com/olekukonko/tablewriter ) from 1.0.7 to 1.0.8.
- [Commits](https://github.com/olekukonko/tablewriter/compare/v1.0.7...v1.0.8 )
---
updated-dependencies:
- dependency-name: github.com/olekukonko/tablewriter
dependency-version: 1.0.8
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-08 15:27:02 -04:00
anchore-actions-token-generator[bot] and wagoodman
9928386d38
chore(deps): update CPE dictionary index ( #4050 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-08 15:26:50 -04:00
dependabot[bot]
9dd06981b4
chore(deps): bump github.com/hashicorp/hcl/v2 from 2.23.0 to 2.24.0 ( #4051 )
...
Bumps [github.com/hashicorp/hcl/v2](https://github.com/hashicorp/hcl ) from 2.23.0 to 2.24.0.
- [Release notes](https://github.com/hashicorp/hcl/releases )
- [Changelog](https://github.com/hashicorp/hcl/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcl/compare/v2.23.0...v2.24.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcl/v2
dependency-version: 2.24.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-08 15:26:34 -04:00
dependabot[bot]
f88be457ef
chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.5 to 1.3.6 ( #4052 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.3.5 to 1.3.6.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.3.5...v1.3.6 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-version: 1.3.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-08 15:26:26 -04:00
Keith Zantow and Alex Goodman
02703d5c80
feat: RHEL EUS detection ( #4023 )
...
* feat: rhel eus detection
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update tests
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update more tests
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* rename feature detection functions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-07 14:11:20 +00:00
dependabot[bot]
9cbd52bdd7
chore(deps): bump anchore/sbom-action from 0.20.1 to 0.20.2 ( #4048 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.1 to 0.20.2.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/9246b90769f852b3a8921f330c59e0b3f439d6e9...cee1b8e05ae5b2593a75e197229729eabaa9f8ec )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-07-03 15:00:51 -04:00
anchore-actions-token-generator[bot] and wagoodman
e8b62ab9ac
chore(deps): update anchore dependencies ( #4047 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-02 16:09:46 +00:00
anchore-actions-token-generator[bot] and wagoodman
2af1bca83f
chore(deps): update anchore dependencies ( #4045 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-07-02 11:50:29 -04:00
Carlos Tadeu Panato Junior and Alex Goodman
2111d4d0e4
chore: upgrade tablewriter dependency to use new API ( #3990 )
...
* upgrade tablewriter
Signed-off-by: Carlos Panato <ctadeu@gmail.com >
* remove header line whitespace
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix static analysis
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Carlos Panato <ctadeu@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-01 16:16:16 -04:00
dependabot[bot] and Alex Goodman
179cc70a36
chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0 ( #4040 )
...
* chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0
Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver ) from 3.3.1 to 3.4.0.
- [Release notes](https://github.com/Masterminds/semver/releases )
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Masterminds/semver/compare/v3.3.1...v3.4.0 )
---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
dependency-version: 3.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* update error message expectations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-07-01 19:21:02 +00:00
Christopher Angelo Phillips
1e3d2a2927
chore: update tests to read from latest test-fixture-cache and fix cache publish ( #4042 )
...
* feat: update integration test with correct package for httpd
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: update integration and cli tests with new upstream expectations
- php interpreter 8.3.21 => 8.3.22
- runCycloneDXInDocker update for local arm64 qemu emulation CycloneDX
- getSyftBinaryLocationByOS update to detect arm64 v8.0 artifact path
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: add snalshot to test command for fixture builds
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: update cdx in docker for all GOOS
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-07-01 14:11:36 +00:00
dependabot[bot]
421afac532
chore(deps): bump github.com/mholt/archives from 0.1.2 to 0.1.3 ( #4032 )
...
Bumps [github.com/mholt/archives](https://github.com/mholt/archives ) from 0.1.2 to 0.1.3.
- [Release notes](https://github.com/mholt/archives/releases )
- [Commits](https://github.com/mholt/archives/compare/v0.1.2...v0.1.3 )
---
updated-dependencies:
- dependency-name: github.com/mholt/archives
dependency-version: 0.1.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-30 17:58:41 -04:00
dependabot[bot]
b0b10acb40
chore(deps): bump marocchino/sticky-pull-request-comment ( #4019 )
...
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) from 2.9.2 to 2.9.3.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/67d0dec7b07ed060a405f9b2a64b8ab319fdd7db...d2ad0de260ae8b0235ce059e63f2949ba9e05943 )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-version: 2.9.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-30 17:58:32 -04:00
dependabot[bot]
b90028bd1f
chore(deps): bump sigstore/cosign-installer from 3.9.0 to 3.9.1 ( #4022 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.9.0 to 3.9.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.9.0...v3.9.1 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 3.9.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-30 17:58:23 -04:00
anchore-actions-token-generator[bot] and spiffcs
b5a1b309ca
chore(deps): update tools to latest versions ( #4035 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-06-30 17:17:49 -04:00
anchore-actions-token-generator[bot] and wagoodman
841f963e70
chore(deps): update CPE dictionary index ( #4037 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-06-30 17:17:34 -04:00
dependabot[bot]
ba59f57bfe
chore(deps): bump github/codeql-action from 3.29.0 to 3.29.2 ( #4039 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.29.0 to 3.29.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ce28f5bb42b7a9f2c824e633a3f6ee835bab6858...181d5eefc20863364f96762470ba6f862bdef56b )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-30 17:17:20 -04:00
Alex Goodman
2bda086423
Add ability to scan snaps (as a source) ( #3929 )
2025-06-25 16:53:35 -04:00
anchore-actions-token-generator[bot] and wagoodman
4eb8ba4575
chore(deps): update CPE dictionary index ( #4021 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-06-23 11:30:19 -04:00
anchore-actions-token-generator[bot] and spiffcs
49115355d4
chore(deps): update tools to latest versions ( #4016 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-06-19 14:02:03 -04:00
anchore-actions-token-generator[bot] and spiffcs
d9eb1d7c1b
chore(deps): update tools to latest versions ( #4012 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-06-17 11:35:22 -04:00
dependabot[bot]
32a30f76c6
chore(deps): bump github.com/go-viper/mapstructure/v2 ( #4014 )
...
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure ) from 2.2.1 to 2.3.0.
- [Release notes](https://github.com/go-viper/mapstructure/releases )
- [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md )
- [Commits](https://github.com/go-viper/mapstructure/compare/v2.2.1...v2.3.0 )
---
updated-dependencies:
- dependency-name: github.com/go-viper/mapstructure/v2
dependency-version: 2.3.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-17 11:35:09 -04:00
dependabot[bot]
b52b13c03c
chore(deps): bump sigstore/cosign-installer from 3.8.2 to 3.9.0 ( #4015 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.8.2 to 3.9.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.8.2...v3.9.0 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 3.9.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-17 11:34:58 -04:00
anchore-actions-token-generator[bot] and wagoodman
0bfda2c514
chore(deps): update CPE dictionary index ( #4007 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-06-16 11:15:50 -04:00
dependabot[bot]
0b57d03958
chore(deps): bump anchore/sbom-action from 0.20.0 to 0.20.1 ( #4008 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.20.0 to 0.20.1.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/e11c554f704a0b820cbf8c51673f6945e0731532...9246b90769f852b3a8921f330c59e0b3f439d6e9 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-16 11:15:37 -04:00
dependabot[bot]
72f9c42562
chore(deps): bump github.com/google/go-containerregistry ( #4009 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.5 to 0.20.6.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.5...v0.20.6 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.20.6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-16 11:15:22 -04:00
anchore-actions-token-generator[bot] and spiffcs
181e180284
chore(deps): update tools to latest versions ( #3992 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-06-13 10:38:44 -04:00
dependabot[bot]
c19558dd73
chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 ( #4000 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.19 to 3.29.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/fca7ace96b7d713c7035871441bd52efbe39e27e...ce28f5bb42b7a9f2c824e633a3f6ee835bab6858 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.29.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-12 10:37:53 -04:00
Keith Zantow
10f0631710
fix: provide separate nonroot image ( #3998 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-06-11 17:00:55 -04:00
Alex Goodman
96c34ffc43
account for non-import shapes ( #3997 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-06-11 13:11:40 -04:00
Alex Goodman
79b6d5daa4
Allow decoding of anchorectl json files ( #3973 )
...
* allow decoding of import sbom file shape
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address formatting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add file mode and type processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use type to interpret the raw value
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* safe mode convert should use uint32
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simpler decoder type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-06-10 15:03:50 -04:00
dependabot[bot]
cfa7cc5be9
chore(deps): bump github.com/anchore/stereoscope ( #3991 )
...
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.1.5-0.20250604132324-344e29f37f05 to 0.1.5.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/stereoscope/commits/v0.1.5 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-version: 0.1.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-10 11:47:40 -04:00
Alex Goodman
18f9b5ab58
remove benchmark utils ( #3982 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-06-09 18:24:49 +00:00
Keith Zantow
9090c69708
fix: exclude packages with SPDX GENERATED_FROM source package indication ( #3981 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-06-09 14:12:23 -04:00
dependabot[bot]
1396a14550
chore(deps): bump modernc.org/sqlite from 1.37.1 to 1.38.0 ( #3979 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.37.1 to 1.38.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.37.1...v1.38.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.38.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-09 10:31:10 -04:00
dependabot[bot]
592bc0af7d
chore(deps): bump github.com/go-git/go-git/v5 from 5.16.1 to 5.16.2 ( #3978 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.16.1 to 5.16.2.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.16.1...v5.16.2 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.16.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-09 10:26:47 -04:00
anchore-actions-token-generator[bot] and spiffcs
b6b8a8f52e
chore(deps): update tools to latest versions ( #3977 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-06-09 08:56:36 -04:00
anchore-actions-token-generator[bot] and wagoodman
a196cc9215
chore(deps): update CPE dictionary index ( #3976 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-06-09 08:56:18 -04:00
dependabot[bot]
12c8003317
chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 ( #3970 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.40.0 to 0.41.0.
- [Commits](https://github.com/golang/net/compare/v0.40.0...v0.41.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.41.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-06 10:23:02 -04:00
dependabot[bot]
0a25c0ec5c
chore(deps): bump github.com/sergi/go-diff ( #3971 )
...
Bumps [github.com/sergi/go-diff](https://github.com/sergi/go-diff ) from 1.3.2-0.20230802210424-5b0b94c5c0d3 to 1.4.0.
- [Commits](https://github.com/sergi/go-diff/commits/v1.4.0 )
---
updated-dependencies:
- dependency-name: github.com/sergi/go-diff
dependency-version: 1.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-06 10:22:54 -04:00
Christoph Blessing
5ae11bd1f7
Fix Python package dependency detection ( #3965 )
...
Previously a dependency relationship between two Python packages was not
detected if there were no parentheses around the version specifier in
the wheel metadata of the parent package. This commit allows detection
of such relationships.
Signed-off-by: Christoph Blessing <chris24.blessing@gmail.com >
2025-06-06 09:46:16 -04:00
John Vandenberg
bc1cbde4f7
fix: Remove three Rust crate false positive CPE matches ( #3967 )
...
Signed-off-by: John Vandenberg <jayvdb@gmail.com >
2025-06-06 04:29:06 -04:00
Michael Briley and Alex Goodman
868a6a7584
Harden Container Runtime with Non-Root User ( #3941 )
...
* Update Dockerfile
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update Dockerfile
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update validations.yaml
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update validations.yaml
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update Dockerfile
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update validations.yaml
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update Dockerfile
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update .goreleaser.yaml
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* Update .goreleaser.yaml
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
* use distroless/static-debian12:nonroot directly
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep manual manifest curation
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove qemu usage
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add smoke test for snapshot
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split up manifests section with comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct ci step name
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix arch condition
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep path prefix
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Michael Briley <michael.briley937@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-06-05 12:36:23 -04:00
John Vandenberg
bd894b9c4d
fix: Remove two Rust crate false positive CPE matches ( #3962 )
...
Rust crates opentelemetry and redis are being given CPEs that
match CVEs such as CVE-2023-45142 and CVE-2022-24735 respectively.
The vendor overrides added here prevent that.
Signed-off-by: John Vandenberg <jayvdb@gmail.com >
2025-06-05 10:28:54 -04:00
dependabot[bot]
c36c69779a
chore(deps): bump golang.org/x/mod from 0.24.0 to 0.25.0 ( #3963 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.24.0 to 0.25.0.
- [Commits](https://github.com/golang/mod/compare/v0.24.0...v0.25.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-version: 0.25.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-05 13:46:58 +00:00
dependabot[bot]
cd23ccc6e6
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.12 to 0.5.13 ( #3964 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.12 to 0.5.13.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.12...v0.5.13 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.13
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-05 13:45:40 +00:00
Keith Zantow
71d84603c1
fix: bump stereoscope to fix symlink performance issue ( #3953 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-06-04 15:50:03 +00:00
dependabot[bot]
f2118b568d
chore(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.1 ( #3960 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.16.0 to 5.16.1.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.16.0...v5.16.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.16.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-04 14:02:45 +00:00
dependabot[bot]
bb50f1650d
chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 ( #3952 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.18 to 3.28.19.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ff0a06e83cb2de871e5a09832bc6a81e7276941f...fca7ace96b7d713c7035871441bd52efbe39e27e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.19
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-03 10:20:24 -04:00
Christopher Angelo Phillips
a0be514184
feat: add syft schema version to version command ( #3949 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-06-02 15:50:21 +00:00
dependabot[bot]
8cc808f8f6
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.11 to 0.5.12 ( #3943 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.11 to 0.5.12.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.11...v0.5.12 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-version: 0.5.12
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-06-02 10:46:30 -04:00
anchore-actions-token-generator[bot] and spiffcs
967e2f85bf
chore(deps): update tools to latest versions ( #3945 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-06-02 10:46:20 -04:00
anchore-actions-token-generator[bot] and wagoodman
339fea9851
chore(deps): update CPE dictionary index ( #3947 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-06-02 10:43:31 -04:00
Keith Zantow
576e729c84
fix: revert incorrect graalvm unknown behavior ( #3944 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-05-30 11:36:57 -04:00
dependabot[bot]
b3e8926025
chore(deps): bump github.com/google/go-containerregistry ( #3933 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.4 to 0.20.5.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.4...v0.20.5 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.20.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-28 12:45:51 -04:00
anchore-actions-token-generator[bot] and wagoodman
002ec4510a
chore(deps): update CPE dictionary index ( #3935 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-05-28 12:45:42 -04:00
Thomas Gosteli
684e1e963d
fix(terraform): parse provider lock entries without constraints ( #3934 )
...
In a .terraform.lock.hcl file in a provider block the `constraints` attribute is actually not required (=optional).
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
2025-05-27 14:55:19 -04:00
Dan Luhring and Keith Zantow
bbf3bb5856
fix(relationship): favor real paths over symlinks for ownership by file ( #3923 )
...
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-05-23 14:33:19 -04:00
dependabot[bot]
31c1be6d4d
chore(deps): bump modernc.org/sqlite from 1.37.0 to 1.37.1 ( #3926 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.37.0 to 1.37.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.37.0...v1.37.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-version: 1.37.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-22 10:47:26 -04:00
Keith Zantow
7bfb4c86a6
fix(dotnet-deps-cataloger): avoid repeated dependency resolution ( #3930 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-05-21 21:28:40 -04:00
anchore-actions-token-generator[bot] and spiffcs
18ed8b60f8
chore(deps): update tools to latest versions ( #3921 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-05-21 10:56:17 -04:00
dependabot[bot]
b5e9f75ef1
chore(deps): bump github.com/google/go-containerregistry ( #3925 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.3 to 0.20.4.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.3...v0.20.4 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-version: 0.20.4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-21 10:55:48 -04:00
Alex Goodman
ac883f52ed
add cdx group as purl namespace ( #3922 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-20 15:56:08 -04:00
Alex Goodman
e23ca43a83
add PE binary cataloger ( #3911 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-19 14:17:09 -04:00
Christopher Angelo Phillips
b4ca04001c
chore: update dockerfile base images to latest rolling tags ( #3915 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-19 13:43:14 +00:00
anchore-actions-token-generator[bot] and wagoodman
828645ec27
chore(deps): update CPE dictionary index ( #3913 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-05-19 09:16:25 -04:00
Alex Goodman
db77b54c01
finalize go mod ref ( #3908 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-16 17:36:26 +00:00
Alex Goodman
2d4fe513ec
remove benchmark workflow ( #3906 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-16 11:08:43 -04:00
Christopher Angelo Phillips
e1374f758e
fix: update license content filtering default case to be 'none' for no content returned
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-16 14:25:15 +00:00
dependabot[bot]
945893847f
chore(deps): bump github/codeql-action from 3.28.17 to 3.28.18 ( #3905 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.17 to 3.28.18.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/60168efe1c415ce0f5521ea06d5c2062adbeed1b...ff0a06e83cb2de871e5a09832bc6a81e7276941f )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.18
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-16 14:16:11 +00:00
sathiya06 and Alex Goodman
8cbdd38a63
fix: Make Native Image contains no embedded SBOM Error Discoverable ( #3805 )
...
* fix: Make Native Image contains no embedded SBOM Error Discoverable
Signed-off-by: Sathiya Narayanan Venkatesan <sathiyavenkat06@gmail.com >
* adjust error phrasing + wrap error
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sathiya Narayanan Venkatesan <sathiyavenkat06@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-16 13:54:40 +00:00
Adam McClenaghan and Alex Goodman
8f02bd85f6
fix: Distinguish openjdk vs jdk when using file source ( #3895 )
...
* fix: Distinguish openjdk vs jdk when using file source
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
* fix: Fix goimport order
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
* add comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-16 13:29:53 +00:00
Alex Goodman
0480b516f6
chore: fix publishing test fixture images ( #3896 )
...
* update pkg counts
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump max cache size
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-15 14:35:11 -04:00
Christopher Angelo Phillips
2a055690e6
chore: delete unused fixture ( #3901 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-15 17:30:36 +00:00
Christopher Angelo Phillips
4f73d35051
Include default config licenses ( #3900 )
...
* fix: the licenses config was not being carried through causing content to show by default
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-15 16:48:18 +00:00
Ralph Bean and Alex Goodman
b369b02f4f
Expose RPM signature information (for RPM DB and RPM archives) ( #3179 )
...
* feat: expose rpm signature information
This helps with more confident identification of an rpm.
In theory, two rpms can be built that have the same purl string, and
otherwise look identical in syft's output, but the PGP information
would distinguish them as signed either by different keys, or signed at
different times.
In practice, this usually makes no difference since rpms tend to have
unique name/version/release strings. This just gives increased
confidence about the identity of the rpm found in the db.
Signed-off-by: Ralph Bean <rbean@redhat.com >
* chore: generate json schema
Signed-off-by: Ralph Bean <rbean@redhat.com >
* re-generate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename to a more generic signature field
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename rpm.pgp to rpm.signatures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* split out signature fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* include RPM archives
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont fail on unknown signature type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Ralph Bean <rbean@redhat.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-15 16:01:00 +00:00
dependabot[bot]
5effed06a8
chore(deps): bump github.com/mholt/archives from 0.1.1 to 0.1.2 ( #3898 )
...
Bumps [github.com/mholt/archives](https://github.com/mholt/archives ) from 0.1.1 to 0.1.2.
- [Release notes](https://github.com/mholt/archives/releases )
- [Commits](https://github.com/mholt/archives/compare/v0.1.1...v0.1.2 )
---
updated-dependencies:
- dependency-name: github.com/mholt/archives
dependency-version: 0.1.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-15 10:23:30 -04:00
dependabot[bot]
5e25d52845
chore(deps): bump anchore/sbom-action from 0.19.0 to 0.20.0 ( #3899 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.19.0 to 0.20.0.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/9f7302141466aa6482940f15371237e9d9f4c34a...e11c554f704a0b820cbf8c51673f6945e0731532 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.20.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-15 10:23:20 -04:00
Laurent Goderre and Alex Goodman
a8e5b25632
Add PHP interpreter + extensions cataloger ( #2585 )
...
* Add PHP extensions binary classifiers
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* [wip] add php extensions cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* find interpreters + extension
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* internalize binary cataloger utilities
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* default to linux/amd64 for test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-15 08:22:50 -04:00
Alex Goodman
0521ccaf5e
chore: update fixtures based on CI builds ( #3894 )
...
* update fixtures based on ci builds
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typo
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-14 21:30:20 +00:00
Christopher Angelo Phillips
3c7018a853
feat: remove full-text before release ( #3889 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-14 13:12:05 +00:00
Christopher Angelo Phillips
e5d7760bb8
feat: improve dpkg cataloger license recognition for "license agreements" ( #3888 )
2025-05-14 08:41:48 -04:00
Laurent Goderre and Alex Goodman
175a6719a9
Add cataloger for Dart pubspec ( #3292 )
...
* Add cataloger for Dart pubspec
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* capture pubspec specific fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 21:51:49 +00:00
Christopher Angelo Phillips and Alex Goodman
f77d503892
detect license ID from full text when incidentally provided as a value ( #3876 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 16:37:18 -04:00
Keith Zantow
b4d717fb30
chore: update mimetype contact info ( #3887 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-05-13 17:47:05 +00:00
Rez Moss and Alex Goodman
12d91f47dc
Add a homebrew cataloger ( #3724 )
...
* Cataloger homebrew (#4 )
* homebrew cataloger
* uptd
* fixed test
* fixed test
* fixed tests
* fixed lint
* inc schema ver
* upt schema
* fixed integration test
* fixed integration tst
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
fixed DCO
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Rez Moss <hi@rezmoss.com >
* Update parse_homebrew_test.go
add evd anno to test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* lint
Signed-off-by: Rez Moss <hi@rezmoss.com >
* fixed test
Signed-off-by: Rez Moss <hi@rezmoss.com >
* with PR refactors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate jsonschema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor homebrew parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more resiliant variable extraction
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Rez Moss <hi@rezmoss.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 13:01:41 -04:00
Weston Steimel
de88b973f8
chore: fix some logging output ( #3884 )
...
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2025-05-13 13:15:19 +01:00
Alex Goodman
59b880f26a
order locations by container layer order ( #3858 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-13 00:02:07 -04:00
Alex Goodman
e3e69596bd
Translate Portage license strings to SPDX expressions ( #1763 )
...
* fix portage license handling
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* cover license_group file
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add licenses to portage metadata in json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <alex.goodman@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-12 21:03:51 -04:00
Will Murphy
58392a9717
fix: stop emitting redis redis CPE for PHP PECL redis ( #3881 )
...
This prevents the cpe:a:redis:redis... from being emitted for the PHP
Pear / PECL package called redis.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-05-12 16:17:18 -04:00
Keith Zantow
621d21eb04
feat: Add PURL list input/output format ( #3853 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-05-12 13:33:24 -04:00
anchore-actions-token-generator[bot] and wagoodman
bea57a4f7d
chore(deps): update CPE dictionary index ( #3877 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-05-12 09:56:30 -04:00
anchore-actions-token-generator[bot] and spiffcs
ff575b3f4d
chore(deps): update tools to latest versions ( #3878 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-05-12 09:56:07 -04:00
Alex Goodman
f9d0fa81ab
do not search binary contents for version for go package ( #3874 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-09 17:49:17 +00:00
Alex Goodman
abe5e27b4b
fix: remove race when writing errors in generic cataloger ( #3875 )
...
* fix generic cataloger race
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update race test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-09 17:46:47 +00:00
Alex Goodman
a7816dc9e7
clear devel version for go packages ( #3873 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-09 13:36:52 -04:00
anchore-actions-token-generator[bot] and spiffcs
0b78186a97
chore(deps): update tools to latest versions ( #3871 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-05-09 08:29:20 +00:00
dependabot[bot]
99ef5accc7
chore(deps): bump actions/setup-go from 5.4.0 to 5.5.0 ( #3867 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.4.0 to 5.5.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/0aaccfd150d50ccaeb58ebd88d36e91967a5f35b...d35c59abb061a4a6fb18e82ac0862c26744d6ab5 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 5.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-08 14:27:08 -04:00
dependabot[bot]
d634f1438b
chore(deps): bump actions/setup-go in /.github/actions/bootstrap ( #3868 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.4.0 to 5.5.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/0aaccfd150d50ccaeb58ebd88d36e91967a5f35b...d35c59abb061a4a6fb18e82ac0862c26744d6ab5 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-version: 5.5.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-08 14:26:57 -04:00
Alex Goodman
1574fb20ae
merge multiple targets for the same dotnet package ( #3869 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-08 15:28:08 +00:00
James Neate and Alex Goodman
00c4a4e72a
Use package ID from decoded SBOMs when provided ( #1872 )
...
* fix: use package id from cyclonedx when provided
Signed-off-by: James Neate <jamesmneate@gmail.com >
* override package IDs from converted SBOMs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typo
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove extractSyftID function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: James Neate <jamesmneate@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-08 11:25:30 -04:00
bgoareguer
39396cfff9
feat: upgrade base docker image ( #3862 )
...
Signed-off-by: Goareguer Bertrand <bertrand.goareguer@gmail.com >
2025-05-07 14:29:48 +00:00
dependabot[bot]
8aaf36b1ad
chore(deps): bump github.com/github/go-spdx/v2 from 2.3.2 to 2.3.3 ( #3863 )
...
Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) from 2.3.2 to 2.3.3.
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.3.2...v2.3.3 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-version: 2.3.3
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-07 10:00:05 -04:00
dependabot[bot]
af273002b8
chore(deps): bump golang.org/x/net from 0.39.0 to 0.40.0 ( #3859 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.39.0 to 0.40.0.
- [Commits](https://github.com/golang/net/compare/v0.39.0...v0.40.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.40.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-06 12:12:58 -04:00
Christopher Angelo Phillips
6eff158ad3
chore: update license sort to be stable with contents field ( #3860 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-06 11:45:47 -04:00
Alex Goodman
7b25ea5eda
annotate hidden paths in all-layers scope ( #3855 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-06 09:50:04 -04:00
Christopher Angelo Phillips
1ba1186410
fix: use "contents" field and remove "fullText" license field ( #3857 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-05 21:40:09 +00:00
GGMU and Alex Goodman
6db60c5975
Add deep-squashed scope to annotate all layers where a package exists ( #3138 )
...
* add squash all layers resolver
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* add squash with all layers logic
Signed-off-by: tomersein <tomersein@gmail.com >
* add squash with all layers logic
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squashed all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squash with all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* squash with all layers
Signed-off-by: tomersein <tomersein@gmail.com >
* adjust resolver to strictly return squash paths only
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* show all packages have locations + primary evidence
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix race condition in test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* consider access paths
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: tomersein <tomersein@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-05 14:35:57 -04:00
Kudryavcev Nikolay
e13c9e7813
fix: propagate unarchive error of file source ( #3845 )
...
Signed-off-by: Kudryavcev Nikolay <kydry.nikolau@gmail.com >
2025-05-05 15:37:47 +00:00
Alex Goodman
d47a6c3a6d
Improve support for cataloging nix package relationships ( #3837 )
...
* add nix DB cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add derivation path to nix store pkg metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* go mod tidy
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for derivation path to be optional
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* repin build image and disable syscall filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump storage capacity
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* track nix derivation details on packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* image fixture should have derivation examples
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-05-05 15:35:13 +00:00
anchore-actions-token-generator[bot] and wagoodman
7505a04aad
chore(deps): update tools to latest versions ( #3848 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-05-05 15:26:14 +00:00
anchore-actions-token-generator[bot] and wagoodman
f1620b120a
chore(deps): update CPE dictionary index ( #3851 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-05-05 15:14:28 +00:00
Christopher Angelo Phillips
00f53b1777
chore: upgrade fixtures to use version 4 lockfile ( #3852 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-05 14:38:23 +00:00
dependabot[bot]
3faf43d592
chore(deps): bump github/codeql-action from 3.28.16 to 3.28.17 ( #3846 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.16 to 3.28.17.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/28deaeda66b76a05916b6923827895f2b14ab387...60168efe1c415ce0f5521ea06d5c2062adbeed1b )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.17
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-05 10:23:08 -04:00
Christopher Angelo Phillips
6ba087c72c
fix: Do not use hashes for SPDX license names/expressions ( #3844 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-02 09:34:08 -04:00
Christopher Angelo Phillips
94e63eb367
feat: detect when full license text has been provided and preserve as separate field ( #3450 )
...
* feat: add full text field to syft license struct
---------
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
2025-05-01 15:00:46 -04:00
dependabot[bot]
4999de4114
chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.0 to 3.3.1 ( #3843 )
...
Bumps [github.com/Masterminds/semver/v3](https://github.com/Masterminds/semver ) from 3.3.0 to 3.3.1.
- [Release notes](https://github.com/Masterminds/semver/releases )
- [Changelog](https://github.com/Masterminds/semver/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Masterminds/semver/compare/v3.3.0...v3.3.1 )
---
updated-dependencies:
- dependency-name: github.com/Masterminds/semver/v3
dependency-version: 3.3.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-05-01 10:06:11 -04:00
anchore-actions-token-generator[bot] and spiffcs
9ecfe9a53c
chore(deps): update tools to latest versions ( #3841 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-05-01 09:29:19 -04:00
Alan Pope and Alex Goodman
baa1080ef6
Update github.com/Masterminds/semver to v3 ( #3836 )
...
* Update semver to v3. Fixes #3829
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* use single instance of regex obj
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:38:12 +00:00
Laurent Goderre and Alex Goodman
529840bfc0
Add support for PHP Pear ( #2775 )
...
* Add support for PHP Pear and unify PECL with it
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove log statements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix struct comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-30 20:16:58 +00:00
Oleksandr Vodotiiets
78ef2cf53b
fix: Improve detection of erlang binary in alpine Linux ( #3839 )
...
Signed-off-by: Oleksandr Vodotiiets <alex.vodotiiets@gmail.com >
Signed-off-by: Oleksandr Vodotiiets <61548316+avodotiiets@users.noreply.github.com >
2025-04-30 18:50:12 +00:00
VictorHuu
09c3b7cbea
fix:Resolve ancestral symlinks correctly ( #3783 )
...
* Resolve upstream symlinks correctly
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* in case of the root directory
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* for static analysis check pass
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add unit test cases for the symlink scenarios
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-04-30 14:47:32 -04:00
anchore-actions-token-generator[bot] and wagoodman
6dca10fe1f
chore(deps): update CPE dictionary index ( #3834 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-04-30 14:40:52 -04:00
anchore-actions-token-generator[bot] and spiffcs
1ecf1ce7bf
chore(deps): update tools to latest versions ( #3835 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-30 14:40:37 -04:00
dependabot[bot]
20ca60de8b
chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.4 to 1.3.5 ( #3838 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.3.4 to 1.3.5.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.3.4...v1.3.5 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-version: 1.3.5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-30 14:40:00 -04:00
VictorHuu
fa599547a3
fix the fluent-bit regex detection pattern ( #3817 )
...
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-04-25 11:50:45 -04:00
dependabot[bot]
22d8b30813
chore(deps): bump anchore/sbom-action from 0.18.0 to 0.19.0 ( #3832 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/f325610c9f50a54015d37c8d16cb3b0e2c8f4de0...9f7302141466aa6482940f15371237e9d9f4c34a )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-version: 0.19.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-25 11:29:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
a714fb8391
chore(deps): update tools to latest versions ( #3830 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-25 09:59:29 -04:00
Alex Goodman
03fa142de9
Resolve owned file paths when searching for overlaps ( #3828 )
...
* resolve owned file paths when searching for overlaps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dont remove empty paths
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-24 21:59:45 +00:00
anchore-actions-token-generator[bot] and wagoodman
4211d79667
chore(deps): update anchore dependencies ( #3827 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-04-24 16:03:09 -04:00
VictorHuu and Alex Goodman
9af087d213
fix: Make the fileresolver Support Prefix Match of Files ( #3820 )
...
* fix the dpkg files pattern detection
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* consider slash before the path is concatenated
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-24 17:38:05 +00:00
Alex Goodman
5c6c6aa123
Add support for detecting javascript assets in .NET projects using libman ( #3825 )
...
* add support for .NET libman files
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix when no libman detected
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add libman.json docs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-24 17:11:01 +00:00
anchore-actions-token-generator[bot] and spiffcs
43a85dfb85
chore(deps): update tools to latest versions ( #3823 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-24 13:08:32 -04:00
Adam McClenaghan
61a3d1784a
(feat): support skipping archive extraction with file source ( #3795 )
...
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
2025-04-24 12:22:36 -04:00
Alex Goodman
df18edf905
Consider DLL claims for dependencies of .NET packages from deps.json ( #3822 )
...
* consider child dll claims for .NET packages from deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* make dll claim propagation configurable
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-24 11:59:16 -04:00
Alex Goodman
2dd9d583af
PE cataloger should consider compile target paths from deps.json ( #3821 )
...
* fix PE compile path processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* adjust fixture comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-24 14:01:53 +01:00
Adam McClenaghan
f6d4a7d27a
Perf: skip license scanner injection ( #3796 )
...
* (perf): allow library users to skip default scanner injection
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
* (perf): remove prints
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
* perf: move to cataloging licenses.go
Signed-off-by: adammcclenaghan <adam.mcclenaghan@upwind.io >
* perf: Simplify to expose a SetContextLicenseScanner func
Signed-off-by: adammcclenaghan <adam.mcclenaghan@upwind.io >
---------
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
Signed-off-by: adammcclenaghan <adam.mcclenaghan@upwind.io >
2025-04-23 16:01:10 -04:00
dependabot[bot]
273d414b6b
chore(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 ( #3818 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.8.1 to 3.8.2.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.8.1...v3.8.2 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-version: 3.8.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-23 11:27:08 -04:00
dependabot[bot]
0a0c2963f4
chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 ( #3819 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.15 to 3.28.16.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/45775bd8235c68ba998cffa5171334d58593da47...28deaeda66b76a05916b6923827895f2b14ab387 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.16
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-23 11:25:42 -04:00
anchore-actions-token-generator[bot] and spiffcs
1d7529d01f
chore(deps): update tools to latest versions ( #3815 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-22 13:10:35 -04:00
Will Murphy
a69f6aec90
docs: document test commands ( #3816 )
...
So that contributors can quickly figure out how to run tests.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-04-22 10:23:52 -04:00
Stijn Taelemans
df11561929
Support detection of Chrome binaries ( #3136 )
...
* test: add test cases
Signed-off-by: Stijn Taelemans <taelemansst@gmail.com >
* feat: add classifier for chrome
Signed-off-by: Stijn Taelemans <taelemansst@gmail.com >
---------
Signed-off-by: Stijn Taelemans <taelemansst@gmail.com >
2025-04-21 16:37:15 -04:00
VictorHuu
ab570497b0
fix:allow golang tip image detection regex pattern ( #3757 )
...
* Modify the Regex version matcher for golang in the binary classifiers to make it compatible with golang tip images
Signed-off-by: Victor Hu <victorhu493@gmail.com >
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* Preliminary fix the regex matching for golang tip image and add the corresponding unit tests
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* consider VERSION.cache when it comes to golang tip images
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* consider VERSION.cache when it comes to golang tip images
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
---------
Signed-off-by: Victor Hu <victorhu493@gmail.com >
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
2025-04-21 14:06:52 -04:00
VictorHuu and Alex Goodman
ea7e9e696b
fix:Make the parse of the replace part in ``go.mod`` more compliant and traceable ( #3812 )
...
* We only need to replace the name of a GoLang package when the name is a web link
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* make the detection of a localfile path pattern more easy
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* consider the m.New.Version so the granularity is narrowed
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* to pass the static-analysis
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* to pass the static-analysis
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
* add test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Yuntao Hu <victorhu493@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-21 17:58:54 +00:00
Adam McClenaghan
1f15361ecf
(fix): delete collection name/type key entries when empty ( #3797 )
...
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
2025-04-21 13:41:39 -04:00
anchore-actions-token-generator[bot] and wagoodman
0bcf2881c4
chore(deps): update CPE dictionary index ( #3813 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-04-21 09:59:06 -04:00
anchore-actions-token-generator[bot] and spiffcs
b9ae936731
chore(deps): update tools to latest versions ( #3806 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-17 12:26:29 -04:00
dependabot[bot]
e452cc7623
chore(deps): bump github.com/go-git/go-git/v5 from 5.15.0 to 5.16.0 ( #3807 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.15.0 to 5.16.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.15.0...v5.16.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.16.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-17 12:26:18 -04:00
Keith Zantow
b13ffdd304
fix: comma separated selectors in cataloger list command ( #3804 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-04-16 10:41:48 -04:00
dependabot[bot]
a5da154327
chore(deps): bump github.com/anchore/stereoscope from 0.1.2 to 0.1.3 ( #3803 )
2025-04-15 19:31:45 +00:00
Musang Kim
1866e25f9a
chore: fix conan parser typos ( #3802 )
...
Signed-off-by: Musang <s.musang.kim@gmail.com >
2025-04-15 10:51:02 -04:00
anchore-actions-token-generator[bot] and spiffcs
1e336e3f07
chore(deps): update tools to latest versions ( #3798 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-14 14:43:53 -04:00
anchore-actions-token-generator[bot] and wagoodman
eee9d0a41e
chore(deps): update CPE dictionary index ( #3799 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-04-14 14:43:25 -04:00
dependabot[bot]
a5632c0044
chore(deps): bump github.com/mholt/archives from 0.1.0 to 0.1.1 ( #3778 )
...
Bumps [github.com/mholt/archives](https://github.com/mholt/archives ) from 0.1.0 to 0.1.1.
- [Release notes](https://github.com/mholt/archives/releases )
- [Commits](https://github.com/mholt/archives/compare/v0.1.0...v0.1.1 )
---
updated-dependencies:
- dependency-name: github.com/mholt/archives
dependency-version: 0.1.1
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 14:50:51 -04:00
dependabot[bot]
2a409488a0
chore(deps): bump marocchino/sticky-pull-request-comment ( #3788 )
...
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) from 2.9.1 to 2.9.2.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/52423e01640425a022ef5fd42c6fb5f633a02728...67d0dec7b07ed060a405f9b2a64b8ab319fdd7db )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-version: 2.9.2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 12:43:11 -04:00
dependabot[bot]
d145e80c20
chore(deps): bump github.com/magiconair/properties from 1.8.9 to 1.8.10 ( #3789 )
...
Bumps [github.com/magiconair/properties](https://github.com/magiconair/properties ) from 1.8.9 to 1.8.10.
- [Release notes](https://github.com/magiconair/properties/releases )
- [Commits](https://github.com/magiconair/properties/compare/v1.8.9...v1.8.10 )
---
updated-dependencies:
- dependency-name: github.com/magiconair/properties
dependency-version: 1.8.10
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 12:42:57 -04:00
dependabot[bot]
05de0d2a1b
chore(deps): bump github.com/charmbracelet/bubbles from 0.20.0 to 0.21.0 ( #3790 )
...
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles ) from 0.20.0 to 0.21.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases )
- [Changelog](https://github.com/charmbracelet/bubbles/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.20.0...v0.21.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
dependency-version: 0.21.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 12:42:46 -04:00
Alex Goodman
24df095a5e
empty source during decoding should not be fatal ( #3791 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-11 10:12:29 -04:00
dependabot[bot]
e7f0a602c2
chore(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.15.0 ( #3792 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.14.0 to 5.15.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.14.0...v5.15.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-version: 5.15.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-11 10:12:05 -04:00
anchore-actions-token-generator[bot] and spiffcs
e73293cd45
chore(deps): update tools to latest versions ( #3785 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-08 14:03:29 -04:00
dependabot[bot]
3b3943d2d6
chore(deps): bump github/codeql-action from 3.28.13 to 3.28.15 ( #3786 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.13 to 3.28.15.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/1b549b9259bda1cb5ddde3b41741a82a2d15a841...45775bd8235c68ba998cffa5171334d58593da47 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-version: 3.28.15
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-08 14:03:06 -04:00
dependabot[bot]
97228af539
chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 ( #3787 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.38.0 to 0.39.0.
- [Commits](https://github.com/golang/net/compare/v0.38.0...v0.39.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-version: 0.39.0
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-04-08 14:02:48 -04:00
anchore-actions-token-generator[bot] and wagoodman
987ba83674
chore(deps): update CPE dictionary index ( #3782 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-04-07 10:01:11 -04:00
anchore-actions-token-generator[bot] and spiffcs
f11377fe30
chore(deps): update tools to latest versions ( #3775 )
...
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-04-03 17:35:26 +00:00
Alex Goodman
12f36420dd
Parse GitHub actions comments ( #3776 )
...
* add version comment parsing support to github actions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with github actions metadata
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add originator processing for github actions type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-03 14:46:27 +00:00
Alex Goodman
f851085668
Expand python license scanning to cover unclaimed files ( #3779 )
...
* expand python license scanning to cover unclaimed files
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* speed up tests using the license scanner
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-03 10:31:02 -04:00
Christopher Angelo Phillips
da62a82413
feat: adds the DirectoryTag to the r cataloger ( #3774 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-04-01 11:46:51 -04:00
anchore-actions-token-generator[bot] and wagoodman
9ab83874ed
chore(deps): update anchore dependencies ( #3772 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-04-01 14:09:34 +00:00
Alex Goodman
d033ad7de6
unpin go version in ci ( #3773 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-04-01 13:27:15 +00:00
dependabot[bot]
b948f2e254
chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 ( #3766 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.37.0 to 0.38.0.
- [Commits](https://github.com/golang/net/compare/v0.37.0...v0.38.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 15:02:30 +00:00
dependabot[bot]
6d792aa9dd
chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 ( #3767 )
...
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.16.2 to 3.18.0.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/28ba43ae48961b90635b50953d216767a6bea486...1750b5085f3ec60384090fb7c52965ef822e869e )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 10:43:47 -04:00
dependabot[bot]
72a0fa4aa3
chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 ( #3771 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.36.1 to 1.37.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.1...v1.37.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-31 10:41:53 -04:00
anchore-actions-token-generator[bot] and wagoodman
ec130b977e
chore(deps): update CPE dictionary index ( #3769 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-31 11:51:04 +01:00
Alex Goodman
c53f2fbad3
Better represent .NET runtime packages ( #3768 )
...
* clean up .NET runtime packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add runtime relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove runtime references from binary package name
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-28 13:36:27 -04:00
Alex Goodman
40dd5d0bbd
better .NET cpe generation ( #3764 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-28 10:58:59 -04:00
Alex Goodman
ad9928cb2a
Merge the .NET deps.json and PE binary catalogers ( #3563 )
...
* add combined deps.json + pe binary cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* deprecate pe and deps standalone catalogers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* parse resource names + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration and CLI tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add some helpful code comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for dropping Dep packages that are missing DLLs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* migrate json schema changes to 24
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* keep application configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* correct config help
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] detect claims of dlls within deps.json
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* [wip] fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add assembly repack detection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* .net package count is lower due to dll claim requirement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-27 14:38:16 -04:00
Keith Zantow
4a9437808e
feat: parallelize catalogers per-file and hash contents in parallel ( #3636 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-26 11:10:08 -04:00
dependabot[bot]
dbe29ed4ab
chore(deps): bump github/codeql-action from 3.28.12 to 3.28.13 ( #3758 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.12 to 3.28.13.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5f8171a638ada777af81d42b55959a643bb29017...1b549b9259bda1cb5ddde3b41741a82a2d15a841 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-24 14:28:25 -04:00
anchore-actions-token-generator[bot] and wagoodman
d0018c921e
chore(deps): update CPE dictionary index ( #3756 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-24 10:02:21 -04:00
Keith Zantow
7ac4d91f43
chore: reformat ( #3754 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-21 06:13:35 -04:00
anchore-actions-token-generator[bot] and spiffcs
410b85e1c9
chore(deps): update tools to latest versions ( #3747 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-03-20 10:19:45 -04:00
Alex Goodman
e9b24a29d7
Remove mitchellh dependencies ( #3748 )
...
* remove mitchellh dependencies
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix failing unit tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-20 10:19:19 -04:00
dependabot[bot]
35d666b27d
chore(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 ( #3750 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.6.1 to 4.6.2.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1...ea165f8d65b6e75b540449e92b4886f43607fa02 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:50 -04:00
dependabot[bot]
b036d75e8a
chore(deps): bump github.com/docker/docker ( #3749 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 28.0.1+incompatible to 28.0.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v28.0.1...v28.0.2 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:35 -04:00
dependabot[bot]
f1bc8f8a2a
chore(deps): bump actions/cache from 4.2.2 to 4.2.3 ( #3751 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.2 to 4.2.3.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/d4323d4df104b026a6aa633fdb11d772146be0bf...5a3ec84eff668545956fd18022155c47e93e2684 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:21 -04:00
dependabot[bot]
e986750cbc
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #3752 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.2 to 4.2.3.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/d4323d4df104b026a6aa633fdb11d772146be0bf...5a3ec84eff668545956fd18022155c47e93e2684 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-20 10:02:05 -04:00
Alan Pope and Alex Goodman
5fa8e9c6e9
feat: add Debian archive (.deb) file cataloger ( #3704 )
...
* feat: add Debian archive (.deb) file cataloger
Add a cataloger that parses Debian package (.deb) archive files directly,
allowing Syft to discover packages from .deb files without requiring
them to be installed on the system. This implements issue #3315 .
Key features:
- Parse .deb AR archives to extract package metadata
- Support for gzip, xz, and zstd compressed control files
- Extract package metadata from control files
- Process file information from md5sums files
- Mark configuration files from conffiles entries
- Handle trailing slashes in archive member names
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* chore: run go mod tidy to fix failing workflow
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* add license processing to dpkg archive cataloger + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with dpkg archive type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-19 20:03:21 +00:00
dependabot[bot]
be0959cabf
chore(deps): bump actions/setup-go in /.github/actions/bootstrap ( #3742 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/f111f3307d8850f501ac008e886eec1fd1932a34...0aaccfd150d50ccaeb58ebd88d36e91967a5f35b )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 13:46:54 -04:00
dependabot[bot]
78dc6f7546
chore(deps): bump actions/setup-go from 5.3.0 to 5.4.0 ( #3743 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.3.0 to 5.4.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/f111f3307d8850f501ac008e886eec1fd1932a34...0aaccfd150d50ccaeb58ebd88d36e91967a5f35b )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 13:46:51 -04:00
dependabot[bot]
071948f58e
chore(deps): bump github/codeql-action from 3.28.11 to 3.28.12 ( #3744 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.11 to 3.28.12.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/6bb031afdd8eb862ea3fc1848194185e076637e5...5f8171a638ada777af81d42b55959a643bb29017 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 13:46:47 -04:00
dependabot[bot]
710f876d86
chore(deps): bump github.com/BurntSushi/toml from 1.4.0 to 1.5.0 ( #3740 )
...
Bumps [github.com/BurntSushi/toml](https://github.com/BurntSushi/toml ) from 1.4.0 to 1.5.0.
- [Release notes](https://github.com/BurntSushi/toml/releases )
- [Commits](https://github.com/BurntSushi/toml/compare/v1.4.0...v1.5.0 )
---
updated-dependencies:
- dependency-name: github.com/BurntSushi/toml
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 09:29:47 -04:00
dependabot[bot]
8d798134c2
chore(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 ( #3738 )
...
Bumps [github.com/containerd/containerd](https://github.com/containerd/containerd ) from 1.7.26 to 1.7.27.
- [Release notes](https://github.com/containerd/containerd/releases )
- [Changelog](https://github.com/containerd/containerd/blob/main/RELEASES.md )
- [Commits](https://github.com/containerd/containerd/compare/v1.7.26...v1.7.27 )
---
updated-dependencies:
- dependency-name: github.com/containerd/containerd
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-19 09:29:36 -04:00
anchore-actions-token-generator[bot] and spiffcs
8fb32dfc13
chore(deps): update tools to latest versions ( #3739 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-03-19 08:32:30 -04:00
Alex Goodman
2738291a96
swap centos images for rocky ( #3741 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-18 14:25:03 +00:00
anchore-actions-token-generator[bot] and wagoodman
7bdbfc0478
chore(deps): update anchore dependencies ( #3727 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-17 15:59:13 +00:00
anchore-actions-token-generator[bot] and wagoodman
6e7386a4fd
chore(deps): update CPE dictionary index ( #3735 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-17 10:22:53 -04:00
anchore-actions-token-generator[bot] and spiffcs
f889c4c014
chore(deps): update tools to latest versions ( #3722 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-03-17 10:22:21 -04:00
dependabot[bot]
06571af855
chore(deps): bump github.com/spf13/afero from 1.12.0 to 1.14.0 ( #3736 )
...
Bumps [github.com/spf13/afero](https://github.com/spf13/afero ) from 1.12.0 to 1.14.0.
- [Release notes](https://github.com/spf13/afero/releases )
- [Commits](https://github.com/spf13/afero/compare/v1.12.0...v1.14.0 )
---
updated-dependencies:
- dependency-name: github.com/spf13/afero
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-17 10:22:10 -04:00
dependabot[bot]
d6693c8504
chore(deps): bump modernc.org/sqlite from 1.36.0 to 1.36.1 ( #3737 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.36.0 to 1.36.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.36.0...v1.36.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-17 10:22:02 -04:00
dependabot[bot]
2d33bcf84f
chore(deps): bump github.com/charmbracelet/lipgloss from 1.0.0 to 1.1.0 ( #3732 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 1.0.0 to 1.1.0.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v1.0.0...v1.1.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-14 11:47:58 -04:00
dependabot[bot]
ae878f7dfd
chore(deps): bump docker/login-action from 3.3.0 to 3.4.0 ( #3733 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.3.0 to 3.4.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/9780b0c442fbb1117ed29e0efdff1e18412f7567...74a5d142397b4f367a81961eba4e8cd7edddf772 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-14 11:47:51 -04:00
Yoav Alon
6f70927bcc
fix(performance): reduce memory allocation in containsPath ( #3730 )
...
Signed-off-by: Yoav Alon <yoav@orca.security >
2025-03-13 14:39:57 -04:00
Keith Zantow
9a2c2ad401
chore: upload individual binaries as artifacts ( #3714 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-13 12:15:13 -04:00
Sven Gregori and Alex Goodman
2846bb18d2
fix: fetch Dart package versions from sdk entries ( #3572 )
...
* fix: fetch Dart package versions from sdk entries
Packages that are provided by an SDK, mainly Flutter, will have their
version set to 0.0.0 in Dart's pubspec.lock file. Their actual version
is linked to that SDK, which is defined either as a version range or a
minimum supported version, rather than an explicit, single version.
The pubspec.lock file has a dedicated section to define those SDK
version range constraints, which is already stored internally when
parsing the file itself. The solution now is to look up such a package's
SDK name, retrieve the defined version range / lower version boundary,
and set the minimum supported version as the package's new version.
Signed-off-by: Sven Gregori <sven@craplab.fi >
* Ignore Dart package if SDK version cannot be fetched
Signed-off-by: Sven Gregori <sven@craplab.fi >
* fix linting issues
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Sven Gregori <sven@craplab.fi >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-13 06:10:32 -04:00
anchore-actions-token-generator[bot] and spiffcs
616c8dfe2a
chore(deps): update tools to latest versions ( #3713 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-03-11 14:13:34 -04:00
anchore-actions-token-generator[bot] and wagoodman
d387f612ca
chore(deps): update CPE dictionary index ( #3715 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-11 14:09:54 -04:00
mikey strauss
6a28c1c604
Add set ID to dotnet packages ( #3719 )
...
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
2025-03-11 14:09:25 -04:00
dependabot[bot]
c613476347
chore(deps): bump github/codeql-action from 3.28.10 to 3.28.11 ( #3716 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.10 to 3.28.11.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d...6bb031afdd8eb862ea3fc1848194185e076637e5 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-11 14:08:54 -04:00
Alex Goodman
34e5ff753f
Location order on packages should consider evidence annotations when sorting ( #3720 )
...
* fix: sorting locations should consider pkg evidence
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify location test options for comparison
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-11 10:34:37 -04:00
TechVest
04941c8b97
chore: fix some function names in comment ( #3717 )
...
Signed-off-by: TechVest <techdashen@qq.com >
2025-03-10 11:34:10 -04:00
Alan Pope
c687b7bfa5
fix: improve fluent-bit binary detection regex pattern ( #3701 )
...
* fix: improve fluent-bit binary detection regex pattern
This fixes issue #3133 by updating the regex pattern for fluent-bit binary detection
to better handle ANSI escape sequences and multiple null bytes between the version
string and "Fluent Bit" text. The change also makes the %s format specifier optional,
supporting all variations in fluent-bit binary signatures.
Signed-off-by: Alan Pope <alan.pope@anchore.com >
* test: add fluent-bit 1.7.0-dev-3 test fixture for issue #3133
Signed-off-by: Alan Pope <alan.pope@anchore.com >
---------
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2025-03-07 14:56:37 +00:00
Keith Zantow
7571f8dfba
chore: updates for go 1.24.1 ( #3712 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-03-06 15:35:26 +00:00
dependabot[bot]
e8c62faefc
chore(deps): bump golang.org/x/mod from 0.23.0 to 0.24.0 ( #3708 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.23.0 to 0.24.0.
- [Commits](https://github.com/golang/mod/compare/v0.23.0...v0.24.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 15:20:45 +00:00
Tom Fay and Alex Goodman
24133be4e6
Update rustaudit module name ( #3689 )
...
Signed-off-by: Tom Fay <tom@teamfay.co.uk >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-03-06 15:07:05 +00:00
dependabot[bot]
8e28b13a3d
chore(deps): bump golang.org/x/net from 0.35.0 to 0.37.0 ( #3711 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.35.0 to 0.37.0.
- [Commits](https://github.com/golang/net/compare/v0.35.0...v0.37.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 15:01:39 +00:00
dependabot[bot]
6b0425ebad
chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.4 to 1.3.4 ( #3690 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.2.4 to 1.3.4.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.4...v1.3.4 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 15:00:19 +00:00
Stef Graces and Keith Zantow
694eec4079
Add downloadLocation URI validation ( #3697 )
...
* Add downloadLocation URI validation
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
* Update function names
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
* Fixes for make lint-fix + Changes to when NONE and NOASSERTION in downloadLocation
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
---------
Signed-off-by: Stef Graces <stefgraces@hotmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-03-06 14:45:47 +00:00
Joel Rudsberg
974ce23722
Native Image SBOM: support extracting symbols in .dynsym section for ELF files ( #3647 )
...
Signed-off-by: Joel Rudsberg <joel.rudsberg@oracle.com >
2025-03-06 09:12:14 -05:00
dependabot[bot]
36c198ac67
chore(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 ( #3687 )
...
Bumps [github.com/google/go-cmp](https://github.com/google/go-cmp ) from 0.6.0 to 0.7.0.
- [Release notes](https://github.com/google/go-cmp/releases )
- [Commits](https://github.com/google/go-cmp/compare/v0.6.0...v0.7.0 )
---
updated-dependencies:
- dependency-name: github.com/google/go-cmp
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:04:14 -05:00
dependabot[bot]
f68351c457
chore(deps): bump modernc.org/sqlite from 1.35.0 to 1.36.0 ( #3692 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.35.0 to 1.36.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.35.0...v1.36.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:04:10 -05:00
dependabot[bot]
3bdc24dfd7
chore(deps): bump github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0 ( #3693 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.13.2 to 5.14.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.13.2...v5.14.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:04:07 -05:00
dependabot[bot]
eaca1921bf
chore(deps): bump github.com/docker/docker ( #3694 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 28.0.0+incompatible to 28.0.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v28.0.0...v28.0.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:03:51 -05:00
dependabot[bot]
6e0cc6fe04
chore(deps): bump actions/cache from 4.2.1 to 4.2.2 ( #3698 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0c907a75c2c80ebcb7f088228285e798b750cf8f...d4323d4df104b026a6aa633fdb11d772146be0bf )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:03:48 -05:00
dependabot[bot]
2251b83315
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #3699 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0c907a75c2c80ebcb7f088228285e798b750cf8f...d4323d4df104b026a6aa633fdb11d772146be0bf )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:03:44 -05:00
anchore-actions-token-generator[bot] and wagoodman
90761f449a
chore(deps): update CPE dictionary index ( #3702 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-03-06 09:03:31 -05:00
dependabot[bot]
a860c4738f
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.6 to 6.6.7 ( #3703 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.6 to 6.6.7.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.6...v6.6.7 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:03:14 -05:00
dependabot[bot]
92e8ee74c8
chore(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 ( #3709 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.35.0 to 0.36.0.
- [Commits](https://github.com/golang/net/compare/v0.35.0...v0.36.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-06 09:03:03 -05:00
dependabot[bot]
705e59b107
chore(deps): bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 ( #3706 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.7 to 7.0.8.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/dd2324fc52d5d43c699a5636bcf19fceaa70c284...271a8d0340265f705b14b6d32b9829c1cb33d45e )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-03-04 11:10:24 -05:00
Alex Goodman
f6605a3817
suppress file already closed errors ( #3695 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-27 21:52:50 +00:00
Alex Goodman
5e2723187d
Fix /etc/redhat-release file parsing when resolving distro details ( #3688 )
2025-02-26 12:42:29 +00:00
dependabot[bot]
f44b709542
chore(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 ( #3675 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.8.0 to 3.8.1.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.8.0...v3.8.1 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-24 10:04:27 -05:00
Keith Zantow
2792013eb2
chore: disable line wrapping glow output ( #3679 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-24 10:04:14 -05:00
anchore-actions-token-generator[bot] and wagoodman
3b951648a8
chore(deps): update CPE dictionary index ( #3682 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-24 10:03:13 -05:00
dependabot[bot]
e4d9ccde47
chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 ( #3684 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.6 to 7.0.7.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/67ccf781d68cd99b580ae25a5c18a1cc84ffff1f...dd2324fc52d5d43c699a5636bcf19fceaa70c284 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-24 10:02:32 -05:00
dependabot[bot]
3c5a71156e
chore(deps): bump github/codeql-action from 3.28.9 to 3.28.10 ( #3685 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.9 to 3.28.10.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0...b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-24 10:02:11 -05:00
dependabot[bot]
ed66988928
chore(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 ( #3686 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.6.0 to 4.6.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08...4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-24 10:01:42 -05:00
Keith Zantow
46522bcc5d
chore: update packageurl-go ( #3678 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-21 15:31:16 -05:00
RogueAI and Keith Zantow
aeea170b19
fix: disable cert validation in dotnet-portable-executable-cataloger by default ( #3677 )
...
Signed-off-by: rogueai <rogueai@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-02-21 15:08:06 -05:00
William Murphy
dd2ee2bbf7
fix: find bitnami files even when no relationships ( #3676 )
...
The bitnami cataloger assigns files under /opt/bitnami/PACKAGE to be
owned by PACKAGE unless they are otherwise owned. Previously, this main
package was identified only by relationships, leading to an edge case
where if there was a bitnami SBOM with a single package in it, there
were no relationships, and so there would be no main package to assign
the files to, leading to deduplication failures.
Instead, when encountering a bitnami SBOM with exactly one package in
it, assume that package is the main package of that SBOM.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2025-02-21 14:22:37 +00:00
anchore-actions-token-generator[bot] and spiffcs
edcfbe2f0d
chore(deps): update tools to latest versions ( #3652 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-02-20 14:59:23 -05:00
anchore-actions-token-generator[bot] and wagoodman
aff025ba35
chore(deps): update CPE dictionary index ( #3666 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-20 14:59:10 -05:00
dependabot[bot]
97a99e1132
chore(deps): bump actions/cache from 4.2.0 to 4.2.1 ( #3670 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.0 to 4.2.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/1bd1e32a3bdc45362d1e726936510720a7c30a57...0c907a75c2c80ebcb7f088228285e798b750cf8f )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-20 10:45:27 -05:00
dependabot[bot]
edc361c0c7
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #3671 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.2.0 to 4.2.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/1bd1e32a3bdc45362d1e726936510720a7c30a57...0c907a75c2c80ebcb7f088228285e798b750cf8f )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-20 10:44:58 -05:00
dependabot[bot]
2317c5acfc
chore(deps): bump github.com/docker/docker ( #3673 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.5.1+incompatible to 28.0.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.5.1...v28.0.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-20 10:41:49 -05:00
idhyt
52bd4acd23
fix: correctly trim conanfile line breaks ( #3672 )
...
Signed-off-by: idhyt <idhyt3r@gmail.com >
2025-02-20 09:18:39 -05:00
dependabot[bot]
59b84f3ffd
chore(deps): bump github.com/spf13/cobra from 1.8.1 to 1.9.1 ( #3667 )
...
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra ) from 1.8.1 to 1.9.1.
- [Release notes](https://github.com/spf13/cobra/releases )
- [Commits](https://github.com/spf13/cobra/compare/v1.8.1...v1.9.1 )
---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-18 13:48:18 -05:00
dependabot[bot]
fb7444cb02
chore(deps): bump github.com/sanity-io/litter from 1.5.6 to 1.5.8 ( #3668 )
...
Bumps [github.com/sanity-io/litter](https://github.com/sanity-io/litter ) from 1.5.6 to 1.5.8.
- [Changelog](https://github.com/sanity-io/litter/blob/main/CHANGELOG.md )
- [Commits](https://github.com/sanity-io/litter/compare/v1.5.6...v1.5.8 )
---
updated-dependencies:
- dependency-name: github.com/sanity-io/litter
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-18 13:48:08 -05:00
dependabot[bot]
e8a4667db2
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.10 to 0.5.11 ( #3669 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.10 to 0.5.11.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.10...v0.5.11 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-18 13:47:54 -05:00
bffe26bcc5
feat: add support for Bitnami cataloguer ( #3341 )
...
* prototype: start bitnami cataloger
Bitnami images have spdx SBOMs at predictable paths, and Syft could more
accurately identify the software in these images by scanning those
SBOMs. Start work on this by forking the sbom-cataloger as a new
bitnami-cataloger.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* wire up bitnami cataloger to run on images by default
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: add support for Bitnami cataloguer
Signed-off-by: juan131 <jariza@vmware.com >
* feat: use a better SPDX sample for unit tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: only report bitnami pkgs
Signed-off-by: juan131 <jariza@vmware.com >
* feat: adapt JSON schema, spdxutil and packagemetadata
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* feat: implement FileOwner interface
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: update json schema
Signed-off-by: juan131 <jariza@vmware.com >
* [wip] add bitnami owned files and fix binary package ownership filtering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* feat: obtain bitnami pkg files based on SPDX relationships tree
Signed-off-by: juan131 <jariza@vmware.com >
* preserve type switches
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename bitnami entry metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restrict find main pkg logic
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add missing graalvm source info
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bugfix: integration tests
Signed-off-by: juan131 <jariza@vmware.com >
* bugfix: mod tidy
Signed-off-by: juan131 <jariza@vmware.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Signed-off-by: juan131 <jariza@vmware.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-18 09:07:47 -05:00
dependabot[bot]
869908ece1
chore(deps): bump modernc.org/sqlite from 1.34.5 to 1.35.0 ( #3664 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.34.5 to 1.35.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.34.5...v1.35.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-14 08:40:30 -05:00
dependabot[bot]
91b7592a2f
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.5 to 6.6.6 ( #3653 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.5 to 6.6.6.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.5...v6.6.6 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-13 10:08:20 -05:00
Weston Steimel
dce99543b2
feat: update to go 1.24.x ( #3660 )
...
* feat: update to go 1.24.x
Update to building with go 1.24.x so that the main module version gets
set during `go build`
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
* chore: bump golangci-lint for go 1.24.x support
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
* chore: appease the updated linter
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
* chore: fix test logging for go 1.24
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
---------
Signed-off-by: Weston Steimel <author@code.w.steimel.me.uk>
2025-02-13 10:08:10 -05:00
Keith Zantow
a17fe480a0
chore: update runners to ubuntu-24.04 ( #3657 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-11 21:34:12 +00:00
dependabot[bot]
d6fe2b08cb
chore(deps): bump golang.org/x/net from 0.34.0 to 0.35.0 ( #3655 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.34.0 to 0.35.0.
- [Commits](https://github.com/golang/net/compare/v0.34.0...v0.35.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-11 13:15:50 -05:00
dependabot[bot]
51780fba16
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.9 to 0.5.10 ( #3650 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.9 to 0.5.10.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.9...v0.5.10 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-10 10:19:22 -05:00
anchore-actions-token-generator[bot] and wagoodman
46f9bf4e4d
chore(deps): update CPE dictionary index ( #3649 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-09 22:45:31 -05:00
Keith Zantow
2328b20082
fix: reduce warn levels to debug for non-actionable errors ( #3645 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-02-07 13:22:55 -05:00
dependabot[bot]
52d543f3c1
chore(deps): bump github/codeql-action from 3.28.8 to 3.28.9 ( #3648 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.8 to 3.28.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/dd746615b3b9d728a6a37ca2045b68ca76d4841a...9e8d0789d4a0fa9ceb6b1738f7e269594bdd67f0 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-07 11:18:56 -05:00
Christopher Angelo Phillips
e584c9f416
feat: 3626 add option enable license content; disable by default ( #3631 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-02-05 20:41:03 +00:00
anchore-actions-token-generator[bot] and spiffcs
7bab6e9851
chore(deps): update tools to latest versions ( #3641 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-02-05 14:23:36 -05:00
dependabot[bot]
10ba5aa9e6
chore(deps): bump sigstore/cosign-installer from 3.7.0 to 3.8.0 ( #3642 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.7.0 to 3.8.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.7.0...v3.8.0 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-05 14:22:21 -05:00
dependabot[bot]
79ea956f18
chore(deps): bump golang.org/x/mod from 0.22.0 to 0.23.0 ( #3644 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.22.0 to 0.23.0.
- [Commits](https://github.com/golang/mod/compare/v0.22.0...v0.23.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-02-05 14:22:02 -05:00
Alex Goodman
684b6e3f98
Add file catalogers to selection configuration ( #3505 )
...
* add file catalogers to selection configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix typos
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* warn when there is conflicting file cataloging configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for explicit removal of all package and file tasks
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-02-03 19:10:17 +00:00
Christopher Angelo Phillips
5e2ba43328
chore: replace all shorthand tags of mapstruct -> mapstructure ( #3633 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-02-03 10:43:06 -05:00
anchore-actions-token-generator[bot] and spiffcs
4dc86a06c7
chore(deps): update tools to latest versions ( #3637 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-02-03 09:44:56 -05:00
anchore-actions-token-generator[bot] and wagoodman
7a69f6fdd7
chore(deps): update CPE dictionary index ( #3638 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-02-03 09:44:44 -05:00
Christopher Angelo Phillips
9a9195e5c4
feat: syft 3435 - add file components to cyclonedx bom output when file metadata is available ( #3539 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-31 15:09:15 -05:00
anchore-actions-token-generator[bot] and spiffcs
a16e374a50
chore(deps): update tools to latest versions ( #3635 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-31 11:14:59 -05:00
dependabot[bot]
bdf680426d
chore(deps): bump github/codeql-action from 3.28.7 to 3.28.8 ( #3634 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.7 to 3.28.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/6e5455904168f98c75d8e5ad848b4dc4ab3ae77e...dd746615b3b9d728a6a37ca2045b68ca76d4841a )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-30 11:07:01 -05:00
Christopher Angelo Phillips
d5e52bc2ce
docs: update descriptions with correct options ( #3630 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-29 15:47:04 +00:00
dependabot[bot]
b89304d9b5
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.8 to 0.5.9 ( #3627 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.8 to 0.5.9.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.8...v0.5.9 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-29 09:58:51 -05:00
dependabot[bot]
3fc0e0485e
chore(deps): bump github/codeql-action from 3.28.6 to 3.28.7 ( #3628 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.6 to 3.28.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/17a820bf2e43b47be2c72b39cc905417bc1ab6d0...6e5455904168f98c75d8e5ad848b4dc4ab3ae77e )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-29 09:58:32 -05:00
HeyeOpenSource and Christopher Phillips
f7e767fc25
feat: update licenses to including license content when SPDX expressions are unable to be determined ( #3366 )
...
---------
Signed-off-by: HeyeOpenSource <opensource@heye-international.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-28 18:05:27 +00:00
Martin Prpič
58dc43de86
fix: update namespace value for OpenSUSE distros ( #3615 )
...
Instead of namespacing them to the specific distro version, such as
Leap or Tumbleweed, the namespace value is set to the vendor itself:
"opensuse".
Resolves #3534
Signed-off-by: Martin Prpič <mprpic@redhat.com >
2025-01-28 12:56:55 -05:00
dependabot[bot]
cc80e6106c
chore(deps): bump github/codeql-action from 3.28.5 to 3.28.6 ( #3625 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.5 to 3.28.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4...17a820bf2e43b47be2c72b39cc905417bc1ab6d0 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-28 12:13:18 -05:00
anchore-actions-token-generator[bot] and wagoodman
5b009dbc7b
chore(deps): update CPE dictionary index ( #3620 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-27 10:56:58 -05:00
dependabot[bot]
1a2a7cb59f
chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.8.0 to 4.8.1 ( #3621 )
...
Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar ) from 4.8.0 to 4.8.1.
- [Release notes](https://github.com/bmatcuk/doublestar/releases )
- [Commits](https://github.com/bmatcuk/doublestar/compare/v4.8.0...v4.8.1 )
---
updated-dependencies:
- dependency-name: github.com/bmatcuk/doublestar/v4
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-27 09:57:04 -05:00
dependabot[bot]
27b8296630
chore(deps): bump github/codeql-action from 3.28.4 to 3.28.5 ( #3622 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.4 to 3.28.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ee117c905ab18f32fa0f66c2fe40ecc8013f3e04...f6091c0113d1dcf9b98e269ee48e8a7e51b7bdd4 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-27 09:56:53 -05:00
dependabot[bot]
5ea952e5b2
chore(deps): bump github/codeql-action from 3.28.3 to 3.28.4 ( #3618 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.3 to 3.28.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/dd196fa9ce80b6bacc74ca1c32bd5b0ba22efca7...ee117c905ab18f32fa0f66c2fe40ecc8013f3e04 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-24 09:49:54 -05:00
dependabot[bot]
a5a2b83fe1
chore(deps): bump anchore/sbom-action from 0.17.9 to 0.18.0 ( #3619 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.9 to 0.18.0.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/df80a981bc6edbc4e220a492d3cbe9f5547a6e75...f325610c9f50a54015d37c8d16cb3b0e2c8f4de0 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-24 09:49:46 -05:00
anchore-actions-token-generator[bot] and spiffcs
1c4743fca2
chore(deps): update tools to latest versions ( #3607 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-23 11:28:20 -05:00
dependabot[bot]
a6d7ff69a9
chore(deps): bump github/codeql-action from 3.28.2 to 3.28.3 ( #3608 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.2 to 3.28.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/d68b2d4edb4189fd2a5366ac14e72027bd4b37dd...dd196fa9ce80b6bacc74ca1c32bd5b0ba22efca7 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-23 11:27:47 -05:00
dependabot[bot]
ad83f7c2cb
chore(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.13.2 ( #3609 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.13.1 to 5.13.2.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.13.1...v5.13.2 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-23 11:27:01 -05:00
dependabot[bot]
dffa52f950
chore(deps): bump github.com/docker/docker ( #3610 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.5.0+incompatible to 27.5.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.5.0...v27.5.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-23 11:26:46 -05:00
dependabot[bot]
2abfa4eb36
chore(deps): bump actions/setup-go in /.github/actions/bootstrap ( #3612 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.0.1 to 5.3.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/cdcb36043654635271a94b9a6d1392de5bb323a7...f111f3307d8850f501ac008e886eec1fd1932a34 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-23 11:26:05 -05:00
dependabot[bot]
1814a0aff5
chore(deps): bump actions/cache in /.github/actions/bootstrap ( #3613 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 3.3.2 to 4.2.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/704facf57e6136b1bc63b828d79edcd491f0ee84...1bd1e32a3bdc45362d1e726936510720a7c30a57 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-23 11:25:47 -05:00
Weston Steimel
b7f78a6a8b
chore(ci): fix composite GitHub action path in dependabot config ( #3611 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2025-01-23 14:33:07 +00:00
anchore-actions-token-generator[bot] and spiffcs
222e6548a9
chore(deps): update tools to latest versions ( #3602 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-22 14:44:54 -05:00
dependabot[bot]
0969453dbe
chore(deps): bump github/codeql-action from 3.28.1 to 3.28.2 ( #3604 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.1 to 3.28.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b6a472f63d85b9c78a3ac5e89422239fc15e9b3c...d68b2d4edb4189fd2a5366ac14e72027bd4b37dd )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-22 10:47:57 -05:00
dependabot[bot]
a5ef8167a1
chore(deps): bump github.com/hashicorp/hcl/v2 from 2.22.0 to 2.23.0 ( #3605 )
...
Bumps [github.com/hashicorp/hcl/v2](https://github.com/hashicorp/hcl ) from 2.22.0 to 2.23.0.
- [Release notes](https://github.com/hashicorp/hcl/releases )
- [Changelog](https://github.com/hashicorp/hcl/blob/main/CHANGELOG.md )
- [Commits](https://github.com/hashicorp/hcl/compare/v2.22.0...v2.23.0 )
---
updated-dependencies:
- dependency-name: github.com/hashicorp/hcl/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-22 10:47:47 -05:00
dependabot[bot]
07f0658843
chore(deps): bump github.com/aquasecurity/go-pep440-version ( #3606 )
...
Bumps [github.com/aquasecurity/go-pep440-version](https://github.com/aquasecurity/go-pep440-version ) from 0.0.0-20210121094942-22b2f8951d46 to 0.0.1.
- [Release notes](https://github.com/aquasecurity/go-pep440-version/releases )
- [Commits](https://github.com/aquasecurity/go-pep440-version/commits/v0.0.1 )
---
updated-dependencies:
- dependency-name: github.com/aquasecurity/go-pep440-version
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-22 10:47:38 -05:00
Christopher Angelo Phillips
7f5dbf9872
chore: bump stereoscope to v0.0.13 ( #3601 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 15:50:42 -05:00
c10e904c28
feat(cataloger): add a terraform provider cataloger ( #3378 )
...
* feat(cataloger): add a terraform provider cataloger
* chore: bump schema from 16.0.19 -> 16.0.20
------
Signed-off-by: Thomas Gosteli <thomas.gosteli@protonmail.ch >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-21 14:44:54 -05:00
anchore-actions-token-generator[bot] and spiffcs
1906c179d0
chore(deps): update tools to latest versions ( #3597 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-21 11:44:27 -05:00
anchore-actions-token-generator[bot] and wagoodman
4edfa4d138
chore(deps): update CPE dictionary index ( #3599 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-21 11:43:59 -05:00
dependabot[bot]
a6557d7cec
chore(deps): bump actions/setup-go from 5.2.0 to 5.3.0 ( #3600 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.2.0 to 5.3.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/3041bf56c941b39c61721a86cd11f3bb1338122a...f111f3307d8850f501ac008e886eec1fd1932a34 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-21 11:41:53 -05:00
Dominik Schmidt and Keith Zantow
19a75fe504
feat(golang): add license parsing from vendor dirs ( #3522 )
...
Signed-off-by: Dominik Schmidt <dev@dominik-schmidt.de >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2025-01-17 20:25:05 -05:00
Christopher Angelo Phillips
8198a706d6
chore: bump packageurl-go with new parsing rules ( #3596 )
...
* chore: bump packageurl-go with new parsing rules
* test: update expectedPURL in unit tests to match new % encoding
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-17 16:20:14 -05:00
dependabot[bot]
254a915592
chore(deps): bump marocchino/sticky-pull-request-comment ( #3595 )
...
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) from 2.9.0 to 2.9.1.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/331f8f5b4215f0445d3c07b4967662a32a2d3e31...52423e01640425a022ef5fd42c6fb5f633a02728 )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-17 13:57:21 -05:00
Bert Coppens and Alex Goodman
512319337f
feat: add cataloger for NuGet packages ( #3484 )
...
* add cataloger for dotnet packages.lock.json files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add entry for dotnet packages.lock files
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add unit test for dotnet packages.lock cataloger
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add test for faulty packages.lock.json file
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add missing name metadata
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* ensure package appears with version
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* add example of conflicting dependencies
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump json schema and fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move section
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Kemosabert <bert.coppens14@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-16 14:57:17 -05:00
GGMU
6b2d73d4b7
allow disabling all package catalogers ( #3468 )
...
Signed-off-by: tomersein <tomersein@gmail.com >
2025-01-16 13:03:54 -05:00
dependabot[bot]
c359c76934
chore(deps): bump github.com/google/go-containerregistry ( #3592 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.2 to 0.20.3.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.2...v0.20.3 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-16 12:19:26 -05:00
dependabot[bot]
06a22dd4dc
chore(deps): bump modernc.org/sqlite from 1.34.4 to 1.34.5 ( #3593 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.34.4 to 1.34.5.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.34.4...v1.34.5 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-16 12:19:19 -05:00
anchore-actions-token-generator[bot] and spiffcs
63a026eb8f
chore(deps): update tools to latest versions ( #3582 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-15 17:13:17 -05:00
Alex Mason
436b36916d
chore: update README.md's link to Nixpkgs ( #3578 )
...
Nixpkgs changed the location of packages to ease organisation, this should be the correct link.
Signed-off-by: Alex Mason <github@me.axman6.com >
2025-01-15 17:56:11 +00:00
dependabot[bot]
453b187ca1
chore(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.6 ( #3579 )
...
Bumps [github.com/sanity-io/litter](https://github.com/sanity-io/litter ) from 1.5.5 to 1.5.6.
- [Changelog](https://github.com/sanity-io/litter/blob/main/CHANGELOG.md )
- [Commits](https://github.com/sanity-io/litter/compare/v1.5.5...v1.5.6 )
---
updated-dependencies:
- dependency-name: github.com/sanity-io/litter
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-15 12:42:13 -05:00
dependabot[bot]
86ad570f8d
chore(deps): bump github.com/spf13/afero from 1.11.0 to 1.12.0 ( #3580 )
...
Bumps [github.com/spf13/afero](https://github.com/spf13/afero ) from 1.11.0 to 1.12.0.
- [Release notes](https://github.com/spf13/afero/releases )
- [Commits](https://github.com/spf13/afero/compare/v1.11.0...v1.12.0 )
---
updated-dependencies:
- dependency-name: github.com/spf13/afero
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-15 12:41:59 -05:00
dependabot[bot]
2f08d60ba3
chore(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 ( #3581 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.5.0 to 4.6.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/6f51ac03b9356f520e9adb1b1b7802705f340c2b...65c4c4a1ddee5b72f698fdd19549f0f0fb45cf08 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-15 12:41:07 -05:00
anchore-actions-token-generator[bot] and wagoodman
da62caee3d
chore(deps): update CPE dictionary index ( #3583 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-15 12:11:46 -05:00
dependabot[bot]
2220d708a5
chore(deps): bump github/codeql-action from 3.28.0 to 3.28.1 ( #3584 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.28.0 to 3.28.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/48ab28a6f5dbc2a99bf1e0131198dd8f1df78169...b6a472f63d85b9c78a3ac5e89422239fc15e9b3c )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-15 12:05:19 -05:00
dependabot[bot]
1a9af0db96
chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 ( #3585 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.6.1 to 5.6.2.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.6.1...v5.6.2 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-14 10:57:33 -05:00
dependabot[bot]
b79f9330fc
chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.7.1 to 4.8.0 ( #3586 )
...
Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar ) from 4.7.1 to 4.8.0.
- [Release notes](https://github.com/bmatcuk/doublestar/releases )
- [Commits](https://github.com/bmatcuk/doublestar/compare/v4.7.1...v4.8.0 )
---
updated-dependencies:
- dependency-name: github.com/bmatcuk/doublestar/v4
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-14 10:55:48 -05:00
dependabot[bot]
fbfad5ef35
chore(deps): bump github.com/docker/docker ( #3587 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.4.1+incompatible to 27.5.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.4.1...v27.5.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-14 10:55:38 -05:00
anchore-actions-token-generator[bot] and wagoodman
b4e7b64d5c
chore(deps): update anchore dependencies ( #3571 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-08 17:51:48 +00:00
anchore-actions-token-generator[bot] and spiffcs
b3fc7b3b0a
chore(deps): update tools to latest versions ( #3567 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-07 11:30:26 -05:00
dependabot[bot]
df36303df0
chore(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 ( #3568 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.33.0 to 0.34.0.
- [Commits](https://github.com/golang/net/compare/v0.33.0...v0.34.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-07 11:29:58 -05:00
Keith Zantow
a2a56dd3e9
fix: golang remote license search not executing when error reading local mod dir ( #3549 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2025-01-06 11:47:55 -05:00
anchore-actions-token-generator[bot]
2a8c8ac832
chore(deps): update tools to latest versions ( #3564 )
2025-01-06 11:15:36 -05:00
anchore-actions-token-generator[bot]
dc01c5d052
chore(deps): update CPE dictionary index ( #3565 )
2025-01-06 11:15:13 -05:00
dependabot[bot]
a95244aace
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.7 to 0.5.8 ( #3548 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.7 to 0.5.8.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.7...v0.5.8 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-03 15:23:57 +00:00
anchore-actions-token-generator[bot] and spiffcs
5c429ae834
chore(deps): update tools to latest versions ( #3560 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-03 10:12:02 -05:00
dependabot[bot]
463a8f3661
chore(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 ( #3561 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.13.0 to 5.13.1.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.13.0...v5.13.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-03 10:11:30 -05:00
Alex Goodman
cbce129bb9
Use reader when scanning for package versions over reading entire binary into memory ( #3558 )
...
* use streaming readers
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* replace redis search patterns
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address PR feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2025-01-02 22:12:37 +00:00
dependabot[bot]
470c2ff04c
chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 ( #3551 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.6.0 to 5.6.1.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.6.0...v5.6.1 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-02 21:52:01 +00:00
anchore-actions-token-generator[bot] and spiffcs
1f4a48c3c1
chore(deps): update tools to latest versions ( #3556 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: update build scripts with new architecture suffix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: update suffix for new ppc64 arch
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: lintfix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2025-01-02 16:18:47 -05:00
Christopher Angelo Phillips
f9ffe7252e
test: removes latest license list test ( #3559 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2025-01-02 20:56:44 +00:00
dependabot[bot]
286182a66f
chore(deps): bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 ( #3547 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.5 to 7.0.6.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/5e914681df9dc83aa4e4905692ca88beb2f9e91f...67ccf781d68cd99b580ae25a5c18a1cc84ffff1f )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-02 12:26:49 -05:00
anchore-actions-token-generator[bot] and wagoodman
5c47568362
chore(deps): update CPE dictionary index ( #3550 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2025-01-02 09:25:13 -05:00
dependabot[bot]
52d904363c
chore(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 ( #3552 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.12.0 to 5.13.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.12.0...v5.13.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2025-01-02 09:24:40 -05:00
anchore-actions-token-generator[bot]
25792160fb
chore(deps): update tools to latest versions ( #3543 )
...
* chore(deps): update tools to latest versions
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-12-23 11:32:17 -05:00
anchore-actions-token-generator[bot] and wagoodman
453c429c5c
chore(deps): update CPE dictionary index ( #3544 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-23 09:37:58 -05:00
dependabot[bot]
13e32d3a49
chore(deps): bump modernc.org/sqlite from 1.34.3 to 1.34.4 ( #3545 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.34.3 to 1.34.4.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.34.3...v1.34.4 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-23 09:36:57 -05:00
dependabot[bot]
03dbd38d88
chore(deps): bump github/codeql-action from 3.27.9 to 3.28.0 ( #3546 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.9 to 3.28.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/df409f7d9260372bd5f19e5b04e83cb3c43714ae...48ab28a6f5dbc2a99bf1e0131198dd8f1df78169 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-23 09:36:46 -05:00
dependabot[bot]
a185acdc43
chore(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 ( #3541 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.32.0 to 0.33.0.
- [Commits](https://github.com/golang/net/compare/v0.32.0...v0.33.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-19 11:15:20 -05:00
dependabot[bot]
4822950b06
chore(deps): bump modernc.org/sqlite from 1.34.2 to 1.34.3 ( #3542 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.34.2 to 1.34.3.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.34.2...v1.34.3 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-19 11:15:10 -05:00
dependabot[bot]
2c10b602f0
chore(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 ( #3537 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.4.3 to 4.5.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882...6f51ac03b9356f520e9adb1b1b7802705f340c2b )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-18 13:34:38 -05:00
dependabot[bot]
5120651285
chore(deps): bump github.com/docker/docker ( #3538 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.4.0+incompatible to 27.4.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.4.0...v27.4.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-18 13:34:24 -05:00
anchore-actions-token-generator[bot] and wagoodman
397eb9c10a
chore(deps): update CPE dictionary index ( #3526 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-16 10:37:35 -05:00
dependabot[bot]
adfb6656fd
chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.1 to 0.9.2 ( #3530 )
...
Bumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) from 0.9.1 to 0.9.2.
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Changelog](https://github.com/CycloneDX/cyclonedx-go/blob/master/.goreleaser.yml )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.9.1...v0.9.2 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-16 10:37:19 -05:00
dependabot[bot]
952837dd25
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.4 to 6.6.5 ( #3531 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.4 to 6.6.5.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.4...v6.6.5 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-16 09:29:51 -05:00
dependabot[bot]
4ac8439115
chore(deps): bump anchore/sbom-action from 0.17.8 to 0.17.9 ( #3532 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.8 to 0.17.9.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/55dc4ee22412511ee8c3142cbea40418e6cec693...df80a981bc6edbc4e220a492d3cbe9f5547a6e75 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-16 09:29:08 -05:00
anchore-actions-token-generator[bot] and spiffcs
5e16e5031a
chore(deps): update anchore dependencies ( #3525 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-12-13 13:30:11 -05:00
dependabot[bot]
36016a0c5f
chore(deps): bump github/codeql-action from 3.27.7 to 3.27.9 ( #3524 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.7 to 3.27.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/babb554ede22fd5605947329c4d04d8e7a0b8155...df409f7d9260372bd5f19e5b04e83cb3c43714ae )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-13 10:38:58 -05:00
dependabot[bot]
8dcb495312
chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 ( #3523 )
...
Bumps [golang.org/x/crypto](https://github.com/golang/crypto ) from 0.30.0 to 0.31.0.
- [Commits](https://github.com/golang/crypto/compare/v0.30.0...v0.31.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/crypto
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-12 15:43:40 -05:00
dependabot[bot]
02f9350fa5
chore(deps): bump actions/setup-go from 5.1.0 to 5.2.0 ( #3519 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.1.0 to 5.2.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed...3041bf56c941b39c61721a86cd11f3bb1338122a )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-11 13:14:55 -05:00
dependabot[bot]
20fb9cc00c
chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 ( #3518 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/v4.2.1...11bd71901bbe5b1630ceea73d27597364c9af683 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-11 13:14:25 -05:00
William Murphy
6deb41c458
chore: make fixes field in PR template match auto-close regex ( #3520 )
...
Previously, if filling out this template, someone pasted a PR link after
"Fixes #", the issue wouldn't automatically close, probably because the
extra "#" confused the auto-close regex.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-11 12:37:55 -05:00
William Murphy
445142886e
fix: stop omitting redundantly parenthesized licenses in CDX formatter ( #3517 )
...
Previously, a bug in the formatter would cause SPDX expressions that
were surrounded in redundant parentheses to be dropped instead of
normalized.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-11 10:06:08 -05:00
Christopher Angelo Phillips
561ed50c2d
chore: migrate syft to use the anchore fork of archiver without replace ( #3516 )
...
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-12-10 13:33:24 -05:00
Alex Goodman
d77e78ea9d
Make pre-release integration PRs ( #3370 )
...
* use reusable dep update action
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use workflow that takes multiple repo
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix mispelling
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove taskfile update
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump action to main branch
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename action
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove gh make var
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-12-10 17:14:11 +00:00
dependabot[bot]
0f9d2e5311
chore(deps): bump github.com/docker/docker ( #3512 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.3.1+incompatible to 27.4.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.3.1...v27.4.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-10 10:49:17 -05:00
dependabot[bot]
0dc74a3c37
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.3 to 6.6.4 ( #3513 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.3 to 6.6.4.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.3...v6.6.4 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-10 10:49:05 -05:00
dependabot[bot]
37957b895e
chore(deps): bump github/codeql-action from 3.27.6 to 3.27.7 ( #3514 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.6 to 3.27.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/aa578102511db1f4524ed59b8cc2bae4f6e88195...babb554ede22fd5605947329c4d04d8e7a0b8155 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-10 10:48:52 -05:00
Alex Goodman
d38efb0b7f
chore(deps): update anchore dependencies ( #3510 )
...
* integrate anchore deps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* upgrade to released versions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-12-09 15:51:16 -05:00
Christopher Angelo Phillips
f9e320c5b7
fix: convert file paths for spdx formats from absolute to relative ( #3509 )
...
* feat: convert file paths for spdx formats from absolute to relative
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-12-09 13:02:54 -05:00
anchore-actions-token-generator[bot] and wagoodman
cd0900e758
chore(deps): update CPE dictionary index ( #3507 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-09 09:54:52 -05:00
anchore-actions-token-generator[bot] and spiffcs
064a9712ac
chore(deps): update tools to latest versions ( #3506 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-12-09 09:54:48 -05:00
dependabot[bot]
c43c9df1ba
chore(deps): bump github.com/magiconair/properties from 1.8.7 to 1.8.9 ( #3508 )
...
Bumps [github.com/magiconair/properties](https://github.com/magiconair/properties ) from 1.8.7 to 1.8.9.
- [Release notes](https://github.com/magiconair/properties/releases )
- [Commits](https://github.com/magiconair/properties/compare/v1.8.7...v1.8.9 )
---
updated-dependencies:
- dependency-name: github.com/magiconair/properties
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-09 09:54:12 -05:00
dependabot[bot]
4015f40982
chore(deps): bump actions/cache from 4.1.2 to 4.2.0 ( #3503 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.1.2 to 4.2.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/6849a6489940f00c2f30c0fb92c6274307ccb58a...1bd1e32a3bdc45362d1e726936510720a7c30a57 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-06 15:29:44 -05:00
Alex Goodman
340b5e17f0
Add relationships for rust audit binary packages ( #3500 )
...
* add rust audit binary pkg relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-12-06 09:23:18 -05:00
William Murphy
4adb56d2fe
fix order of rust dependencies and support git sources in Cargo.lock dependencies ( #3502 )
...
* fix: un-reverse Cargo.lock dependencies
Previously, dependencyOf was pointing the wrong way. Use dependency
specification helpers to build the dependency graph.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* feat: parse Cargo.lock git dependency relationships
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-06 13:38:36 +00:00
anchore-actions-token-generator[bot] and spiffcs
d3c9ce532d
chore(deps): update tools to latest versions ( #3501 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-12-06 08:36:54 -05:00
dependabot[bot]
5e22251c86
chore(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 ( #3499 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.31.0 to 0.32.0.
- [Commits](https://github.com/golang/net/compare/v0.31.0...v0.32.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-05 11:36:33 -05:00
William Murphy
25e5d555ef
chore: add and document target for updating unit snapshots ( #3498 )
...
* chore: add and document target for updating unit snapshots
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: rename to reflect narrower scope
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-04 20:21:07 +00:00
48190233f4
fix: emit NOASSERTION for copyright text to fix SPDX 2.2 validation failure ( #3495 )
...
* fixes issue #3346
Signed-off-by: Fearkin <fearjin1@gmail.com >
* chore: update schema and unit tests to reflect new copyright property
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* chore: revert schema changes
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* fix: noassert copyright on spdx root package
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* test: explicitly test spdx 2.2 with tools-java validator
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* test: update snapshot files
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Fearkin <fearjin1@gmail.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
Co-authored-by: Fearkin <fearjin1@gmail.com >
Co-authored-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-12-04 14:58:36 -05:00
anchore-actions-token-generator[bot] and spiffcs
3508e648af
chore(deps): update tools to latest versions ( #3496 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-12-04 10:01:21 -05:00
anchore-actions-token-generator[bot] and spiffcs
1af70d766d
chore(deps): update tools to latest versions ( #3487 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-12-03 11:04:44 -05:00
dependabot[bot]
0c3fa82952
chore(deps): bump github/codeql-action from 3.27.5 to 3.27.6 ( #3494 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.5 to 3.27.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f09c1c0a94de965c15400f5634aa42fac8fb8f88...aa578102511db1f4524ed59b8cc2bae4f6e88195 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-03 11:04:28 -05:00
dependabot[bot]
c3619422bb
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.2 to 6.6.3 ( #3489 )
2024-12-02 16:30:09 +00:00
GGMU
59e943385d
feat: set max layer size ( #3464 )
...
Signed-off-by: tomersein <tomersein@gmail.com >
2024-12-02 11:29:42 -05:00
anchore-actions-token-generator[bot] and wagoodman
0e880e83e6
chore(deps): update CPE dictionary index ( #3491 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-12-02 11:14:28 -05:00
dependabot[bot]
74d58024f6
chore(deps): bump modernc.org/sqlite from 1.34.1 to 1.34.2 ( #3492 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.34.1 to 1.34.2.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.34.1...v1.34.2 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-02 10:47:33 -05:00
dependabot[bot]
a0a62931c8
chore(deps): bump github.com/saferwall/pe from 1.5.5 to 1.5.6 ( #3493 )
...
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe ) from 1.5.5 to 1.5.6.
- [Release notes](https://github.com/saferwall/pe/releases )
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md )
- [Commits](https://github.com/saferwall/pe/compare/v1.5.5...v1.5.6 )
---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-12-02 10:47:21 -05:00
anchore-actions-token-generator[bot] and spiffcs
a320cf76a4
chore(deps): update tools to latest versions ( #3478 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-11-27 10:17:54 -05:00
anchore-actions-token-generator[bot] and wagoodman
ec5f3169db
chore(deps): update CPE dictionary index ( #3479 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-27 10:17:34 -05:00
dependabot[bot]
bbc292ecc0
chore(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 ( #3480 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.9.0 to 1.10.0.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.9.0...v1.10.0 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-27 10:17:19 -05:00
dependabot[bot]
b8d3dd3039
chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.3 to 1.2.4 ( #3482 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.2.3 to 1.2.4.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.3...v1.2.4 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-27 10:17:10 -05:00
anchore-actions-token-generator[bot] and kzantow
9f1e91e72e
chore(deps): update stereoscope to be5deed44b7c03fcbfa6f1f42fb67202d31636a9 ( #3483 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-11-27 10:17:00 -05:00
witchcraze
2118295f19
fix: dart classifier for 2.x and ARM ( #3475 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-11-22 13:05:09 -05:00
Adam McClenaghan
21df38798e
Use file indexer directly when scanning with file source ( #3333 )
...
* Use file indexer when scanning with file source
Prevents filesystem walks when scanning a single file, to
optimise memory & scan times in case the scanned file
lives in a directory containing many files.
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
* Create filetree resolver
Shared behaviour for resolving indexed filetrees.
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
---------
Signed-off-by: adammcclenaghan <adam@mcclenaghan.co.uk >
2024-11-22 11:53:53 -05:00
dependabot[bot]
8abd97a5bf
chore(deps): bump anchore/sbom-action from 0.17.7 to 0.17.8 ( #3476 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.7 to 0.17.8.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/fc46e51fd3cb168ffb36c6d1915723c47db58abb...55dc4ee22412511ee8c3142cbea40418e6cec693 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-22 11:18:05 -05:00
dependabot[bot]
05c09fd73d
chore(deps): bump github/codeql-action from 3.27.4 to 3.27.5 ( #3473 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.4 to 3.27.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ea9e4e37992a54ee68a9622e985e60c8e8f12d9f...f09c1c0a94de965c15400f5634aa42fac8fb8f88 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-21 15:14:27 -05:00
anchore-actions-token-generator[bot] and willmurphyscode
a8d4202d77
chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a ( #3472 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2024-11-21 14:28:51 +00:00
dependabot[bot]
19a30b9fd2
chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.2 to 1.2.3 ( #3467 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.2.2 to 1.2.3.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.2...v1.2.3 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-20 08:32:30 -05:00
William Murphy
e65fe243bf
fix: bump clio to pull in logging fix ( #3466 )
...
Previously, if SYFT_LOG_FILE was not set, and no TTY was present,
log.Warn messages were discarded instead of being sent to stderr.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-11-19 14:56:53 -05:00
Christopher Angelo Phillips
f4cad63da1
3122 valid license url characters ( #3449 )
...
* chore: strip unwanted characters from license URL
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-11-19 15:34:58 +00:00
Christopher Angelo Phillips
e7b65c2c58
3030 license declared spdx correction ( #3461 )
...
* feat: update hasExtractedLicense field to include license-ref candidates
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-11-19 15:00:59 +00:00
anchore-actions-token-generator[bot] and spiffcs
8aef0c908a
chore(deps): update tools to latest versions ( #3463 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-11-19 09:36:46 -05:00
dependabot[bot]
35fa0cc454
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.1 to 6.6.2 ( #3465 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.1 to 6.6.2.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.1...v6.6.2 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-19 09:36:32 -05:00
dependabot[bot]
1c61e9cbff
chore(deps): bump modernc.org/sqlite from 1.33.1 to 1.34.1 ( #3460 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.33.1 to 1.34.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.33.1...v1.34.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-18 09:33:08 -05:00
anchore-actions-token-generator[bot] and wagoodman
d91150edea
chore(deps): update CPE dictionary index ( #3453 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-18 08:33:41 -05:00
anchore-actions-token-generator[bot] and spiffcs
215ae2bbb9
chore(deps): update tools to latest versions ( #3454 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-11-18 08:33:23 -05:00
anchore-actions-token-generator[bot] and spiffcs
93d90cb10a
chore(deps): update tools to latest versions ( #3448 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-11-17 12:32:11 -05:00
anchore-actions-token-generator[bot] and spiffcs
70ef3f25df
chore(deps): update tools to latest versions ( #3444 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-11-15 09:36:21 -05:00
dependabot[bot]
e41f8dfa04
chore(deps): bump github/codeql-action from 3.27.3 to 3.27.4 ( #3446 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.3 to 3.27.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/396bb3e45325a47dd9ef434068033c6d5bb0d11a...ea9e4e37992a54ee68a9622e985e60c8e8f12d9f )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-15 09:35:59 -05:00
William Murphy
bc35345afb
feat: emit dependency relationships found in Cargo.lock ( #3443 )
...
* feat: emit dependency relationships found in Cargo.lock
Include updating test Cargo.lock to have dependencies on multiple
versions of the same crate.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-11-14 16:45:00 -05:00
anchore-actions-token-generator[bot] and kzantow
926486a7c3
chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a ( #3442 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-11-14 13:13:04 -05:00
dependabot[bot]
a15c5f61f4
chore(deps): bump github/codeql-action from 3.27.2 to 3.27.3 ( #3438 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.2 to 3.27.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/9278e421667d5d90a2839487a482448c4ec7df4d...396bb3e45325a47dd9ef434068033c6d5bb0d11a )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-14 05:32:26 -05:00
dependabot[bot]
94dd634a97
chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.1 to 1.2.2 ( #3439 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.2.1 to 1.2.2.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.2.1...v1.2.2 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-14 05:31:39 -05:00
dependabot[bot]
5624d48e25
chore(deps): bump github.com/saferwall/pe from 1.5.4 to 1.5.5 ( #3440 )
...
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe ) from 1.5.4 to 1.5.5.
- [Release notes](https://github.com/saferwall/pe/releases )
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md )
- [Commits](https://github.com/saferwall/pe/compare/v1.5.4...v1.5.5 )
---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-14 05:31:21 -05:00
ac8be4ad41
chore(deps): update tools to latest versions ( #3413 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-11-12 15:53:27 +00:00
dependabot[bot]
abd6abe186
chore(deps): bump github/codeql-action from 3.27.1 to 3.27.2 ( #3436 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.1 to 3.27.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4f3212b61783c3c68e8309a0f18a699764811cda...9278e421667d5d90a2839487a482448c4ec7df4d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-12 13:50:25 +00:00
dependabot[bot]
51872403d1
chore(deps): bump golang.org/x/mod from 0.21.0 to 0.22.0 ( #3426 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.21.0 to 0.22.0.
- [Commits](https://github.com/golang/mod/compare/v0.21.0...v0.22.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-12 13:48:39 +00:00
witchcraze
066aadb4d1
update node classifier ( #3419 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-11-12 08:38:43 -05:00
anchore-actions-token-generator[bot] and kzantow
e463206349
chore(deps): update stereoscope to 120d9ea511e2f7a9887b443c52e66cd19bb80b43 ( #3424 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-11-12 08:37:14 -05:00
anchore-actions-token-generator[bot] and wagoodman
7c6483f84a
chore(deps): update CPE dictionary index ( #3429 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-12 08:36:41 -05:00
dependabot[bot]
013a2fe340
chore(deps): bump github/codeql-action from 3.27.0 to 3.27.1 ( #3431 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.27.0 to 3.27.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/662472033e021d55d94146f66f6058822b0b39fd...4f3212b61783c3c68e8309a0f18a699764811cda )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-12 08:36:01 -05:00
dependabot[bot]
6e7c198ae7
chore(deps): bump golang.org/x/net from 0.30.0 to 0.31.0 ( #3432 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.30.0 to 0.31.0.
- [Commits](https://github.com/golang/net/compare/v0.30.0...v0.31.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-12 08:35:41 -05:00
dependabot[bot]
8a7da599fc
chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.2 to 1.2.1 ( #3433 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.1.2 to 1.2.1.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.1.2...v1.2.1 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-12 08:35:15 -05:00
Alex Goodman
b0bffef1a2
restore log on ui teardown ( #3427 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-11-08 12:31:38 -05:00
Alan Pope
3c070e0ad9
doc: Add official Syft logo license information ( #3421 )
...
This clarifies the license under which the Syft "owl" logo is released. This is necessary to enable us to share the logo in certain online communities.
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2024-11-07 14:23:57 +00:00
dependabot[bot]
defb08d120
chore(deps): bump anchore/sbom-action from 0.17.6 to 0.17.7 ( #3418 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.6 to 0.17.7.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/251a468eed47e5082b105c3ba6ee500c0e65a764...fc46e51fd3cb168ffb36c6d1915723c47db58abb )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-06 10:41:45 -05:00
Keith Zantow
16eedd81ec
chore: build release sbom from go.mod ( #3417 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-11-05 09:51:23 -05:00
Christopher Angelo Phillips and Keith Zantow
8a41d77250
chore: prevent file resolver from bubbling errors in binary cataloger ( #3410 )
...
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-11-04 20:23:27 +00:00
anchore-actions-token-generator[bot] and kzantow
eb56f2e4bb
chore(deps): update stereoscope to cbd43fb4e5d348fe680066ee6329385fd6a4f827 ( #3411 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-11-04 10:20:27 -05:00
anchore-actions-token-generator[bot] and wagoodman
849e325408
chore(deps): update CPE dictionary index ( #3414 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-11-04 10:13:22 -05:00
dependabot[bot]
203df65a65
chore(deps): bump github.com/adrg/xdg from 0.5.2 to 0.5.3 ( #3408 )
...
Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg ) from 0.5.2 to 0.5.3.
- [Release notes](https://github.com/adrg/xdg/releases )
- [Commits](https://github.com/adrg/xdg/compare/v0.5.2...v0.5.3 )
---
updated-dependencies:
- dependency-name: github.com/adrg/xdg
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-01 11:43:54 -04:00
dependabot[bot]
2c70090d10
chore(deps): bump github.com/charmbracelet/lipgloss from 0.13.1 to 1.0.0 ( #3409 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.13.1 to 1.0.0.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.13.1...v1.0.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-11-01 11:43:47 -04:00
anchore-actions-token-generator[bot] and kzantow
8f179e6961
chore(deps): update stereoscope to 2ce1e520983b1c21d5150d7fae2b39e8e5ab9063 ( #3405 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-11-01 11:43:39 -04:00
Artemii
6a1e3f32fe
Issue #3143 – fixed format conversion docs link ( #3407 )
...
* chore: fixed format conversion docs link (#3143 )
Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com >
* changed link to wiki docs
Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com >
---------
Signed-off-by: Artemii Fedotov <artemii.fedotov@tutamail.com >
2024-11-01 11:43:00 -04:00
Joel Rudsberg
fcf1350a0e
feat: support dependencies and purl for Native Image SBOMs ( #3399 )
...
Signed-off-by: Joel Rudsberg <joel.rudsberg@oracle.com >
2024-10-31 12:12:54 -04:00
anchore-actions-token-generator[bot] and kzantow
9302e20d62
chore(deps): update stereoscope to 9c92fe30492ffeba14ed2e23ad1fd923341dda4f ( #3398 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-10-31 10:22:14 -04:00
Nathan Voss and Keith Zantow
a55b71d4ef
feat: exclude devDependencies from package-lock.json parsing ( #3371 )
...
Signed-off-by: Nathan Voss <njvoss299@gmail.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-10-30 12:02:27 -04:00
dependabot[bot]
df3998b4f1
chore(deps): bump github.com/adrg/xdg from 0.5.1 to 0.5.2 ( #3394 )
2024-10-29 16:32:14 +00:00
dependabot[bot]
9dc9be645a
chore(deps): bump anchore/sbom-action from 0.17.5 to 0.17.6 ( #3393 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.5 to 0.17.6.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/1ca97d9028b51809cf6d3c934c3e160716e1b605...251a468eed47e5082b105c3ba6ee500c0e65a764 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-29 10:07:28 -04:00
Keith Zantow
798c18a698
fix: stack overflow in spyingIoReadCloser ( #3392 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-29 08:23:57 -04:00
Keith Zantow
1118ac4ace
fix: bad pom files may cause infinite loop ( #3391 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-28 18:09:04 -04:00
anchore-actions-token-generator[bot] and willmurphyscode
55cc1877ef
chore(deps): update stereoscope to bcc40c6817524718277256d6b774ce643f98640a ( #3388 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2024-10-28 19:48:04 +00:00
dependabot[bot]
367c699585
chore(deps): bump actions/setup-go from 5.0.2 to 5.1.0 ( #3384 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.0.2 to 5.1.0.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32...41dfa10bad2bb2ae585af6ee5bb4d7d973ad74ed )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-28 14:09:45 -04:00
dependabot[bot]
46445ff29f
chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.1 to 1.1.2 ( #3385 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.1.1 to 1.1.2.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.1.1...v1.1.2 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-28 14:08:44 -04:00
anchore-actions-token-generator[bot] and spiffcs
5faa6d34d5
chore(deps): update tools to latest versions ( #3383 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-10-28 14:08:14 -04:00
anchore-actions-token-generator[bot] and wagoodman
c7c036660c
chore(deps): update CPE dictionary index ( #3387 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-28 08:03:08 -04:00
dependabot[bot]
a0c62da747
chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 ( #3380 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.2.1 to 4.2.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871...11bd71901bbe5b1630ceea73d27597364c9af683 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-24 10:35:47 -04:00
Keith Zantow
759b898df5
feat: multi-level configuration and profiles ( #3337 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-23 12:15:59 -04:00
Keith Zantow
a00533c836
feat: Java dependency graph information ( #3363 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-10-23 11:17:34 -04:00
Nathan Voss
b505317e10
Expanded dpkg cataloger globs ( #3373 )
...
Signed-off-by: Nathan Voss <njvoss299@gmail.com >
2024-10-23 14:59:28 +00:00
Ariel Miculas-Trif
06d300e662
Enable cargo-auditable-binary-cataloger for files/directories ( #3376 )
...
Especially when scanning a single binary file, the
cargo-auditable-binary-cataloger should run and report the rust binary's
dependencies:
```
scan --select-catalogers rust <binary_file>
```
This is in line with other binary catalogers, such as the
go-module-binary-cataloger.
Signed-off-by: Ariel Miculas-Trif <amiculas@cisco.com >
2024-10-23 14:55:04 +00:00
dependabot[bot]
80333d39e3
chore(deps): bump github/codeql-action from 3.26.13 to 3.27.0 ( #3374 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.13 to 3.27.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f779452ac5af1c261dce0346a8f964149f49322b...662472033e021d55d94146f66f6058822b0b39fd )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-23 10:47:12 -04:00
dependabot[bot]
11335466b6
chore(deps): bump github.com/charmbracelet/lipgloss ( #3375 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.13.0 to 0.13.1.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.13.0...v0.13.1 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-23 10:46:52 -04:00
anchore-actions-token-generator[bot] and wagoodman
260d80974f
chore(deps): update stereoscope to 6db3c175f1f836e552b01ee70e5d5528cc04bce4 ( #3362 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-22 12:23:29 -04:00
dependabot[bot]
fc524a0565
chore(deps): bump actions/cache from 4.1.1 to 4.1.2 ( #3364 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/3624ceb22c1c5a301c8db4169662070a689d9ea8...6849a6489940f00c2f30c0fb92c6274307ccb58a )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-22 12:23:13 -04:00
dependabot[bot]
b5cde1304b
chore(deps): bump anchore/sbom-action from 0.17.4 to 0.17.5 ( #3365 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.4 to 0.17.5.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/8d0a6505bf28ced3e85154d13dc6af83299e13f1...1ca97d9028b51809cf6d3c934c3e160716e1b605 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-22 12:22:27 -04:00
dependabot[bot]
6a2898e00d
chore(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 ( #3367 )
...
Bumps [github.com/go-git/go-billy/v5](https://github.com/go-git/go-billy ) from 5.5.0 to 5.6.0.
- [Release notes](https://github.com/go-git/go-billy/releases )
- [Commits](https://github.com/go-git/go-billy/compare/v5.5.0...v5.6.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-billy/v5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-22 12:22:19 -04:00
Alex Goodman
e4e985b9b0
Create single license scanner for all catalogers ( #3348 )
...
* add single license scanner instance
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* rename testing license scanner
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-21 16:17:12 +00:00
anchore-actions-token-generator[bot] and kzantow
14355aac21
chore(deps): update stereoscope to a38c93517fc7d67ca1af826ac529a06c05b571d2 ( #3357 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-10-21 10:05:43 -04:00
anchore-actions-token-generator[bot] and wagoodman
e38825a0a2
chore(deps): update CPE dictionary index ( #3358 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-21 10:04:25 -04:00
dependabot[bot]
5a37b4a996
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.0 to 6.6.1 ( #3361 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.6.0 to 6.6.1.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.6.0...v6.6.1 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-21 14:02:07 +00:00
Alex Goodman
56dbb342ef
update to latest packageurl-go ( #3347 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-18 14:47:02 -04:00
anchore-actions-token-generator[bot] and spiffcs
3267545097
chore(deps): update tools to latest versions ( #3342 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-10-17 10:05:38 -04:00
anchore-actions-token-generator[bot] and kzantow
7adbdfe624
chore(deps): update stereoscope to 9e57bce5efeb0ffe27770dd0b8eb2eef8b38512f ( #3338 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-10-17 10:05:18 -04:00
dependabot[bot]
f2646d0156
chore(deps): bump github.com/adrg/xdg from 0.5.0 to 0.5.1 ( #3344 )
...
Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg ) from 0.5.0 to 0.5.1.
- [Release notes](https://github.com/adrg/xdg/releases )
- [Commits](https://github.com/adrg/xdg/compare/v0.5.0...v0.5.1 )
---
updated-dependencies:
- dependency-name: github.com/adrg/xdg
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-17 09:58:16 -04:00
Weston Steimel
5b9601d9c6
fix: use official CPE for linux kernel ( #3343 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-10-17 12:01:40 +00:00
dependabot[bot]
80c8bc1afb
chore(deps): bump anchore/sbom-action from 0.17.3 to 0.17.4 ( #3340 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.3 to 0.17.4.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/f5e124a5e5e1d497a692818ae907d3c45829d033...8d0a6505bf28ced3e85154d13dc6af83299e13f1 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-16 12:44:07 -04:00
Weston Steimel
d7194bb00f
fix: improve mariadb binary classifer to detect older versions ( #3339 )
...
With older versions of mariadb the binary name was `mysql`, so this
adjusts the binary classifier to additionally search for the expected
version pattern in `mysql` binaries.
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-10-16 12:43:50 -04:00
William Murphy
754cebee64
fix: stop some log.Warn spam due parsing an empty string as a CPE ( #3330 )
...
* chore: don't try to parse empty string as CPE
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
* chore: improve OS name and version extraction from ELF metadata
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-10-15 08:50:47 -04:00
anchore-actions-token-generator[bot] and willmurphyscode
138c6e3420
chore(deps): update stereoscope to 1cc8a41d447d0d092699be2b700b8ba62e870434 ( #3334 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2024-10-15 12:45:07 +00:00
anchore-actions-token-generator[bot] and willmurphyscode
5c0df6386f
chore(deps): update stereoscope to 1cc8a41d447d0d092699be2b700b8ba62e870434 ( #3332 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2024-10-14 21:37:26 +00:00
anchore-actions-token-generator[bot] and willmurphyscode
7c69367b65
chore(deps): update stereoscope to 93f8a11331e3d50f751e4d0ec5b63f3df309e9e5 ( #3331 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: willmurphyscode <12529630+willmurphyscode@users.noreply.github.com >
2024-10-14 20:03:16 +00:00
dependabot[bot]
39146aaf62
chore(deps): bump anchore/sbom-action from 0.17.2 to 0.17.3 ( #3326 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.2 to 0.17.3.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Changelog](https://github.com/anchore/sbom-action/blob/main/RELEASE.md )
- [Commits](https://github.com/anchore/sbom-action/compare/61119d458adab75f756bc0b9e4bde25725f86a7a...f5e124a5e5e1d497a692818ae907d3c45829d033 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-14 11:46:47 -04:00
dependabot[bot]
67faca4208
chore(deps): bump github/codeql-action from 3.26.12 to 3.26.13 ( #3327 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.12 to 3.26.13.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/c36620d31ac7c881962c3d9dd939c40ec9434f2b...f779452ac5af1c261dce0346a8f964149f49322b )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-14 14:06:08 +00:00
anchore-actions-token-generator[bot] and wagoodman
f6e5405eb8
chore(deps): update CPE dictionary index ( #3323 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-14 09:42:20 -04:00
Weston Steimel
e962c10da7
fix: improve go binary semver extraction for traefik ( #3325 )
...
Improves the go cataloger semver extraction logic to include getting the
release version of traefik. This is based off of the regex pattern that
already existed in the traefik binary classifier.
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-10-14 09:41:34 -04:00
anchore-actions-token-generator[bot] and kzantow
8095f7b8c1
chore(deps): update stereoscope to 92e97a1cf36d162bad51ccc6aba0cce7a4dcfbf4 ( #3322 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-10-13 10:53:58 -04:00
anchore-actions-token-generator[bot] and kzantow
84877369e5
chore(deps): update stereoscope to c04af061af62ab3ba6ab6760613526eaa7fcb163 ( #3319 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-10-11 12:30:20 -04:00
dependabot[bot]
6124d72a29
chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.6.1 to 4.7.0 ( #3321 )
...
Bumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar ) from 4.6.1 to 4.7.0.
- [Release notes](https://github.com/bmatcuk/doublestar/releases )
- [Commits](https://github.com/bmatcuk/doublestar/compare/v4.6.1...v4.7.0 )
---
updated-dependencies:
- dependency-name: github.com/bmatcuk/doublestar/v4
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-11 10:09:14 -04:00
dependabot[bot]
c2c8c793d2
chore(deps): bump actions/upload-artifact from 4.4.1 to 4.4.3 ( #3314 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.4.1 to 4.4.3.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/604373da6381bf24206979c74d06a550515601b9...b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-11 05:17:35 -04:00
Alex Goodman
fbff87fc6d
shorten release docs ( #3318 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-11 05:17:01 -04:00
William Murphy
0c71bf23c5
docs: clearer deprecation message for --file ( #3310 )
...
It's not clear to users that they shoudl use --output FORMAT=PATH
instead of --file. Directly suggest the FORMAT=PATH syntax.
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-10-10 13:11:45 -04:00
Alan Pope
b62b0cb800
[docs] Add mastodon link to README.md ( #3306 )
...
Hello friends.
This follows the same pattern as the other badges at the top of the readme. It adds the mastodon link to the Syft account.
This also means that the link back here from the Mastodon account's profile page will show as 'Validated' once landed, which gives more authenticity to the account.
Signed-off-by: Alan Pope <alan.pope@anchore.com >
2024-10-10 15:28:55 +01:00
anchore-actions-token-generator[bot]
223a52d07e
chore(deps): update stereoscope to 5bc91bf166769e43d8d0f86c02e877c55eb04aed ( #3313 )
2024-10-10 06:03:55 -04:00
dependabot[bot]
5d068f30c0
chore(deps): bump actions/cache from 4.1.0 to 4.1.1 ( #3312 )
2024-10-10 06:01:06 -04:00
dependabot[bot]
5d165e0230
chore(deps): bump github/codeql-action from 3.26.11 to 3.26.12 ( #3307 )
2024-10-09 08:07:36 -04:00
dependabot[bot]
56ed131247
chore(deps): bump actions/checkout from 4.2.0 to 4.2.1 ( #3308 )
2024-10-09 08:07:14 -04:00
dependabot[bot]
37c179b530
chore(deps): bump actions/upload-artifact from 4.4.0 to 4.4.1 ( #3309 )
2024-10-09 08:06:49 -04:00
Keith Zantow and Alex Goodman
ccbee94b87
feat: report unknowns in sbom ( #2998 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-07 16:11:37 -04:00
dependabot[bot]
4d7ed9f749
chore(deps): bump sigstore/cosign-installer from 3.6.0 to 3.7.0 ( #3299 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.6.0 to 3.7.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.6.0...v3.7.0 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-07 15:21:34 -04:00
anchore-actions-token-generator[bot] and kzantow
4c4e5cb06c
chore(deps): update stereoscope to efa76446cc1c7e6c4117350943a2754b2453aec4 ( #3301 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-10-07 15:21:26 -04:00
dependabot[bot]
8b6159dbd8
chore(deps): bump golang.org/x/net from 0.29.0 to 0.30.0 ( #3304 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.29.0 to 0.30.0.
- [Commits](https://github.com/golang/net/compare/v0.29.0...v0.30.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-07 15:20:38 -04:00
dependabot[bot]
7b30ce15d7
chore(deps): bump actions/cache from 4.0.2 to 4.1.0 ( #3305 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.0.2 to 4.1.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/0c45773b623bea8c8e75f6c82b208c3cf94ea4f9...2cdf405574d6ef1f33a1d12acccd3ae82f47b3f2 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-07 15:20:29 -04:00
anchore-actions-token-generator[bot] and wagoodman
27ee203495
chore(deps): update CPE dictionary index ( #3302 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-07 15:20:12 -04:00
Piotr Radkowski and Piotr Radkowski
3b9c55d28b
Fix: Parse package.json with non-standard fields in 'author' section ( #3300 )
...
* Improved parsing of package.json 'author' section
Signed-off-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com >
* test: parse 'package.json' files with non-standard fields in author section
Signed-off-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com >
---------
Signed-off-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com >
Co-authored-by: Piotr Radkowski <piotr.radkowski@contractors.roche.com >
2024-10-07 10:26:04 -04:00
dependabot[bot]
25f5c6729f
chore(deps): bump github/codeql-action from 3.26.10 to 3.26.11 ( #3298 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.10 to 3.26.11.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e2b3eafc8d227b0241d48be5f425d47c2d750a13...6db8d6351fd0be61f9ed8ebd12ccd35dcec51fea )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-05 09:25:01 -04:00
William Murphy
0d457142cc
chore: add pull request template ( #3294 )
...
Signed-off-by: Will Murphy <willmurphyscode@users.noreply.github.com >
2024-10-05 09:05:11 -04:00
anchore-actions-token-generator[bot] and spiffcs
fc8457418a
chore(deps): update tools to latest versions ( #3296 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-10-05 07:32:32 -04:00
Alex Goodman
13c6876906
Track supporting DPKG evidence ( #3228 )
...
* add dpkg evidence support
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use path over filepath
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-10-04 11:07:29 -04:00
William Murphy and Christopher Phillips
770fdc53ea
Fix: make failed CPE validation correctly return error ( #2762 )
...
* Test CPE attributes correctly returns error
Previously, this method incorrectly return an empty Attributes object
and a nil error, leading to callers attempting to use the empty
attributes object.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: merge with main and refactor call that relied on old nil behavior
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* test: add test to cover new OSCPE err pattern
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-10-03 16:42:57 -04:00
dependabot[bot]
32c0d1e673
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.9 to 6.6.0 ( #3293 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.9 to 6.6.0.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.9...v6.6.0 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-03 10:14:13 -04:00
witchcraze
263ea6b1bb
feat: update haproxy classifier ( #3277 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-10-02 15:10:39 -04:00
anchore-actions-token-generator[bot] and spiffcs
cc4f62b3d4
chore(deps): update tools to latest versions ( #3291 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-10-02 09:07:25 -04:00
Niv Govrin
dbad17de9e
fix: don't use builtin scanner in licensecheck ( #3290 )
...
Signed-off-by: Niv Govrin <nivgo@oligosecurity.io >
2024-10-01 13:53:54 -04:00
anchore-actions-token-generator[bot] and wagoodman
93beceb4a2
chore(deps): update CPE dictionary index ( #3288 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-10-01 10:50:15 -04:00
dependabot[bot]
9b242b0309
chore(deps): bump github/codeql-action from 3.26.9 to 3.26.10 ( #3289 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.9 to 3.26.10.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/461ef6c76dfe95d5c364de2f431ddbd31a417628...e2b3eafc8d227b0241d48be5f425d47c2d750a13 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-10-01 10:48:46 -04:00
witchcraze
f5f8005fe0
update redis classifier ( #3281 )
...
* update redis classifier
Signed-off-by: witchcraze <witchcraze@gmail.com >
* Remove snippets to pass Validation.
In this case, 9000 byte was required...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-09-30 15:37:47 -04:00
witchcraze
2a3d171c10
fix: improve node classifier version matching ( #3284 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-09-27 08:53:35 -04:00
witchcraze
1a746b2c05
fix: update ruby classifier for -rc, -dev, etc. versions ( #3285 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-09-27 08:51:50 -04:00
anchore-actions-token-generator[bot] and wagoodman
e37c4686c2
chore(deps): update CPE dictionary index ( #3262 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-09-26 13:49:18 -04:00
dependabot[bot]
5393cd5dec
chore(deps): bump github.com/docker/docker ( #3264 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.3.0+incompatible to 27.3.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.3.0...v27.3.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-26 13:49:02 -04:00
dependabot[bot]
f9ef9cf1dc
chore(deps): bump github/codeql-action from 3.26.8 to 3.26.9 ( #3275 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.8 to 3.26.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/294a9d92911152fe08befb9ec03e240add280cb3...461ef6c76dfe95d5c364de2f431ddbd31a417628 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-26 13:48:45 -04:00
anchore-actions-token-generator[bot] and kzantow
16122eb32d
chore(deps): update stereoscope to dc10ea61fd18efa45b516eda4de8bc19d8322429 ( #3280 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-09-26 13:48:33 -04:00
dependabot[bot]
39b2bf5518
chore(deps): bump actions/checkout from 4.1.7 to 4.2.0 ( #3283 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.7 to 4.2.0.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/692973e3d937129bcbf40652eb9f2f61becf3332...d632683dd7b4114ad314bca15554477dd762a938 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-26 13:48:12 -04:00
Alex Goodman
d7005d7d8c
add awaiting response management ( #3272 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-25 08:56:21 -04:00
Christian Dupuis
92c1ddec5a
fix: correct excluded mount point comparison to file paths ( #3269 )
...
Signed-off-by: Christian Dupuis <cd@docker.com >
2024-09-24 17:05:16 -04:00
Alex Goodman
01de99b253
Add JVM cataloger ( #3217 )
...
* add jvm cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify version selection
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* CPEs from JVM cataloger should be declared
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure package overlap is enabled for sensitive use cases
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more permissive glob
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-23 17:21:38 -04:00
Laurent Goderre
7815d8e4d9
feat: classifier for Dart lang binaries ( #3265 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-23 14:21:31 -04:00
Alex Goodman
963ea594c8
Add compliance policy for empty name and version ( #3257 )
...
* add policy for empty name and version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* default stub version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* modifying ids requires augmenting relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-20 12:50:47 -04:00
dependabot[bot]
60bbd24031
chore(deps): bump github.com/github/go-spdx/v2 from 2.3.1 to 2.3.2 ( #3254 )
...
Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) from 2.3.1 to 2.3.2.
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.3.1...v2.3.2 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-20 10:50:16 -04:00
dependabot[bot]
7c12e3f3b3
chore(deps): bump peter-evans/create-pull-request from 7.0.3 to 7.0.5 ( #3255 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.3 to 7.0.5.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/6cd32fd93684475c31847837f87bb135d40a2b79...5e914681df9dc83aa4e4905692ca88beb2f9e91f )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-20 10:50:03 -04:00
dependabot[bot]
9b5cf1db51
chore(deps): bump github/codeql-action from 3.26.7 to 3.26.8 ( #3256 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.7 to 3.26.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8214744c546c1e5c8f03dde8fab3a7353211988d...294a9d92911152fe08befb9ec03e240add280cb3 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-20 10:49:55 -04:00
anchore-actions-token-generator[bot] and spiffcs
a08ea86aa6
chore(deps): update tools to latest versions ( #3259 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-09-20 10:49:37 -04:00
dependabot[bot]
98c96ce361
chore(deps): bump github.com/docker/docker ( #3260 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.2.1+incompatible to 27.3.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.2.1...v27.3.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-20 10:49:22 -04:00
6a95a5f2ed
feat: add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and sqlcipher ( #3252 )
...
* feat: detect lighttpd binaries
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* feat: detect proftpd binaries
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* feat: detect zstd binaries
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* feat: detect xz utils binarie
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* feat: detect gzip binaries
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* feat: detect sqlcipher binaries
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* feat: detect jq binaries
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
* add tests + snippets
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Krystian Gorny <krystian.gorny@wipotec.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Krystian Gorny <krystian.gorny@wipotec.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-19 13:21:02 +00:00
Krystian G. and Gorny Krystian
cb0de97bc3
fix: capture-snippet.sh can handle leading whitespaces now ( #3249 ) ( #3250 )
...
Signed-off-by: Gorny Krystian <krystian.gorny@wipotec.com >
Co-authored-by: Gorny Krystian <krystian.gorny@wipotec.com >
2024-09-19 09:15:54 -04:00
anchore-actions-token-generator[bot] and spiffcs
50016c3172
chore(deps): update tools to latest versions ( #3251 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-09-19 09:15:12 -04:00
anchore-actions-token-generator[bot] and spiffcs
a2f12fef0c
chore(deps): update tools to latest versions ( #3247 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-09-18 13:13:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
7934696463
chore(deps): update tools to latest versions ( #3243 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-09-17 12:30:07 -04:00
dependabot[bot]
b9efac4d78
chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.0 to 0.9.1 ( #3242 )
...
Bumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) from 0.9.0 to 0.9.1.
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Changelog](https://github.com/CycloneDX/cyclonedx-go/blob/master/.goreleaser.yml )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.9.0...v0.9.1 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-16 11:54:12 -04:00
dependabot[bot]
48c1c45d12
chore(deps): bump github/codeql-action from 3.26.6 to 3.26.7 ( #3241 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.6 to 3.26.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4dd16135b69a43b6c8efb853346f8437d92d3c93...8214744c546c1e5c8f03dde8fab3a7353211988d )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-16 11:54:01 -04:00
dependabot[bot]
9cc3641ac6
chore(deps): bump peter-evans/create-pull-request from 7.0.2 to 7.0.3 ( #3240 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.2 to 7.0.3.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/d121e62763d8cc35b5fb1710e887d6e69a52d3a4...6cd32fd93684475c31847837f87bb135d40a2b79 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-16 11:53:51 -04:00
anchore-actions-token-generator[bot] and spiffcs
7b4feb7c16
chore(deps): update tools to latest versions ( #3231 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-09-16 09:09:11 -04:00
anchore-actions-token-generator[bot] and wagoodman
41e9630409
chore(deps): update CPE dictionary index ( #3232 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-09-16 09:08:50 -04:00
anchore-actions-token-generator[bot] and spiffcs
58100fec9f
chore(deps): update tools to latest versions ( #3205 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: disable gosec(G115)
A change to the rule gosec(G115) made a large amount of FP for gosec appear when updating to the
latest golang-ci linter.
https://github.com/securego/gosec/issues/1185
https://github.com/securego/gosec/pull/1149
We're going to ignore this rule for the time being while waiting for gosec to get updates so that
bound checking and example snippets of `valid` code is added for this rule
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-09-13 15:05:50 -04:00
dependabot[bot]
834027e32d
chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.0 to 1.1.1 ( #3225 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/main/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v1.1.0...v1.1.1 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-13 13:51:17 -04:00
dependabot[bot]
2b4d5c275f
chore(deps): bump peter-evans/create-pull-request from 7.0.1 to 7.0.2 ( #3226 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.1 to 7.0.2.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/8867c4aba1b742c39f8d0ba35429c2dfa4b6cb20...d121e62763d8cc35b5fb1710e887d6e69a52d3a4 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-13 11:31:09 -04:00
dependabot[bot]
38e51f16ec
chore(deps): bump modernc.org/sqlite from 1.33.0 to 1.33.1 ( #3229 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.33.0 to 1.33.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.33.0...v1.33.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-13 11:30:58 -04:00
Keith Zantow
1b863268df
feat: --enrich flag for data enrichment feature enablement ( #3182 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-09-12 10:45:18 -04:00
Ryuichi Okumura
fcd5ec951d
chore: make ci-check.sh an executable file ( #3220 )
...
Signed-off-by: Ryuichi Okumura <okuryu@okuryu.com >
2024-09-11 10:02:37 -04:00
dependabot[bot]
61a9fde01c
chore(deps): bump github.com/opencontainers/runc from 1.1.12 to 1.1.14 ( #3219 )
...
Bumps [github.com/opencontainers/runc](https://github.com/opencontainers/runc ) from 1.1.12 to 1.1.14.
- [Release notes](https://github.com/opencontainers/runc/releases )
- [Changelog](https://github.com/opencontainers/runc/blob/main/CHANGELOG.md )
- [Commits](https://github.com/opencontainers/runc/compare/v1.1.12...v1.1.14 )
---
updated-dependencies:
- dependency-name: github.com/opencontainers/runc
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-10 21:20:43 +00:00
Keith Zantow
c33a51d3d8
chore: restore ci-check.sh script ( #3218 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-09-10 15:19:05 -04:00
Laurent Goderre
dbc4238f63
Add haskell binaries cataloger ( #3078 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-10 10:58:20 -04:00
anchore-actions-token-generator[bot] and wagoodman
fce14fd537
chore(deps): update CPE dictionary index ( #3206 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-09-10 10:36:50 -04:00
dependabot[bot]
98bd4e99b6
chore(deps): bump golang.org/x/net from 0.28.0 to 0.29.0 ( #3203 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.28.0 to 0.29.0.
- [Commits](https://github.com/golang/net/compare/v0.28.0...v0.29.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-10 10:35:43 -04:00
Laurent Goderre
9c2799e379
Add the Ocaml ecosystem ( #3112 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-09-10 10:35:18 -04:00
dependabot[bot]
dafc6ad034
chore(deps): bump github.com/charmbracelet/bubbles from 0.19.0 to 0.20.0 ( #3209 )
...
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles ) from 0.19.0 to 0.20.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases )
- [Changelog](https://github.com/charmbracelet/bubbles/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.19.0...v0.20.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-09 16:28:01 -04:00
dependabot[bot]
16f89840fd
chore(deps): bump modernc.org/sqlite from 1.32.0 to 1.33.0 ( #3210 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.32.0 to 1.33.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.32.0...v1.33.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-09 16:27:52 -04:00
dependabot[bot]
2475f7f696
chore(deps): bump github.com/docker/docker ( #3211 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.2.0+incompatible to 27.2.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.2.0...v27.2.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-09 16:27:43 -04:00
dependabot[bot]
f735a428eb
chore(deps): bump github.com/dave/jennifer from 1.7.0 to 1.7.1 ( #3212 )
...
Bumps [github.com/dave/jennifer](https://github.com/dave/jennifer ) from 1.7.0 to 1.7.1.
- [Commits](https://github.com/dave/jennifer/compare/v1.7.0...v1.7.1 )
---
updated-dependencies:
- dependency-name: github.com/dave/jennifer
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-09 16:27:33 -04:00
Alex Goodman
ba7bf6b85e
dont cleanup cache in forks ( #3214 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-09 20:27:21 +00:00
Alex Goodman
b153b1d594
less verbose java logging when non-fatal issues arise ( #3208 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-09 15:27:59 +00:00
Alex Goodman
0a3f513f92
Slim down docker cache size ( #3190 )
...
* slim down docker cache size
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove old centos images
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* troubleshoot test failure
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix wget version ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor caching mechanisms
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add cache cleanup steps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* simplify deleting cache
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix first clone issue
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tool dep
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-09-09 11:15:13 -04:00
dependabot[bot]
deabd4115a
chore(deps): bump peter-evans/create-pull-request from 7.0.0 to 7.0.1 ( #3196 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 7.0.0 to 7.0.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/4320041ed380b20e97d388d56a7fb4f9b8c20e79...8867c4aba1b742c39f8d0ba35429c2dfa4b6cb20 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-05 15:06:23 -04:00
dependabot[bot]
ff0bae67bd
chore(deps): bump golang.org/x/mod from 0.20.0 to 0.21.0 ( #3197 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.20.0 to 0.21.0.
- [Commits](https://github.com/golang/mod/compare/v0.20.0...v0.21.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-05 15:05:15 -04:00
witchcraze
a343825685
fix: haproxy classifier for versions with -dev suffix ( #3180 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-09-05 14:52:19 -04:00
dependabot[bot]
7c96a10cbe
chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.3 to 3.3.0 ( #3177 )
...
Bumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig ) from 3.2.3 to 3.3.0.
- [Release notes](https://github.com/Masterminds/sprig/releases )
- [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md )
- [Commits](https://github.com/Masterminds/sprig/compare/v3.2.3...v3.3.0 )
---
updated-dependencies:
- dependency-name: github.com/Masterminds/sprig/v3
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-03 12:22:43 -04:00
anchore-actions-token-generator[bot] and wagoodman
8c690d000d
chore(deps): update CPE dictionary index ( #3183 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-09-03 12:22:30 -04:00
dependabot[bot]
8ade391658
chore(deps): bump actions/upload-artifact from 4.3.6 to 4.4.0 ( #3184 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.6 to 4.4.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/834a144ee995460fba8ed112a2fc961b36a5ec5a...50769540e7f4bd5e21e526ee35c689e35e0d6874 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-03 12:22:16 -04:00
dependabot[bot]
e299a95120
chore(deps): bump peter-evans/create-pull-request from 6.1.0 to 7.0.0 ( #3187 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 6.1.0 to 7.0.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/c5a7806660adbe173f04e3e038b0ccdcd758773c...4320041ed380b20e97d388d56a7fb4f9b8c20e79 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-09-03 12:22:07 -04:00
Mikail
f2caf45695
fix: properly decode SPDX license expressions in CycloneDX format ( #3175 )
...
Signed-off-by: Mikail Kocak <mikail-gh@pm.me >
2024-08-29 11:05:43 -04:00
dependabot[bot]
731fc77641
chore(deps): bump github.com/docker/docker ( #3168 )
2024-08-29 14:16:50 +00:00
dependabot[bot]
3499d92c6d
chore(deps): bump github.com/charmbracelet/bubbletea ( #3171 )
2024-08-29 14:16:43 +00:00
dependabot[bot]
19d2735aff
chore(deps): bump github/codeql-action from 3.26.5 to 3.26.6 ( #3173 )
2024-08-29 14:16:34 +00:00
Keith Zantow
11d77b4a94
fix: cycles resolving relative path parent poms with parent-defined variables ( #3170 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-08-28 15:12:13 -04:00
Weston Steimel
2c25f81b68
fix: improve generated cpes for binaries with existing classifiers ( #3169 )
...
The existing syft binary classifiers already specify any known CPEs for
the defined binary; however, sometimes these end up getting suppressed
(such as when there are ELF notes extracted) and the CPE generator ends
up being used instead. This adds enough detail to at least ensure the
correct ones get appended to the generation list for the currently
covered classifiers.
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-28 16:46:35 +01:00
GGMU
04e3371cce
fix: add log time of task ( #3105 )
...
Signed-off-by: tomersein <tomersein@gmail.com >
2024-08-28 11:04:26 -04:00
Weston Steimel
5ab43bafec
fix: improve known CPEs and set NVD as source for all current binary classifiers ( #3167 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-27 17:36:34 +01:00
Alex Goodman
e9a8c27be1
respond to authoratative CPEs from catalogers ( #3166 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-08-27 10:26:35 -04:00
Alex Goodman
4ee6c179f8
set cataloger names within package cataloger task ( #3165 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-08-27 09:23:43 -04:00
Weston Steimel
99be365f62
fix: use official CPE for curl binary cataloger ( #3164 )
...
The official CPE for curl is `cpe:2.3:a:haxx:curl:*:*:*:*:*:*:*:*`
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-27 14:03:19 +01:00
anchore-actions-token-generator[bot] and spiffcs
cf9bb13f2b
chore(deps): update tools to latest versions ( #3160 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-08-26 10:07:59 -04:00
anchore-actions-token-generator[bot] and wagoodman
0cd6185716
chore(deps): update CPE dictionary index ( #3161 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-08-26 10:07:44 -04:00
dependabot[bot]
6549ec9831
chore(deps): bump github/codeql-action from 3.26.4 to 3.26.5 ( #3162 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.4 to 3.26.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f0f3afee809481da311ca3a6ff1ff51d81dbeb24...2c779ab0d087cd7fe7b826087247c2c81f27bfa6 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-26 10:07:18 -04:00
Alex Goodman
b6b5c8e308
fix ELF package correlations ( #3151 )
2024-08-26 08:44:39 -04:00
anchore-actions-token-generator[bot]
dad253785e
chore(deps): update tools to latest versions ( #3144 )
2024-08-23 14:42:12 -04:00
KrysGor
cff9d494df
feat: detect curl binaries ( #3146 )
2024-08-23 14:41:08 -04:00
dependabot[bot]
9ab3de1819
chore(deps): bump anchore/sbom-action from 0.17.1 to 0.17.2 ( #3155 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.1 to 0.17.2.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/ab9d16d4b419c9d1a02df5213fa0ebe965ca5a57...61119d458adab75f756bc0b9e4bde25725f86a7a )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:52:58 -04:00
dependabot[bot]
6f0230879a
chore(deps): bump github/codeql-action from 3.26.3 to 3.26.4 ( #3154 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.3 to 3.26.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/883d8588e56d1753a8a58c1c86e88976f0c23449...f0f3afee809481da311ca3a6ff1ff51d81dbeb24 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:52:48 -04:00
anchore-actions-token-generator[bot] and kzantow
691f34ce27
chore(deps): update stereoscope to e6d086e8bef5fab4fcfbd60c9a759c4cb229decf ( #3152 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-08-22 13:52:34 -04:00
dependabot[bot]
ac977246c9
chore(deps): bump github.com/charmbracelet/bubbles from 0.18.0 to 0.19.0 ( #3148 )
...
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles ) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases )
- [Changelog](https://github.com/charmbracelet/bubbles/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.18.0...v0.19.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:52:06 -04:00
dependabot[bot]
78d48b4209
chore(deps): bump github.com/charmbracelet/lipgloss ( #3147 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.12.1 to 0.13.0.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.12.1...v0.13.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:51:57 -04:00
dependabot[bot]
bd80eeafac
chore(deps): bump github.com/anchore/stereoscope ( #3153 )
...
Bumps [github.com/anchore/stereoscope](https://github.com/anchore/stereoscope ) from 0.0.3-0.20240725180315-50ce3be7aa1f to 0.0.3.
- [Release notes](https://github.com/anchore/stereoscope/releases )
- [Changelog](https://github.com/anchore/stereoscope/blob/main/.goreleaser.yaml )
- [Commits](https://github.com/anchore/stereoscope/commits/v0.0.3 )
---
updated-dependencies:
- dependency-name: github.com/anchore/stereoscope
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-22 13:51:50 -04:00
Keith Zantow
73b9d5aa42
fix: mysql 8.0.3x binary detection ( #3142 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-08-21 09:48:28 -04:00
dependabot[bot]
f786233e97
chore(deps): bump github/codeql-action from 3.26.2 to 3.26.3 ( #3139 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.2 to 3.26.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/429e1977040da7a23b6822b13c129cd1ba93dbb2...883d8588e56d1753a8a58c1c86e88976f0c23449 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-20 23:04:58 +00:00
Keith Zantow
95b4a88256
fix: logging for remote network calls ( #3140 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-08-20 11:45:33 -04:00
anchore-actions-token-generator[bot] and wagoodman
511cc9c2d5
chore(deps): update CPE dictionary index ( #3135 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-08-19 12:49:43 -04:00
dependabot[bot]
360983f75b
chore(deps): bump github.com/charmbracelet/bubbletea ( #3137 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.6 to 0.27.0.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.6...v0.27.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-19 12:48:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
4b7ae0ed3b
chore(deps): update tools to latest versions ( #3121 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: update code to reflect new linter settings for error messages
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-08-16 17:56:36 +00:00
dependabot[bot]
4ff60ee837
chore(deps): bump github.com/docker/docker ( #3123 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.1.1+incompatible to 27.1.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.1.1...v27.1.2 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-15 13:50:51 -04:00
dependabot[bot]
965000dcbb
chore(deps): bump anchore/sbom-action from 0.17.0 to 0.17.1 ( #3124 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.17.0 to 0.17.1.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5...ab9d16d4b419c9d1a02df5213fa0ebe965ca5a57 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-15 13:16:47 -04:00
dependabot[bot]
a447884084
chore(deps): bump github/codeql-action from 3.26.0 to 3.26.2 ( #3129 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.26.0 to 3.26.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/eb055d739abdc2e8de2e5f4ba1a8b246daa779aa...429e1977040da7a23b6822b13c129cd1ba93dbb2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-15 13:16:39 -04:00
Lucas Rodriguez
cd3b828905
fix: add nil check to CycloneDX toBomProperties ( #3119 )
...
Signed-off-by: Lucas Rodriguez <lucas.rodriguez9616@gmail.com >
2024-08-13 16:02:15 -04:00
Lukas Voetmand
3161e1847e
fix: read CycloneDX BOM components from metadata ( #3092 )
...
Signed-off-by: dervoeti <lukas.voetmand@stackable.tech >
2024-08-12 16:37:23 -04:00
Weston Steimel
df1e5b57fe
fix: improve groupid extraction for Jenkins plugins ( #2815 )
...
* fix: improve groupid extraction for Jenkins plugins
Consider the `Group-Id` java manifest property as this is typically set
for Jenkins plugins if there is no pom file
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
* test: update java purl integration test image
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
---------
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-12 13:01:44 -04:00
d2b33f1acb
chore(deps): update CPE dictionary index ( #3116 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-08-12 16:57:47 +00:00
GGMU
91cf066db6
support .kar files ( #3113 )
...
* add kar
Signed-off-by: tomersein <tomersein@gmail.com >
2024-08-12 12:10:03 -04:00
luozexuan
c19cf626ab
chore: fix some comments ( #3114 )
...
Signed-off-by: luozexuan <fetchcode@139.com >
2024-08-12 12:08:04 -04:00
Keith Zantow
cf85450e08
chore: fix failing python relationship test ( #3117 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-08-12 12:07:47 -04:00
Alan Pope
49d4e32241
update-slack-to-discourse ( #3111 )
...
Signed-off-by: Alan Pope <alan@popey.com >
2024-08-12 11:49:10 +01:00
Weston Steimel
19cc664cf8
test: increase java purl generation test coverage ( #3110 )
...
ensures correct package url generation for more java packages now that
syft has more deterministic results per https://github.com/anchore/syft/pull/3085
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-08-09 10:14:10 +00:00
dependabot[bot]
64a9ecbf7a
chore(deps): bump modernc.org/sqlite from 1.31.1 to 1.32.0 ( #3106 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.31.1 to 1.32.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.31.1...v1.32.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-08 15:49:45 -04:00
dependabot[bot]
6267d69930
chore(deps): bump sigstore/cosign-installer from 3.5.0 to 3.6.0 ( #3107 )
...
Bumps [sigstore/cosign-installer](https://github.com/sigstore/cosign-installer ) from 3.5.0 to 3.6.0.
- [Release notes](https://github.com/sigstore/cosign-installer/releases )
- [Commits](https://github.com/sigstore/cosign-installer/compare/v3.5.0...v3.6.0 )
---
updated-dependencies:
- dependency-name: sigstore/cosign-installer
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-08 15:49:37 -04:00
anchore-actions-token-generator[bot] and spiffcs
1fb47d908e
chore(deps): update tools to latest versions ( #3099 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-08-07 14:26:05 -04:00
dependabot[bot]
2339743c8c
chore(deps): bump github/codeql-action from 3.25.15 to 3.26.0 ( #3101 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.15 to 3.26.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/afb54ba388a7dca6ecae48f608c4ff05ff4cc77a...eb055d739abdc2e8de2e5f4ba1a8b246daa779aa )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-07 14:25:52 -04:00
dependabot[bot]
9031592649
chore(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6 ( #3102 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.5 to 4.3.6.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/89ef406dd8d7e03cfd12d9e0a4a378f454709029...834a144ee995460fba8ed112a2fc961b36a5ec5a )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-07 14:25:44 -04:00
dependabot[bot]
47d192d79b
chore(deps): bump github.com/google/go-containerregistry ( #3103 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.1 to 0.20.2.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.1...v0.20.2 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-07 14:25:36 -04:00
dependabot[bot]
040b683da8
chore(deps): bump golang.org/x/net from 0.27.0 to 0.28.0 ( #3104 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.27.0 to 0.28.0.
- [Commits](https://github.com/golang/net/compare/v0.27.0...v0.28.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-07 14:25:28 -04:00
dependabot[bot]
dcd87d1fef
chore(deps): bump actions/upload-artifact from 4.3.4 to 4.3.5 ( #3095 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.4 to 4.3.5.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/0b2256b8c012f0828dc542b3febcab082c67f72b...89ef406dd8d7e03cfd12d9e0a4a378f454709029 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-06 13:17:36 -04:00
anchore-actions-token-generator[bot] and wagoodman
214a0498e0
chore(deps): update CPE dictionary index ( #3094 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-08-06 13:07:48 -04:00
dependabot[bot]
0f9df805c1
chore(deps): bump golang.org/x/mod from 0.19.0 to 0.20.0 ( #3096 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.19.0 to 0.20.0.
- [Commits](https://github.com/golang/mod/compare/v0.19.0...v0.20.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-06 13:07:33 -04:00
dependabot[bot]
703330abd0
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.6 to 0.5.7 ( #3097 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.6 to 0.5.7.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.6...v0.5.7 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-08-06 13:07:21 -04:00
Gijs Calis and Keith Zantow
9d40d1152e
feat: improved java maven property resolution ( #2769 )
...
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-08-05 11:30:47 -04:00
Harippriya Sivapatham
cc15edca62
fix: use organization for package supplier when reading Java vendor fields ( #3093 )
...
Signed-off-by: Harippriya Sivapatham <harippriyasivapatham@gmail.com >
2024-08-03 16:00:55 -04:00
anchore-actions-token-generator[bot] and spiffcs
623532e3ed
chore(deps): update tools to latest versions ( #3091 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-08-02 13:25:09 -04:00
Dor Hayun and dor-hayun
48f1e975f0
fix: update 'guessMainPackageNameAndVersionFromPomInfo' and 'artifactIDMatchesFilename' ( #3054 )
...
- Correct retrieval of package name when main POM file exists
- Address issue where wrong package name was retrieved for certain jars
- Example case: 'jansi' jar containing multiple jars like 'jansi-win32'
- Ensure true is returned when filename matches the artifact ID, prevent random retrieval by checking prefix and suffix
- Use fallback check with suffix and prefix if no POM properties file matches the exact artifact name
Signed-off-by: dor-hayun <dor.hayun@mend.io >
Co-authored-by: dor-hayun <dor.hayun@mend.io >
2024-08-01 13:47:15 -04:00
Christopher Angelo Phillips
c84cb2cf84
fix: update mainModuleVersion function to always prefix v to findings ( #3087 )
...
* chore: basic fix
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
* test: make sure ldflags are prefixed with v
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-08-01 11:29:07 -04:00
Keith Zantow
05a10e8bed
chore: update release script to use gh from binny ( #3084 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-07-31 20:10:17 -04:00
Laurent Goderre
92d63df6f5
Added the SWI Prolog (swipl) ecosystem ( #3076 )
...
* Add binary classifier for swipl
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Added cataloger for SWI Prolog Pack packages
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-31 16:13:26 -04:00
Keith Zantow
a4b5dcd0df
fix: improve determinism in java archive identification ( #3085 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-07-30 12:02:52 -04:00
anchore-actions-token-generator[bot] and kzantow
06526e2931
chore(deps): update stereoscope to 50ce3be7aa1fb8829234ae648215e7907196bfa5 ( #3075 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-07-29 10:04:46 -04:00
anchore-actions-token-generator[bot] and wagoodman
a2042e629c
chore(deps): update CPE dictionary index ( #3079 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-07-29 10:03:59 -04:00
dependabot[bot]
a35e410c75
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.5 to 0.5.6 ( #3082 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.5 to 0.5.6.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.5...v0.5.6 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-29 10:03:44 -04:00
dependabot[bot]
8dd7c9c0b9
chore(deps): bump github/codeql-action from 3.25.14 to 3.25.15 ( #3083 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.14 to 3.25.15.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/5cf07d8b700b67e235fbb65cbc84f69c0cf10464...afb54ba388a7dca6ecae48f608c4ff05ff4cc77a )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-29 10:03:35 -04:00
witchcraze
490e05adb2
fix: traefik classifier ( #3077 )
...
Signed-off-by: witchcraze <witchcraze@gmail.com >
2024-07-29 09:46:51 -04:00
mikcl
1cd75b7d68
python-cataloger: fix normalization test ( #3073 )
...
Signed-off-by: mikcl <mikesmikes400@gmail.com >
2024-07-25 15:45:14 -04:00
Laurent Goderre
4882d2e8ce
Only match ldflag version if it matches the main module or targets main.version ( #3062 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-25 13:56:55 -04:00
mikcl
b3848f780f
python cataloger: allow dots in python package names ( #3070 )
...
Signed-off-by: mikcl <mikesmikes400@gmail.com >
2024-07-25 13:56:10 -04:00
mikcl
36f95d6828
python-cataloger: normalize package names ( #3069 )
...
Signed-off-by: mikcl <mikesmikes400@gmail.com >
2024-07-25 13:54:13 -04:00
dependabot[bot]
68b96ae444
chore(deps): bump github.com/docker/docker ( #3066 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.1.0+incompatible to 27.1.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.1.0...v27.1.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-25 13:50:33 -04:00
dependabot[bot]
3917989f86
chore(deps): bump github/codeql-action from 3.25.13 to 3.25.14 ( #3072 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.13 to 3.25.14.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/2d790406f505036ef40ecba973cc774a50395aac...5cf07d8b700b67e235fbb65cbc84f69c0cf10464 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-25 13:50:06 -04:00
Keith Zantow
741c8fb9bd
fix: SPDX output performance with many relationships ( #3053 )
2024-07-24 10:14:20 -04:00
Alex Goodman
9573f557d1
better go mod detection from partial package builds ( #3060 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-07-24 09:34:40 -04:00
anchore-actions-token-generator[bot] and spiffcs
ca945d16e0
chore(deps): update tools to latest versions ( #3061 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-07-23 10:16:25 -04:00
dependabot[bot] and Christopher Phillips
fe7c5a7174
chore(deps): bump github.com/charmbracelet/lipgloss from 0.11.1 to 0.12.1 ( #3040 )
...
* chore(deps): bump github.com/charmbracelet/lipgloss
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.11.1 to 0.12.1.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.11.1...v0.12.1 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
* chore: pin fedora linux/amd64 to sha
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: dependabot[bot] <support@github.com >
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-07-22 10:43:17 -07:00
Keith Zantow
125c787e40
chore: add debug logging for errors reading RPM files ( #3051 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-07-22 13:05:04 -04:00
anchore-actions-token-generator[bot] and wagoodman
bfe6f5204a
chore(deps): update CPE dictionary index ( #3035 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-07-22 08:56:58 -07:00
dependabot[bot]
aead40e1de
chore(deps): bump github.com/docker/docker ( #3055 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 27.0.3+incompatible to 27.1.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v27.0.3...v27.1.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 08:56:01 -07:00
dependabot[bot]
536611fa25
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.4 to 0.5.5 ( #3056 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.4 to 0.5.5.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.4...v0.5.5 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 08:45:25 -07:00
dependabot[bot]
d0a7d4c43e
chore(deps): bump modernc.org/sqlite from 1.30.2 to 1.31.1 ( #3057 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.30.2 to 1.31.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.30.2...v1.31.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 08:45:01 -07:00
dependabot[bot]
0c53a087f0
chore(deps): bump docker/login-action from 3.2.0 to 3.3.0 ( #3058 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.2.0 to 3.3.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/0d4c9c5ea7693da7b068278f7b52bda2a190a446...9780b0c442fbb1117ed29e0efdff1e18412f7567 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 08:44:06 -07:00
dependabot[bot]
b263b1ec1f
chore(deps): bump github/codeql-action from 3.25.12 to 3.25.13 ( #3059 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.12 to 3.25.13.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4fa2a7953630fd2f3fb380f21be14ede0169dd4f...2d790406f505036ef40ecba973cc774a50395aac )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-22 10:55:55 -04:00
034a98f029
chore(deps): update stereoscope to 487b11e5ba2622d976acda10c605da63b4fbbb0a ( #3032 )
...
* chore(deps): update stereoscope to 487b11e5ba2622d976acda10c605da63b4fbbb0a
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: allow unlicense
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
Co-authored-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-07-18 09:26:01 -07:00
anchore-actions-token-generator[bot] and spiffcs
69031b0646
chore(deps): update tools to latest versions ( #3050 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-07-18 08:21:31 -07:00
Alan Pope
761a161e7f
docs: CODE_OF_CONDUCT.md ( #3046 )
...
This PR adds a code of conduct document to the repo, as agreed at our recent OSS team catch up.
Signed-off-by: Alan Pope <alan@popey.com >
2024-07-17 14:33:17 -07:00
Keith Zantow
ba31c2f1ae
fix: include CPEs with Maven groupId as vendor ( #3045 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-07-17 11:23:58 -07:00
dependabot[bot]
5d729a5e9e
chore(deps): bump github.com/google/go-containerregistry ( #3047 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.20.0 to 0.20.1.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.20.0...v0.20.1 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-17 11:21:23 -07:00
dependabot[bot]
276df95768
chore(deps): bump github.com/moby/sys/mountinfo from 0.7.1 to 0.7.2 ( #3048 )
...
Bumps [github.com/moby/sys/mountinfo](https://github.com/moby/sys ) from 0.7.1 to 0.7.2.
- [Release notes](https://github.com/moby/sys/releases )
- [Commits](https://github.com/moby/sys/compare/signal/v0.7.1...mountinfo/v0.7.2 )
---
updated-dependencies:
- dependency-name: github.com/moby/sys/mountinfo
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-17 11:21:14 -07:00
dependabot[bot]
cca9a06a64
chore(deps): bump modernc.org/sqlite from 1.30.1 to 1.30.2 ( #3039 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.30.1 to 1.30.2.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.30.1...v1.30.2 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-17 09:10:34 -04:00
Bradley Jones
4d23990dd4
docs: link to contrib/dev docs in readme ( #3029 )
...
These docs are full of great information so make them easily accessible
from the README so they aren't overlooked.
Signed-off-by: Bradley Jones <bradley.jones@anchore.com >
2024-07-16 06:59:31 -07:00
Adam McClenaghan
d4fa61e0a2
chore: Fix apache shield in readme ( #3021 )
...
Signed-off-by: Adam McClenaghan <adam@mcclenaghan.co.uk >
2024-07-16 06:59:14 -07:00
anchore-actions-token-generator[bot] and spiffcs
d4d4e003e9
chore(deps): update tools to latest versions ( #3031 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-07-16 06:58:33 -07:00
dependabot[bot]
6bf91a410d
chore(deps): bump github/codeql-action from 3.25.11 to 3.25.12 ( #3034 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.11 to 3.25.12.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b611370bb5703a7efb587f9d136a52ea24c5c38c...4fa2a7953630fd2f3fb380f21be14ede0169dd4f )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-16 06:58:18 -07:00
dependabot[bot]
77c300d617
chore(deps): bump anchore/sbom-action from 0.16.1 to 0.17.0 ( #3044 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.16.1 to 0.17.0.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/95b086ac308035dc0850b3853be5b7ab108236a8...d94f46e13c6c62f59525ac9a1e147a99dc0b9bf5 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-16 06:58:07 -07:00
William Murphy
75902b0540
fix: stop panicking on "devel" version go stdlib ( #3043 )
...
Previously, if a Go binary was cataloged with build info indicating that
the go compiler version used was "deve", syft would panic on a nil
pointer dereference. Instead, skip creating a Go stdlib reference and
relationship for such a package.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-07-16 09:51:14 -04:00
Keith Zantow
278b72d39b
chore: pin fedora image for elf binary test ( #3041 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-07-15 16:37:09 +00:00
dependabot[bot]
37245a21cc
chore(deps): bump anchore/sbom-action from 0.16.0 to 0.16.1 ( #3023 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.16.0 to 0.16.1.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/e8d2a6937ecead383dfe75190d104edd1f9c5751...95b086ac308035dc0850b3853be5b7ab108236a8 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-11 14:50:48 -04:00
anchore-actions-token-generator[bot] and kzantow
e2fe955262
chore(deps): update stereoscope to 27b66b76fc6686fcf6bde656aa09e1f0e047fec1 ( #3026 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-07-11 10:38:10 -07:00
dependabot[bot]
4e09908ba1
chore(deps): bump actions/setup-go from 5.0.1 to 5.0.2 ( #3027 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.0.1 to 5.0.2.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/cdcb36043654635271a94b9a6d1392de5bb323a7...0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-11 10:19:48 -07:00
dependabot[bot]
863793a3cc
chore(deps): bump github.com/charmbracelet/lipgloss ( #3028 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.11.0 to 0.11.1.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Changelog](https://github.com/charmbracelet/lipgloss/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.11.0...v0.11.1 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-11 10:19:14 -07:00
Christopher Angelo Phillips
f7ffcc534f
fix: stabilize cpe sorting during collection sort ( #3009 )
2024-07-09 14:24:21 -04:00
Laurent Goderre
b101f44aba
Map the downloadLocation field for PHP Composer packages ( #3011 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-07-09 09:01:58 -07:00
anchore-actions-token-generator[bot] and kzantow
de3313cfb6
chore(deps): update stereoscope to e46739e217969fa67cbe8834b64bb165a10a1548 ( #3013 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-07-09 07:53:04 -07:00
dependabot[bot]
b2f9904d74
chore(deps): bump golang.org/x/net from 0.26.0 to 0.27.0 ( #3015 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.26.0 to 0.27.0.
- [Commits](https://github.com/golang/net/compare/v0.26.0...v0.27.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 07:52:32 -07:00
dependabot[bot]
13d01ecaff
chore(deps): bump golang.org/x/mod from 0.18.0 to 0.19.0 ( #3014 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.18.0 to 0.19.0.
- [Commits](https://github.com/golang/mod/compare/v0.18.0...v0.19.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 07:08:25 -07:00
dependabot[bot]
7dc1b1ce27
chore(deps): bump actions/upload-artifact from 4.3.3 to 4.3.4 ( #3017 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.3 to 4.3.4.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/65462800fd760344b1a7b4382951275a0abb4808...0b2256b8c012f0828dc542b3febcab082c67f72b )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 07:08:12 -07:00
dependabot[bot]
b8dce675fe
chore(deps): bump github.com/google/go-containerregistry ( #3019 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.19.2 to 0.20.0.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.19.2...v0.20.0 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 07:08:02 -07:00
dependabot[bot]
6dda9edd7c
chore(deps): bump github.com/adrg/xdg from 0.4.0 to 0.5.0 ( #3020 )
...
Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg ) from 0.4.0 to 0.5.0.
- [Release notes](https://github.com/adrg/xdg/releases )
- [Commits](https://github.com/adrg/xdg/compare/v0.4.0...v0.5.0 )
---
updated-dependencies:
- dependency-name: github.com/adrg/xdg
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-07-09 07:07:53 -07:00
anchore-actions-token-generator[bot]
04c861bf77
chore(deps): update CPE dictionary index ( #3016 )
2024-07-08 08:13:17 -04:00
Alex Goodman
573440b7cf
Infer the package type from ELF package notes ( #3008 )
...
* fix ELF package types to be honored
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* prefer OS packages over binary packages when there are duplicates
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-07-02 16:07:08 -04:00
anchore-actions-token-generator[bot]
c816039e91
chore(deps): update tools to latest versions ( #3003 )
2024-07-01 20:04:45 -04:00
anchore-actions-token-generator[bot]
7f3ca65cf6
chore(deps): update CPE dictionary index ( #3002 )
2024-07-01 15:02:15 -04:00
dependabot[bot]
43e5b1b45f
chore(deps): bump github.com/docker/docker ( #3006 )
2024-07-01 19:01:01 +00:00
dependabot[bot]
a876aaccb2
chore(deps): bump github/codeql-action from 3.25.10 to 3.25.11 ( #3004 )
2024-07-01 19:00:35 +00:00
dependabot[bot]
875669bfd1
chore(deps): bump github.com/saferwall/pe from 1.5.3 to 1.5.4 ( #3005 )
2024-07-01 19:00:07 +00:00
Danielle Featherstone
5283c4687a
feat: version 3 support for swift package manager of the resolved files ( #3001 )
...
Signed-off-by: Danielle Featherstone <dfeatherstone@fearless.tech >
2024-07-01 14:27:37 -04:00
dependabot[bot]
4d48adfa3f
chore(deps): bump github.com/spdx/tools-golang from 0.5.4 to 0.5.5 ( #2999 )
2024-06-26 13:44:52 +00:00
dependabot[bot]
c8b449c92b
chore(deps): bump github.com/docker/docker ( #2994 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.1.4+incompatible to 27.0.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.1.4...v27.0.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-25 14:40:51 -07:00
Laurent Goderre
ceced5eb27
Add detection of Erlang in Alpine linux ( #2996 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-06-25 14:40:40 -07:00
anchore-actions-token-generator[bot] and spiffcs
7da15890eb
chore(deps): update tools to latest versions ( #2991 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-06-25 13:41:26 -07:00
anchore-actions-token-generator[bot] and kzantow
580c09b01c
chore(deps): update stereoscope to 753b5576fe42bc007b22108ad7911d1729957a46 ( #2992 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-06-25 13:41:08 -07:00
dependabot[bot]
0dce67872e
chore(deps): bump github.com/charmbracelet/bubbletea ( #2995 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.5 to 0.26.6.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.5...v0.26.6 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-25 10:10:26 -07:00
anchore-actions-token-generator[bot] and wagoodman
1eae9333a9
chore(deps): update CPE dictionary index ( #2986 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-06-24 08:27:29 -07:00
dependabot[bot]
863891f325
chore(deps): bump github.com/go-test/deep from 1.1.0 to 1.1.1 ( #2988 )
...
Bumps [github.com/go-test/deep](https://github.com/go-test/deep ) from 1.1.0 to 1.1.1.
- [Release notes](https://github.com/go-test/deep/releases )
- [Changelog](https://github.com/go-test/deep/blob/master/CHANGES.md )
- [Commits](https://github.com/go-test/deep/compare/v1.1.0...v1.1.1 )
---
updated-dependencies:
- dependency-name: github.com/go-test/deep
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-24 08:27:13 -07:00
Keith Zantow
bd1c1d260c
fix: handle errors reading go licenses ( #2985 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-06-24 10:27:03 -04:00
Christopher Angelo Phillips
f5a917a5a2
docs: update cyclone-dx documentation ( #2983 )
...
* chore: update docs to show 1.6 for cyclone-dx by default
* chore: update README showing version information for formats
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
2024-06-21 09:32:59 -07:00
Rajan Agaskar
ae0683074e
feat: update syft to generate cyclone-dx 1.6 by default ( #2978 )
...
- Resolves #2974
- add detailed instructions re: updating schemas (a necessary task
when a new CycloneDX spec version becomes available).
- The DefaultVersion constant has been updated to "1.6" -- it's not
clear to me how this is used at this time (it may be redundant given
other code), but effectively unless a specific spec version is
configured, `syft` will emit the "most recent" spec version available
for cyclonedx. Users who wish to pin back to a "older" specVersion
(e.g. to preserve compatibilty with utilities that have not yet bumped
to latest) can either set this in a syft config file or pass a
name@spec_version pair to the output flag (e.g. `-o
cyclonedx-json@1.5=some-1.5-spec-bom.cdx.json`)
- Regenerate relevant .golden files (there seems to be a way to do this
via flags, but I couldn't quite figure out the right set to pass
correctly, esp. since (as a relative go novice) I found it difficult
to run just a single test file. I ended up "brute-forcing it" by
changing the *updateSnapshot val to "true" and running it in Goland.
A brief comment giving an example of regenerating fixtures usage would
be helpful.
Signed-off-by: Rajan Agaskar <ragaskar@gmail.com >
2024-06-21 08:51:27 -07:00
dependabot[bot]
9b178174a7
chore(deps): bump github.com/charmbracelet/bubbletea ( #2982 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.4 to 0.26.5.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Changelog](https://github.com/charmbracelet/bubbletea/blob/master/.goreleaser.yml )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.4...v0.26.5 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-21 08:46:35 -07:00
dependabot[bot]
e947779886
chore(deps): bump peter-evans/create-pull-request from 6.0.5 to 6.1.0 ( #2975 )
2024-06-20 15:12:12 +00:00
Laurent Goderre
7a35de04ee
fix: detection of arangodb 3.12 ( #2979 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-06-20 11:11:03 -04:00
Weston Steimel
246df97ae7
chore: enable dependabot to keep boostrap action updated ( #2976 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-06-19 20:17:11 +01:00
dependabot[bot]
750d37f075
chore(deps): bump github.com/github/go-spdx/v2 from 2.2.0 to 2.3.1 ( #2973 )
...
Bumps [github.com/github/go-spdx/v2](https://github.com/github/go-spdx ) from 2.2.0 to 2.3.1.
- [Release notes](https://github.com/github/go-spdx/releases )
- [Commits](https://github.com/github/go-spdx/compare/v2.2.0...v2.3.1 )
---
updated-dependencies:
- dependency-name: github.com/github/go-spdx/v2
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-18 09:46:11 -07:00
dependabot[bot]
5061b905dc
chore(deps): bump github.com/google/go-containerregistry ( #2971 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.19.1 to 0.19.2.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.19.1...v0.19.2 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-17 08:44:19 -07:00
dependabot[bot]
ed3774afa7
chore(deps): bump github.com/spf13/cobra from 1.8.0 to 1.8.1 ( #2972 )
...
Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra ) from 1.8.0 to 1.8.1.
- [Release notes](https://github.com/spf13/cobra/releases )
- [Commits](https://github.com/spf13/cobra/compare/v1.8.0...v1.8.1 )
---
updated-dependencies:
- dependency-name: github.com/spf13/cobra
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-17 08:44:10 -07:00
Christopher Angelo Phillips and Alex Goodman
22d5731482
fix: fix parsing for complex toml types ( #2965 )
...
* fix: fix parsing for complex toml types
---------
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-14 19:32:17 +00:00
Keith Zantow
af3aaa0397
fix: make caching options more explicit ( #2966 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-06-14 18:45:48 +00:00
anchore-actions-token-generator[bot] and spiffcs
70098e20bb
chore(deps): update tools to latest versions ( #2961 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-06-14 08:18:41 -07:00
dependabot[bot]
784b17f66c
chore(deps): bump github/codeql-action from 3.25.9 to 3.25.10 ( #2964 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.9 to 3.25.10.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/530d4feaa9c62aaab2d250371e2061eb7a172363...23acc5c183826b7a8a97bce3cecc52db901f8251 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-14 08:18:25 -07:00
Weston Steimel
d5cd5f6091
feat: index known CPEs for wordpress plugins and themes ( #2963 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-06-14 14:39:43 +01:00
Weston Steimel and Alex Goodman
749ccc59c1
fix(golang): improve version extraction from ldflags for pingcap TiDB ( #2962 )
...
* fix(golang): improve version extraction from ldflags for pingcap TiDB
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
* loosen ld flag parsing requirements
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-14 14:35:14 +01:00
dependabot[bot]
273e31e806
chore(deps): bump actions/checkout from 4.1.6 to 4.1.7 ( #2955 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.6 to 4.1.7.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/a5ac7e51b41094c92402da3b24376905380afc29...692973e3d937129bcbf40652eb9f2f61becf3332 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-13 12:28:04 -04:00
dependabot[bot]
9beaec2e97
chore(deps): bump github/codeql-action from 3.25.8 to 3.25.9 ( #2956 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.8 to 3.25.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/2e230e8fe0ad3a14a340ad0815ddb96d599d2aff...530d4feaa9c62aaab2d250371e2061eb7a172363 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-13 12:27:53 -04:00
Keith Zantow
ca0cc52d47
fix: separate golang license caches from mod dir ( #2852 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-06-12 19:12:35 -04:00
dependabot[bot]
dd723bb3c5
chore(deps): bump github.com/vbatts/go-mtree from 0.5.3 to 0.5.4 ( #2952 )
...
Bumps [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree ) from 0.5.3 to 0.5.4.
- [Release notes](https://github.com/vbatts/go-mtree/releases )
- [Changelog](https://github.com/vbatts/go-mtree/blob/main/releases.md )
- [Commits](https://github.com/vbatts/go-mtree/compare/v0.5.3...v0.5.4 )
---
updated-dependencies:
- dependency-name: github.com/vbatts/go-mtree
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-12 13:17:06 -04:00
anchore-actions-token-generator[bot] and spiffcs
fb68489590
chore(deps): update tools to latest versions ( #2949 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-06-11 08:09:07 -07:00
dependabot[bot]
5590d5c1ce
chore(deps): bump modernc.org/sqlite from 1.30.0 to 1.30.1 ( #2950 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.30.0 to 1.30.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.30.0...v1.30.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-11 08:08:45 -07:00
Alex Goodman
0956753409
Consider Author field for wordpress plugins when generating CPEs ( #2946 )
...
* enhance wordpress vendor candidates for CPEs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* encode wordpress plugin target software
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-10 14:12:20 -04:00
Alex Goodman
f966bcfd03
trim whitespace from wordpress values ( #2945 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-10 13:35:01 -04:00
Alex Goodman
c43f4fb416
add signature verification to install.sh ( #2941 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-10 11:29:53 -04:00
Alex Goodman
db0c33481e
pin golang image ( #2944 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-10 09:59:33 -04:00
anchore-actions-token-generator[bot] and spiffcs
a658cc7402
chore(deps): update tools to latest versions ( #2943 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-06-10 09:20:22 -04:00
Alex Goodman
254a562b4e
Add support for reading ELF package notes with section header ( #2939 )
...
* add support for reading ELF package notes with section header
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add systemd elf package fields to json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-07 14:38:54 -04:00
anchore-actions-token-generator[bot] and spiffcs
bc20e66d08
chore(deps): update tools to latest versions ( #2940 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* chore: update header and deprecated fields
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-06-07 16:55:32 +00:00
Alex Goodman
6e16396d18
remove dco workflow ( #2936 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-06 14:29:55 +00:00
Brian Ebarb
5cdc0845fb
feat: add license field to ELF binary package metadata ( #2890 )
...
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
feat: add License component to elf binary packages
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
feat: fix elf_package_cataloger test
feat: elf package cataloger unit test updates
2024-06-06 14:10:53 +00:00
dependabot[bot]
baca15f186
chore(deps): bump github.com/docker/docker ( #2935 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.1.3+incompatible to 26.1.4+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.1.3...v26.1.4 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-06 09:56:47 -04:00
Laurent Goderre
b608ab77e1
feat: classifier for util-linux ( #2933 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-06-05 17:32:52 -04:00
dependabot[bot]
f4c941f08d
chore(deps): bump golang.org/x/net from 0.25.0 to 0.26.0 ( #2929 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.25.0 to 0.26.0.
- [Commits](https://github.com/golang/net/compare/v0.25.0...v0.26.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-05 19:09:09 +00:00
dependabot[bot]
2d5760145c
chore(deps): bump github/codeql-action from 3.25.7 to 3.25.8 ( #2928 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.7 to 3.25.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/f079b8493333aace61c81488f8bd40919487bd9f...2e230e8fe0ad3a14a340ad0815ddb96d599d2aff )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-05 11:58:14 -07:00
dependabot[bot]
f11bb95c1e
chore(deps): bump golang.org/x/mod from 0.17.0 to 0.18.0 ( #2930 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.17.0 to 0.18.0.
- [Commits](https://github.com/golang/mod/compare/v0.17.0...v0.18.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-05 11:57:54 -07:00
dependabot[bot]
d2fa5ed41c
chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.8.0 to 0.9.0 ( #2931 )
...
Bumps [github.com/CycloneDX/cyclonedx-go](https://github.com/CycloneDX/cyclonedx-go ) from 0.8.0 to 0.9.0.
- [Release notes](https://github.com/CycloneDX/cyclonedx-go/releases )
- [Changelog](https://github.com/CycloneDX/cyclonedx-go/blob/master/.goreleaser.yml )
- [Commits](https://github.com/CycloneDX/cyclonedx-go/compare/v0.8.0...v0.9.0 )
---
updated-dependencies:
- dependency-name: github.com/CycloneDX/cyclonedx-go
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-05 11:57:43 -07:00
Christopher Angelo Phillips
7508d75b2b
fix: update unit tests to use pinned patch version ( #2932 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-06-05 18:31:38 +00:00
Alex Goodman
3472b48177
Add relationships for python poetry packages ( #2906 )
...
* [wip] add initial poetry.lock relationship support
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* provide generic set for basic types
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dependency resolver should allow for conditional deps
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests for poetry lock relationship additions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update schema with python poetry dependency refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* dep specification data structure should not be recursive in nature
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 20:00:05 +00:00
Alex Goodman
4bdbd1aa2a
remove unused test fixtures and empty dirs ( #2924 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 15:22:49 -04:00
William Murphy and Alex Goodman
557ad73ee6
fix: only skip tmpfs mounts for some paths ( #2918 )
...
* fix: only skip tmpfs mounts for some paths
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* refactor and add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add regression test for archive processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* bump to golang 1.22
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove rule 1 and add more tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 15:21:45 -04:00
Alex Goodman
cb09dd9e19
match existing DCO GH check name
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 13:34:29 -04:00
Alex Goodman
2f39322f81
use dco tool during gh app outage ( #2926 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-06-04 17:31:29 +00:00
William Tang
fe0b78b7fe
fix: close sql driver after testing sqlite availability ( #2922 )
...
Signed-off-by: William Tang <ttc0419@outlook.com >
2024-06-03 14:42:13 +00:00
Ralph Bean
8a7f08e2c8
Use redhat as namespace for redhat rpms ( #2914 )
...
The namespace value of `redhat` signifies this as an RPM package
produced and distributed by Red Hat.
Using "rhel" in the namespace is not correct.
Signed-off-by: Ralph Bean <rbean@redhat.com >
2024-06-03 10:18:52 -04:00
dufucun and dufucun
29d601d1f1
chore: fix some comments ( #2920 )
...
Signed-off-by: dufucun <dufuchun@sohu.com >
Co-authored-by: dufucun <dufucunn@sohu.com >
2024-06-03 14:10:39 +00:00
anchore-actions-token-generator[bot] and wagoodman
3ac95bfbd0
chore(deps): update CPE dictionary index ( #2919 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-06-03 10:00:30 -04:00
dependabot[bot]
24262b9e31
chore(deps): bump modernc.org/sqlite from 1.29.10 to 1.30.0 ( #2921 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.10 to 1.30.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.10...v1.30.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-06-03 09:59:33 -04:00
dependabot[bot]
b04bc0fbfe
chore(deps): bump github/codeql-action from 3.25.6 to 3.25.7 ( #2916 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.6 to 3.25.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/9fdb3e49720b44c48891d036bb502feb25684276...f079b8493333aace61c81488f8bd40919487bd9f )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-31 11:17:21 -04:00
dependabot[bot]
aafa161ff6
chore(deps): bump github.com/charmbracelet/bubbletea ( #2917 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.3 to 0.26.4.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.3...v0.26.4 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-31 10:20:00 -04:00
Laurent Goderre
eeb4193d4a
Lua: Add support for more advanced syntax ( #2908 )
...
* Add lua/rocksepc support for variables substitution
* Lua: Skip expressions in rockspec packages
* Lua: Add support for concatenation of string and variables
* Lua: Skip expressions in local
* Lua: Skip build sections in Rockspec files
* Lua: skip function blocks in Rockspec
* Lua: Add support for multi variable per line
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-30 11:38:45 -04:00
anchore-actions-token-generator[bot] and spiffcs
5cf8cc9bc3
chore(deps): update tools to latest versions ( #2913 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-05-30 11:37:31 -04:00
Alex Goodman
f4a69e6d35
add relationships for go binary packages ( #2912 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-30 11:37:17 -04:00
Keith Zantow
ac34808b9c
feat: detect fluent-bit binaries ( #2905 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-05-28 10:13:06 -04:00
anchore-actions-token-generator[bot] and spiffcs
2b70ea3fc2
chore(deps): update tools to latest versions ( #2907 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-05-28 10:02:32 -04:00
dependabot[bot]
5eb1e7115f
chore(deps): bump docker/login-action from 3.1.0 to 3.2.0 ( #2909 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.1.0 to 3.2.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/e92390c5fb421da1463c202d546fed0ec5c39f20...0d4c9c5ea7693da7b068278f7b52bda2a190a446 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-28 09:57:32 -04:00
dependabot[bot]
774602f0d8
chore(deps): bump github.com/charmbracelet/bubbletea ( #2901 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.2 to 0.26.3.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.2...v0.26.3 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-25 16:30:48 -04:00
Jon Johnson and Will Murphy
c314e05aae
Handle GOEXPERIMENTs in go version ( #2893 )
...
* Handle GOEXPERIMENTs in go version
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev >
* bump JSON schema
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Jon Johnson <jon.johnson@chainguard.dev >
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: Will Murphy <will.murphy@anchore.com >
2024-05-25 20:23:30 +00:00
Alex Goodman
05e8ba948d
Add python wheel egg relationships ( #2903 )
...
* add python package relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* nil for empty relationships collections
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* new json schema for optional python requiremenets
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update format snapshots for python packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* decompose python parsers more + add tests around plural fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update JSON schema with python dep refs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-25 20:11:38 +00:00
dependabot[bot]
64e11d53e9
chore(deps): bump github.com/charmbracelet/lipgloss ( #2902 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.10.0 to 0.11.0.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.10.0...v0.11.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-25 16:07:25 -04:00
Laurent Goderre
b51252dbdb
feat: Add Lua cataloger ( #2613 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-24 16:56:34 -04:00
anchore-actions-token-generator[bot]
77b3f66404
chore(deps): update tools to latest versions ( #2900 )
2024-05-24 09:34:08 -04:00
Keith Zantow
1c37bab2b2
feat: add config command ( #2892 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-05-23 15:18:09 -04:00
Laurent Goderre
7071f1e498
feat: Added functionality to convert major, minor, patch to version for binary classifier ( #2864 )
...
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-23 12:17:12 -04:00
dependabot[bot]
3875e4a67d
chore(deps): bump github.com/knqyf263/go-rpmdb from 0.1.0 to 0.1.1 ( #2896 )
...
Bumps [github.com/knqyf263/go-rpmdb](https://github.com/knqyf263/go-rpmdb ) from 0.1.0 to 0.1.1.
- [Commits](https://github.com/knqyf263/go-rpmdb/compare/v0.1.0...v0.1.1 )
---
updated-dependencies:
- dependency-name: github.com/knqyf263/go-rpmdb
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-23 12:06:44 -04:00
a0f0332e30
chore(deps): update tools to latest versions ( #2887 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-05-23 13:39:09 +00:00
dependabot[bot]
ea50c6153d
--- ( #2889 )
...
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-23 09:26:12 -04:00
Christopher Angelo Phillips
b41d5cced5
chore: update spdx license list to 3.24.0 ( #2895 )
...
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-05-23 13:10:36 +00:00
dependabot[bot]
68daa42f86
--- ( #2888 )
...
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-23 08:11:03 -04:00
Russell Haering
2356787053
Go Mod Cataloger: Remove Replaced Packages ( #2891 )
...
When the goModCataloger processes a Replace directive it currently adds the new
package to the resulting package list, but does not remove the old one unless
the path is unchanged.
Based on an existing comment in the code, removing the old one seems to be the
intended behavior, and results in a more expected end-result, so this does so.
Signed-off-by: Russell Haering <russellhaering@gmail.com >
2024-05-22 14:26:40 -04:00
dependabot[bot]
2d318cffaa
chore(deps): bump actions/checkout from 4.1.5 to 4.1.6 ( #2879 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.5 to 4.1.6.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/44c2b7a8a4ea60a981eaca3cf939b5f4305c123b...a5ac7e51b41094c92402da3b24376905380afc29 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-20 13:46:57 -04:00
Alan Pope
49c458b113
chore: Reduce length of readme, moving lengthy content to the wiki ( #2882 )
...
* chore: Reduce length of readme, moving lengthy content to the wiki
https://github.com/anchore/syft/wiki
---------
Signed-off-by: Alan Pope <alan@popey.com >
2024-05-20 13:46:32 -04:00
dependabot[bot]
1144407591
chore(deps): bump github.com/docker/docker ( #2880 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.1.2+incompatible to 26.1.3+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.1.2...v26.1.3 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-20 12:30:50 -04:00
dependabot[bot]
15808fbd04
chore(deps): bump github.com/saferwall/pe from 1.5.2 to 1.5.3 ( #2881 )
...
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe ) from 1.5.2 to 1.5.3.
- [Release notes](https://github.com/saferwall/pe/releases )
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md )
- [Commits](https://github.com/saferwall/pe/compare/v1.5.2...v1.5.3 )
---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-20 12:25:05 -04:00
dependabot[bot]
13ae56e3ef
chore(deps): bump modernc.org/sqlite from 1.29.9 to 1.29.10 ( #2885 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.9 to 1.29.10.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.9...v1.29.10 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-20 11:59:28 -04:00
Russell Haering
1bec1fc5d3
fix: DecoderCollection discarding input from non-seekable Readers ( #2878 )
...
Signed-off-by: Russell Haering <russellhaering@gmail.com >
2024-05-16 15:17:11 -04:00
15c9fe092a
chore(deps): update tools to latest versions ( #2863 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* add tmate debug session
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add go tooling to bootstrap on mac
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 15:06:21 -04:00
Take
338ce51fd8
Fix outdated spdx links ( #2865 )
...
Signed-off-by: Takeru Tanaka <takeru.tt5672@gmail.com >
2024-05-14 17:58:36 +00:00
Alex Goodman
048df17e3d
Use values in relationship To/From fields ( #2871 )
...
* use pkg values in relationship fields
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add linter rule for using values in relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use new cmptest package for comparing relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create cmptest for common cmp.Diff options in test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* condense matches for relationship ruleguard
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove relationship type from rules
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore build tag
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* suggest using values
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* nil check pkgs
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:48:33 -04:00
Alex Goodman
7ad7627d5d
add support for RPM DB package relationships ( #2872 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:48:19 -04:00
Russell Haering
e767bcff4b
fix: capture dependencies when parsing SPDX SBOMs ( #2869 )
...
Signed-off-by: Russell Haering <russellhaering@gmail.com >
2024-05-14 09:57:48 -04:00
Alex Goodman
4a18895545
Add abstraction for adding relationships from package cataloger results ( #2853 )
...
* add internal dependency resolver
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor dependency relationship resolution to common object
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* replace cataloger decorator with generic processor
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* refactor resolver to be a single function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use common dependency specifier for debian
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use common dependency specifier for arch
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use common dependency specifier for alpine
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for generic pkg and rel assertions in testpkg helper
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* do not allow for empty results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* move stable deduplicate comment
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove relationship resolver type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-14 13:27:36 +00:00
dependabot[bot]
fae6f5d372
chore(deps): bump github/codeql-action from 3.25.4 to 3.25.5 ( #2867 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.4 to 3.25.5.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/ccf74c947955fd1cf117aef6a0e4e66191ef6f61...b7cec7526559c32f1616476ff32d17ba4c59b2d6 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-13 12:27:14 -04:00
Christopher Angelo Phillips
ee75aafa37
chore: fix small tooling error for go.mod ( #2868 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-05-13 11:47:21 -04:00
Alex Goodman
c200896a96
fix pruning binary packages when considering ELF packages ( #2862 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-09 19:35:22 +00:00
Brian Ebarb and Alex Goodman
4194a2cd34
feat: add relationships to ELF package discovery ( #2715 )
...
This PR adds DependencyOf relationships when ELF packages have been discovered by the binary cataloger. The discovered file.Executable type has a []ImportedLibraries that's read from the file when discovered by syft. By mapping these imported libraries back to the package collection, syft is able to create relationships showing which packages are dependencies of other packages by just reading metadata from the ELF executable.
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Brian Ebarb <ebarb.brian@sers.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-09 13:53:59 -04:00
Jörg Thalheim
74b01a1c38
README.md: link to official wiki ( #2858 )
...
This commit updates the the link from the former, unofficial nixos wiki page to the new https://wiki.nixos.org
ref: NixOS/foundation#113
Signed-off-by: Jörg Thalheim <joerg@thalheim.io >
2024-05-09 13:49:37 -04:00
William Murphy
b2ca5fbf89
fix Windows file paths in local go mod cache ( #2654 )
...
Previously, the file resolver was created from incorrect calls
(path.Join instead of filepath.Join) which resulted Go license searches
always missing on Windows. Use filepath.* functions when initializing
the Go config, and when the unindexed file resolver is being created.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-05-09 13:08:58 -04:00
dependabot[bot]
1892f24002
chore(deps): bump github.com/docker/docker ( #2859 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.1.1+incompatible to 26.1.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.1.1...v26.1.2 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-09 12:02:36 -04:00
dependabot[bot]
88aaab2841
chore(deps): bump github.com/charmbracelet/bubbletea ( #2860 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.1 to 0.26.2.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.1...v0.26.2 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-09 12:02:28 -04:00
dependabot[bot]
5044f48cd6
chore(deps): bump github/codeql-action from 3.25.3 to 3.25.4 ( #2855 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.3 to 3.25.4.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/d39d31e687223d841ef683f52467bd88e9b21c14...ccf74c947955fd1cf117aef6a0e4e66191ef6f61 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-08 10:33:38 -04:00
dependabot[bot]
6c2e8c8c4b
chore(deps): bump github.com/sassoftware/go-rpmutils from 0.3.0 to 0.4.0 ( #2856 )
...
Bumps [github.com/sassoftware/go-rpmutils](https://github.com/sassoftware/go-rpmutils ) from 0.3.0 to 0.4.0.
- [Release notes](https://github.com/sassoftware/go-rpmutils/releases )
- [Commits](https://github.com/sassoftware/go-rpmutils/compare/v0.3.0...v0.4.0 )
---
updated-dependencies:
- dependency-name: github.com/sassoftware/go-rpmutils
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-08 10:33:11 -04:00
Alex Goodman
ada8f009d2
Add relationships for ALPM packages (arch linux) ( #2851 )
...
* add alpm relationships
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* tweak reader linter rule to check for reader impl
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update JSON schema with alpm dependency information
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-07 13:29:46 -04:00
Laurent Goderre
e7b6284039
Add binary classifier for ArangoDB ( #2830 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-07 12:06:32 -04:00
dependabot[bot]
78625164c6
chore(deps): bump golang.org/x/net from 0.24.0 to 0.25.0 ( #2849 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.24.0 to 0.25.0.
- [Commits](https://github.com/golang/net/compare/v0.24.0...v0.25.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-07 12:05:43 -04:00
dependabot[bot]
c0635a77a9
chore(deps): bump actions/checkout from 4.1.4 to 4.1.5 ( #2850 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.4 to 4.1.5.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/0ad4b8fadaa221de15dcec353f45205ec38ea70b...44c2b7a8a4ea60a981eaca3cf939b5f4305c123b )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-07 12:05:33 -04:00
William Murphy
3713d97b7b
chore: use ruleguard to test for missing defer statements ( #2837 )
...
* chore: ruleguard to enforce defer use
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* fix go.mod location
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close in linux release identifier
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: better lint suggestion
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: refactor binary classifier to defer close
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in gentoo cataloger
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: make go license parsing defer close readers
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer closing readers in alpine apm parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in graalvm parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in debian package parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in alpm parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in executable file cataloger
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in javascript license parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: defer close readers in go mod parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-05-07 05:42:29 -04:00
Alex Goodman
430c55a5b0
remove homebrew update workflow ( #2846 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-06 15:38:12 -04:00
Alex Goodman
49e93646eb
Restore version file update on release ( #2844 )
...
* restore version file update on release
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* allow for shallower fetch depth
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-06 15:14:43 -04:00
Laurent Goderre
5ca26ed3ca
fix: Add missing CPE for traefik, memcached, and postgres binaries ( #2845 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-06 15:06:30 -04:00
Laurent Goderre
e353214ef8
Add detection for newer version of ErLang/OTP ( #2829 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-05-06 11:47:54 -04:00
Alex Goodman
a56eff90d6
fix ui race for package count ( #2839 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-06 11:45:52 -04:00
anchore-actions-token-generator[bot] and wagoodman
00ff3ffda9
chore(deps): update CPE dictionary index ( #2841 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: wagoodman <590471+wagoodman@users.noreply.github.com >
2024-05-06 11:44:19 -04:00
dependabot[bot]
9de533996e
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.8 to 6.5.9 ( #2842 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.8 to 6.5.9.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.8...v6.5.9 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-06 11:44:05 -04:00
dependabot[bot]
7aae7470e2
chore(deps): bump modernc.org/sqlite from 1.29.8 to 1.29.9 ( #2843 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.8 to 1.29.9.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.8...v1.29.9 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-06 11:43:55 -04:00
dependabot[bot]
d6604adaaf
chore(deps): bump github.com/charmbracelet/bubbletea ( #2838 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.26.0 to 0.26.1.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.26.0...v0.26.1 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-03 09:50:20 -04:00
Alex Goodman
34ca9a8412
add security policy ( #2835 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-05-02 14:45:17 +00:00
dependabot[bot]
f51b39ca04
chore(deps): bump actions/setup-go from 5.0.0 to 5.0.1 ( #2834 )
...
Bumps [actions/setup-go](https://github.com/actions/setup-go ) from 5.0.0 to 5.0.1.
- [Release notes](https://github.com/actions/setup-go/releases )
- [Commits](https://github.com/actions/setup-go/compare/0c52d547c9bc32b1aa3301fd7a9cb496313a4491...cdcb36043654635271a94b9a6d1392de5bb323a7 )
---
updated-dependencies:
- dependency-name: actions/setup-go
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-02 10:12:10 -04:00
anchore-actions-token-generator[bot] and kzantow
9bbb42620a
chore(deps): update stereoscope to 2e9894674185d121917b283f773c2b5830f8b360 ( #2831 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-05-02 09:38:23 -04:00
dependabot[bot]
0b4de3d0c7
chore(deps): bump github.com/charmbracelet/bubbletea ( #2833 )
...
Bumps [github.com/charmbracelet/bubbletea](https://github.com/charmbracelet/bubbletea ) from 0.25.0 to 0.26.0.
- [Release notes](https://github.com/charmbracelet/bubbletea/releases )
- [Commits](https://github.com/charmbracelet/bubbletea/compare/v0.25.0...v0.26.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbletea
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-02 09:36:49 -04:00
camcui and Christopher Phillips
80d196a8c9
chore: fix function name in comment ( #2771 )
...
Signed-off-by: camcui <cuishua@sina.cn >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-05-01 18:04:02 +00:00
William Murphy
ed40833b30
chore: enable go-critic deferInLoop lint ( #2825 )
...
The goal here is to be more careful about leaking file handles and other
resources.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-05-01 12:59:35 -04:00
William Murphy
93a7d2ee27
fix: better clean up of file handles ( #2823 )
...
* always close ELF cataloger file handles
The elf-binary-package-cataloger does its own file IO to account for the
possibility of a logical ELF package being broken across multiple
physical files. However, this casued it to skip the normal invocation
pattern in the generic cataloger code that prevented file leaks. Ensure
this cataloger always closes its file handles.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* defer closing of generic cataloger file handles
Otherwise, a panicking cataloger could leak file handles.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* add unit test for file closed on panic parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* make invoke parser a static function
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* push error logging down into invoke parser
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-05-01 12:58:17 -04:00
dependabot[bot]
93a99e36c2
chore(deps): bump github.com/docker/docker ( #2827 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.1.0+incompatible to 26.1.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.1.0...v26.1.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-05-01 11:03:31 -04:00
Keith Zantow
b0c88ddea9
fix(spdx): include required fields ( #2168 )
...
* fix(spdx): include required fields
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: missed update due to refactoring
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: update tools-golang
Signed-off-by: Keith Zantow <kzantow@gmail.com >
* chore: add test with packageVerificationCode included and excluded
Signed-off-by: Keith Zantow <kzantow@gmail.com >
---------
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-04-30 13:28:42 -04:00
Keith Zantow
047e31a969
fix: add correct vendor for dnsmasq CPE ( #2659 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-04-30 13:24:01 -04:00
guangwu and Christopher Phillips
25b55e1704
fix: close temp rpmdb file ( #2792 )
...
* fix: close temp rpmdb file and db
Signed-off-by: guoguangwu <guoguangwug@gmail.com >
* chore: fix linter
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: guoguangwu <guoguangwug@gmail.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-04-30 12:47:17 -04:00
dependabot[bot] and Christopher Phillips
02dc2dfa9b
chore(deps): bump github/codeql-action from 3.25.2 to 3.25.3 ( #2817 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.2 to 3.25.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8f596b4ae3cb3c588a5c46780b86dd53fef16c52...d39d31e687223d841ef683f52467bd88e9b21c14 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-04-30 16:27:14 +00:00
Alex Goodman
5b03788300
Fill in SPDX originator for all supported package types ( #2822 )
...
* add failing test + beef up doc comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* cover more metadata types in spdx originator processing
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-04-29 16:33:00 -04:00
dependabot[bot]
9901ea8fe9
chore(deps): bump anchore/sbom-action from 0.15.10 to 0.15.11 ( #2821 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.10 to 0.15.11.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/ab5d7b5f48981941c4c5d6bf33aeb98fe3bae38c...7ccf588e3cf3cc2611714c2eeae48550fbc17552 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-29 12:40:43 -04:00
Alex Goodman
87cd6c8c48
update spdx license list to 3.23 ( #2818 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-04-26 14:50:55 +00:00
William Murphy
d3310a1830
fix: re-use embedded union reader if possible ( #2814 )
...
* fix: re-use embedded union reader if possible
Previously, because file.LocationReadCloser embeds a ReadCloser that
might be a UnionReader, but doesn't implement the interface itself, the
type assertion would fall and Syft would fall back to io.ReadAll to
enable seeking on the underlying reader, resulting in a potentially
large extra allocation.
Instead, check whether the passed ReadCloser is a
file.LocationReadCloser, and if so, try to use the embedded ReadCloser
as a UnionReader.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* lint fix
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* Assert that underlying reader is returned
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-04-26 10:21:38 -04:00
Weston Steimel
8640f978ba
feat: index known CPEs for go modules ( #2816 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-26 09:55:05 -04:00
dependabot[bot]
13b06dad45
chore(deps): bump peter-evans/create-pull-request from 6.0.4 to 6.0.5 ( #2812 )
2024-04-25 10:32:10 -04:00
Weston Steimel
9604e3dc9c
feat: support multiple known CPEs in index ( #2813 )
...
It is possible that a given package has multiple known "official" CPEs
active in the dictionary at once, so the index should support a slice of
CPE strings per package
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-25 15:22:26 +01:00
anchore-actions-token-generator[bot] and kzantow
f2fc10aa86
chore(deps): update stereoscope to 8b297badafd5d81fa1187b26ae34dd2a7ce7e425 ( #2807 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-04-24 15:19:13 -04:00
dependabot[bot]
21b22555d2
chore(deps): bump actions/checkout from 4.1.3 to 4.1.4 ( #2809 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.3 to 4.1.4.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/1d96c772d19495a3b5c517cd2bc0cb401ea0529f...0ad4b8fadaa221de15dcec353f45205ec38ea70b )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-24 15:19:03 -04:00
dependabot[bot]
5326efcef1
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.3 to 0.5.4 ( #2810 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.3 to 0.5.4.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.3...v0.5.4 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-24 12:04:09 -04:00
Gijs Calis
b90e7f9437
Fix removing labels in 'Detect schema changes' job ( #2772 )
...
* Fix error messages for add & remove label
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com >
* Check if label exists on PR before removing
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com >
---------
Signed-off-by: Gijs Calis <51088038+GijsCalis@users.noreply.github.com >
2024-04-23 14:42:57 -04:00
dependabot[bot]
fbdd4ee015
chore(deps): bump github.com/docker/docker ( #2805 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.0.2+incompatible to 26.1.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.0.2...v26.1.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-23 14:32:34 -04:00
William Murphy
f154bf570d
Display which provider caused which error in output ( #2757 )
...
* Display which provider caused which error in output
Otherwise, the output is very difficult to parse.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* lint fix
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* bump stereoscope to v0.0.2
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-04-23 14:27:39 -04:00
Weston Steimel
99b58db497
fix: prefer non-deprecated CPEs and include jenkins plugins from plugins.jenkins.io ( #2806 )
...
Improves the logic for adding known CPEs for Jenkins plugins by
including `plugins.jenkins.io` and prefers non-deprecated CPEs
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-23 11:11:47 -04:00
Weston Steimel
8d960e62c6
feat: index known CPEs for PHP Composer packagist.org packages ( #2804 )
...
Indexes known CPEs from `packagist.org`
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-23 10:42:59 -04:00
dependabot[bot]
27a8a1be03
chore(deps): bump github/codeql-action from 3.25.1 to 3.25.2 ( #2802 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.1 to 3.25.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/c7f9125735019aa87cfc361530512d50ea439c71...8f596b4ae3cb3c588a5c46780b86dd53fef16c52 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-23 09:54:36 -04:00
dependabot[bot]
4ccbd17255
chore(deps): bump actions/upload-artifact from 4.3.2 to 4.3.3 ( #2803 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.2 to 4.3.3.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/1746f4ab65b179e0ea60a494b83293b640dd5bba...65462800fd760344b1a7b4382951275a0abb4808 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-23 09:54:28 -04:00
Weston Steimel
891e61a2ef
fix: improvements to known CPE index construction ( #2801 )
...
* fix: stop pre-filtering potential known CPE URLs
Previously when building the known CPE index, there was logic to
de-duplicate processing based on the normalized CPE name; however, this
means a significant number of known CPE's don't get indexed because the
first instance of that name didn't have a supported collection url but a
later one did. This isn't code that executes at runtime in syft so
de-duplicating the processing for performance isn't really necessary
here and it doesn't add much to the total runtime anyways
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
* fix: CPE index builder should extract and consider all reference urls
Previously the struct definition for CpeItem caused only the last URL
reference in the list to be kept and processed for inclusion in the
index
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
---------
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-23 09:28:18 -04:00
Keith Zantow
f7d3d552ce
fix: exclude known instrumentation jars from being erroneously identified ( #2796 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-04-22 15:03:17 -04:00
Weston Steimel
12ea9912b4
feat: index known cpes for PHP extensions ( #2777 )
...
Indexes known CPEs from `pecl.php.net` and `pear.php.net`
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-22 13:43:19 -04:00
dependabot[bot]
cf6f92f2c8
chore(deps): bump actions/checkout from 4.1.2 to 4.1.3 ( #2799 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.2 to 4.1.3.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/9bb56186c3b09b4f86b1c65136769dd318469633...1d96c772d19495a3b5c517cd2bc0cb401ea0529f )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-22 13:29:13 -04:00
William Murphy
6440f26b5a
fix: return empty string if dereferncing pom var fails ( #2797 )
...
Previously, Syft would attempt to dereference pom variables, but if it
detected a cycle or failed to get back to a non-variable value, it would
return the last variable. Instead, return an empty string. Otherwise,
certain jars will have versions like "${project.version}" in the SBOM,
which is not helpful.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-04-19 19:38:36 +00:00
dependabot[bot]
f2633800ce
chore(deps): bump github.com/docker/docker ( #2793 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.0.1+incompatible to 26.0.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.0.1...v26.0.2 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-19 15:06:57 -04:00
dependabot[bot]
4f227bf447
chore(deps): bump modernc.org/sqlite from 1.29.7 to 1.29.8 ( #2794 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.7 to 1.29.8.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.7...v1.29.8 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-19 15:06:44 -04:00
dependabot[bot]
d70eb3d04b
chore(deps): bump actions/upload-artifact from 4.3.1 to 4.3.2 ( #2795 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.1 to 4.3.2.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/5d5d22a31266ced268874388b861e4b58bb5c2f3...1746f4ab65b179e0ea60a494b83293b640dd5bba )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-19 15:06:32 -04:00
guangwu
fe4819bc08
chore: cleanup redundant code ( #2791 )
...
Signed-off-by: guoguangwu <guoguangwug@gmail.com >
2024-04-19 12:12:48 -04:00
anchore-actions-token-generator[bot] and spiffcs
b26b38d6c5
chore(deps): update tools to latest versions ( #2789 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-04-18 12:40:08 -04:00
dependabot[bot]
31969136e3
chore(deps): bump github.com/spdx/tools-golang from 0.5.3 to 0.5.4 ( #2790 )
...
Bumps [github.com/spdx/tools-golang](https://github.com/spdx/tools-golang ) from 0.5.3 to 0.5.4.
- [Release notes](https://github.com/spdx/tools-golang/releases )
- [Changelog](https://github.com/spdx/tools-golang/blob/main/RELEASE-NOTES.md )
- [Commits](https://github.com/spdx/tools-golang/compare/v0.5.3...v0.5.4 )
---
updated-dependencies:
- dependency-name: github.com/spdx/tools-golang
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-18 12:39:42 -04:00
dependabot[bot]
f6845474bd
chore(deps): bump github/codeql-action from 3.25.0 to 3.25.1 ( #2786 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.25.0 to 3.25.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/df5a14dc28094dc936e103b37d749c6628682b60...c7f9125735019aa87cfc361530512d50ea439c71 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-17 10:46:34 -04:00
dependabot[bot]
e1cadead1d
chore(deps): bump peter-evans/create-pull-request from 6.0.3 to 6.0.4 ( #2787 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 6.0.3 to 6.0.4.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/c55203cfde3e5c11a452d352b4393e68b85b4533...9153d834b60caba6d51c9b9510b087acf9f33f83 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-17 10:46:24 -04:00
William Murphy
3e71f46fc8
Fix: repeatedly dereference pom variables ( #2781 )
...
* Fix: repeatedly dereference pom variables
Previously, if there was more than one layer of variable indirection in
the pom property (propert A says it has the same value as property B,
property B says it has the same value as property C), then Syft would
only dereference one layer. Add a loop to dereference variables until
either dereferencing fails, or until the variable is completely
dereferenced back to a literal.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* switch to recursive implementation
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* add test cases for degenerate poms
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* switch to recursive implementation
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* remove redundant pieces of test cases
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-04-16 15:44:02 -04:00
dependabot[bot]
3b01e13f92
chore(deps): bump modernc.org/sqlite from 1.29.6 to 1.29.7 ( #2783 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.6 to 1.29.7.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.6...v1.29.7 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-16 11:05:35 -04:00
anchore-actions-token-generator[bot] and westonsteimel
25c2e60358
chore(deps): update CPE dictionary index ( #2780 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: westonsteimel <1593939+westonsteimel@users.noreply.github.com >
2024-04-15 11:15:38 -04:00
dependabot[bot]
dc7fa21980
chore(deps): bump github/codeql-action from 3.24.10 to 3.25.0 ( #2779 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.10 to 3.25.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/4355270be187e1b672a7a1c7c7bae5afdc1ab94a...df5a14dc28094dc936e103b37d749c6628682b60 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-15 10:00:54 -04:00
Weston Steimel
587690b875
chore: fix broken cpe index generation task ( #2778 )
...
Signed-off-by: Weston Steimel <commits@weston.slmail.me >
2024-04-15 09:39:57 -04:00
dependabot[bot]
21eaa5c82b
chore(deps): bump github.com/docker/docker ( #2773 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 26.0.0+incompatible to 26.0.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v26.0.0...v26.0.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-12 15:33:27 -04:00
dependabot[bot]
081ec04b3f
chore(deps): bump peter-evans/create-pull-request from 6.0.2 to 6.0.3 ( #2774 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 6.0.2 to 6.0.3.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/70a41aba780001da0a30141984ae2a0c95d8704e...c55203cfde3e5c11a452d352b4393e68b85b4533 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-12 15:31:36 -04:00
Keith Zantow and Will Murphy
dde5d349b1
fix: more robust go main version extraction ( #2767 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: Will Murphy <will.murphy@anchore.com >
2024-04-11 11:58:51 -04:00
anchore-actions-token-generator[bot] and spiffcs
a5d77b9263
chore(deps): update tools to latest versions ( #2768 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-04-11 11:53:55 -04:00
Laurent Goderre and Keith Zantow
c9aab4863b
fix: binary character in java version ( #2766 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Keith Zantow <kzantow@gmail.com >
Co-authored-by: Keith Zantow <kzantow@gmail.com >
2024-04-11 10:32:24 -04:00
anchore-actions-token-generator[bot] and spiffcs
af1a065d2a
chore(deps): update tools to latest versions ( #2760 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-04-09 12:03:12 -04:00
dependabot[bot]
88cef1e05c
chore(deps): bump modernc.org/sqlite from 1.29.5 to 1.29.6 ( #2761 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.5 to 1.29.6.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.5...v1.29.6 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-09 12:02:56 -04:00
dependabot[bot]
870d97ca5a
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.6 to 6.5.8 ( #2754 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.6 to 6.5.8.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.6...v6.5.8 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-08 12:19:45 -04:00
dependabot[bot]
e681bc4780
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.2 to 0.5.3 ( #2755 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.2 to 0.5.3.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.2...v0.5.3 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-08 12:19:32 -04:00
dependabot[bot]
c31696f131
chore(deps): bump github/codeql-action from 3.24.9 to 3.24.10 ( #2756 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.9 to 3.24.10.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/1b1aada464948af03b950897e5eb522f92603cc2...4355270be187e1b672a7a1c7c7bae5afdc1ab94a )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-08 12:19:20 -04:00
dependabot[bot]
67781e98a2
chore(deps): bump golang.org/x/mod from 0.16.0 to 0.17.0 ( #2751 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.16.0 to 0.17.0.
- [Commits](https://github.com/golang/mod/compare/v0.16.0...v0.17.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-05 19:22:00 +00:00
Laurent Goderre
619ace65c3
Differentiate between JRE and JDK ( #2748 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-05 15:10:58 -04:00
dependabot[bot]
3e4e3bb1d4
chore(deps): bump golang.org/x/net from 0.23.0 to 0.24.0 ( #2752 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.23.0 to 0.24.0.
- [Commits](https://github.com/golang/net/compare/v0.23.0...v0.24.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-05 15:10:15 -04:00
anchore-actions-token-generator[bot] and spiffcs
1e31356c49
chore(deps): update tools to latest versions ( #2744 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-04-04 10:34:19 -04:00
dependabot[bot]
0fa925e5af
chore(deps): bump golang.org/x/net from 0.22.0 to 0.23.0 ( #2747 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.22.0 to 0.23.0.
- [Commits](https://github.com/golang/net/compare/v0.22.0...v0.23.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-04 10:34:03 -04:00
Christopher Angelo Phillips
e100776f22
chore: update anchore/packageurl-go to use latest commits ( #2746 )
...
chore: update packageurl-go dependency to use latest commits
chore: go mod tidy
unit: update + -> %2B
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-04-04 10:33:51 -04:00
Laurent Goderre
e0233625cb
feat: cataloger for PHP Pecl and PEAR packages ( #2604 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-04-02 11:55:56 -04:00
dependabot[bot]
e0f5b5a787
chore(deps): bump github.com/go-git/go-git/v5 from 5.11.0 to 5.12.0 ( #2743 )
...
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git ) from 5.11.0 to 5.12.0.
- [Release notes](https://github.com/go-git/go-git/releases )
- [Commits](https://github.com/go-git/go-git/compare/v5.11.0...v5.12.0 )
---
updated-dependencies:
- dependency-name: github.com/go-git/go-git/v5
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-04-01 14:14:07 -04:00
anchore-actions-token-generator[bot] and spiffcs
9c42c83229
chore(deps): update tools to latest versions ( #2741 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-03-30 17:51:21 -04:00
Keith Zantow
01340b2a5c
fix: conan poco project cpe ( #2740 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-03-28 16:56:24 -04:00
dependabot[bot]
16edb40c72
chore(deps): bump github.com/distribution/reference from 0.5.0 to 0.6.0 ( #2738 )
...
Bumps [github.com/distribution/reference](https://github.com/distribution/reference ) from 0.5.0 to 0.6.0.
- [Release notes](https://github.com/distribution/reference/releases )
- [Commits](https://github.com/distribution/reference/compare/v0.5.0...v0.6.0 )
---
updated-dependencies:
- dependency-name: github.com/distribution/reference
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-28 12:22:00 -04:00
dependabot[bot]
5a865d0d90
chore(deps): bump anchore/sbom-action from 0.15.9 to 0.15.10 ( #2737 )
2024-03-27 17:52:22 +00:00
Keith Zantow
410867ca0c
fix: panic scanning binaries without symtab ( #2739 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-03-27 13:51:45 -04:00
guangwu
469b4c13bb
chore: remove useless code ( #2716 )
...
Signed-off-by: guoguangwu <guoguangwug@gmail.com >
2024-03-26 12:21:03 -04:00
dependabot[bot]
57e9cc52a4
chore(deps): bump google.golang.org/protobuf from 1.31.0 to 1.33.0 ( #2731 )
...
Bumps google.golang.org/protobuf from 1.31.0 to 1.33.0.
---
updated-dependencies:
- dependency-name: google.golang.org/protobuf
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-26 11:52:50 -04:00
dependabot[bot]
55fff0f4a1
chore(deps): bump github/codeql-action from 3.24.8 to 3.24.9 ( #2732 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.8 to 3.24.9.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/05963f47d870e2cb19a537396c1f668a348c7d8f...1b1aada464948af03b950897e5eb522f92603cc2 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-26 11:50:31 -04:00
anchore-actions-token-generator[bot] and spiffcs
2a7b4f3761
chore(deps): update tools to latest versions ( #2733 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-03-26 11:50:21 -04:00
dependabot[bot]
fe3704d4a9
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.5 to 6.5.6 ( #2734 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.5 to 6.5.6.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.5...v6.5.6 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-26 11:50:07 -04:00
Hung Nguyen
059cfd6730
update release token from readonly to write token ( #2735 )
...
Signed-off-by: Hung Nguyen <hung.tran.nguyen.585@gmail.com >
2024-03-26 09:06:55 -04:00
Colm O hEigeartaigh
f4e18961b9
Adding the ability to retrieve remote licenses from package.lock ( #2708 )
...
Signed-off-by: Colm O hEigeartaigh <coheigea@apache.org >
2024-03-21 13:20:04 -04:00
Alex Goodman
0d5ebed74a
dont include labels for dependabot ecosystems ( #2720 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-21 12:16:01 -04:00
dependabot[bot]
8f7305ef78
chore(deps): bump fountainhead/action-wait-for-check from 1.1.0 to 1.2.0 ( #2717 )
...
Bumps [fountainhead/action-wait-for-check](https://github.com/fountainhead/action-wait-for-check ) from 1.1.0 to 1.2.0.
- [Release notes](https://github.com/fountainhead/action-wait-for-check/releases )
- [Commits](https://github.com/fountainhead/action-wait-for-check/compare/297be350cf8393728ea4d4b39435c7d7ae167c93...5a908a24814494009c4bb27c242ea38c93c593be )
---
updated-dependencies:
- dependency-name: fountainhead/action-wait-for-check
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-21 12:15:30 -04:00
anchore-actions-token-generator[bot] and spiffcs
c199b80b88
chore(deps): update tools to latest versions ( #2726 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-03-21 12:15:06 -04:00
dependabot[bot]
df547020ef
chore(deps): bump github/codeql-action from 3.24.7 to 3.24.8 ( #2725 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.7 to 3.24.8.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/3ab4101902695724f9365a384f86c1074d94e18c...05963f47d870e2cb19a537396c1f668a348c7d8f )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-21 12:14:51 -04:00
dependabot[bot]
37094c9751
chore(deps): bump actions/cache from 4.0.1 to 4.0.2 ( #2728 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.0.1 to 4.0.2.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/ab5e6d0c87105b4c9c2047343972218f562e4319...0c45773b623bea8c8e75f6c82b208c3cf94ea4f9 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-21 12:14:43 -04:00
dependabot[bot]
c83556e7b6
chore(deps): bump github.com/docker/docker ( #2730 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 25.0.4+incompatible to 26.0.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v25.0.4...v26.0.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-21 12:14:32 -04:00
Hung Nguyen
3ac1cd7a9f
updating credentials to scoped permissions ( #2722 )
...
* updating credentials to scoped permissions
Signed-off-by: Hung Nguyen <hung.tran.nguyen.585@gmail.com >
---------
Signed-off-by: Hung Nguyen <hung.tran.nguyen.585@gmail.com >
2024-03-20 17:35:07 -04:00
dependabot[bot]
96d2b4a368
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.4 to 6.5.5 ( #2718 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.4 to 6.5.5.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.4...v6.5.5 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-15 10:33:11 -04:00
dependabot[bot]
807de976c4
chore(deps): bump github.com/google/go-containerregistry ( #2719 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.19.0 to 0.19.1.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.19.0...v0.19.1 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-15 10:32:51 -04:00
Laurent Goderre and Alex Goodman
cf17bd69b2
Add detection for Oracle GraalVM ( #2705 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-14 15:40:07 +00:00
dependabot[bot]
1c8d29d577
chore(deps): bump docker/login-action from 3.0.0 to 3.1.0 ( #2714 )
...
Bumps [docker/login-action](https://github.com/docker/login-action ) from 3.0.0 to 3.1.0.
- [Release notes](https://github.com/docker/login-action/releases )
- [Commits](https://github.com/docker/login-action/compare/343f7c4344506bcbf9b4de18042ae17996df046d...e92390c5fb421da1463c202d546fed0ec5c39f20 )
---
updated-dependencies:
- dependency-name: docker/login-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-14 11:16:16 -04:00
6a2517b5d2
Add ELF binary package cataloger ( #2396 )
...
* feat Adds Elf package catalogger
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
* Add test fixtures for elf package
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
* bump JSON schema to v16.0.6 + expand test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* less verbose logging
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove dead test code
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove unreleated swift change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Brian Ebarb <ebarb.brian@gmail.com >
Signed-off-by: Colleen Divers <colleen.divers@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Colleen Divers <colleen.divers@gmail.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-14 11:16:03 -04:00
dependabot[bot]
7ab6fc3fe4
chore(deps): bump modernc.org/sqlite from 1.29.3 to 1.29.5 ( #2710 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.3 to 1.29.5.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.3...v1.29.5 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-14 09:58:56 -04:00
dependabot[bot]
2051a62ded
chore(deps): bump github/codeql-action from 3.24.6 to 3.24.7 ( #2711 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.6 to 3.24.7.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/8a470fddafa5cbb6266ee11b37ef4d8aae19c571...3ab4101902695724f9365a384f86c1074d94e18c )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-14 09:58:42 -04:00
dependabot[bot]
5534c38d0f
chore(deps): bump peter-evans/create-pull-request from 6.0.1 to 6.0.2 ( #2712 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 6.0.1 to 6.0.2.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/a4f52f8033a6168103c2538976c07b467e8163bc...70a41aba780001da0a30141984ae2a0c95d8704e )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-13 13:47:47 -04:00
Alex Goodman
47fc909700
Show binary exports, entrypoint, and imports ( #2626 )
...
show binary exports, entrypoint, and imports for macho, elf, and pe formats
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-03-12 22:04:02 +00:00
dependabot[bot]
2e2a9377ea
chore(deps): bump actions/checkout from 4.1.1 to 4.1.2 ( #2703 )
...
Bumps [actions/checkout](https://github.com/actions/checkout ) from 4.1.1 to 4.1.2.
- [Release notes](https://github.com/actions/checkout/releases )
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md )
- [Commits](https://github.com/actions/checkout/compare/b4ffde65f46336ab88eb53be808477a3936bae11...9bb56186c3b09b4f86b1c65136769dd318469633 )
---
updated-dependencies:
- dependency-name: actions/checkout
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-12 13:18:44 -04:00
dependabot[bot]
4ca79c7626
chore(deps): bump github.com/knqyf263/go-rpmdb ( #2701 )
...
Bumps [github.com/knqyf263/go-rpmdb](https://github.com/knqyf263/go-rpmdb ) from 0.0.0-20230301153543-ba94b245509b to 0.1.0.
- [Commits](https://github.com/knqyf263/go-rpmdb/commits/v0.1.0 )
---
updated-dependencies:
- dependency-name: github.com/knqyf263/go-rpmdb
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-11 11:48:05 -04:00
guangwu
3743f5ae53
chore: reduce duplicate case SwiftPkg ( #2696 )
...
Signed-off-by: guoguangwu <guoguangwug@gmail.com >
2024-03-07 18:15:31 +00:00
guangwu
ebb9d4edb6
chore: remove deprecated os.SEEK_SET os.SEEK_CUR ( #2693 )
...
Signed-off-by: guoguangwu <guoguangwug@gmail.com >
2024-03-07 13:10:48 -05:00
dependabot[bot]
e2a9d891b2
chore(deps): bump github.com/docker/docker ( #2698 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 25.0.3+incompatible to 25.0.4+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v25.0.3...v25.0.4 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-07 13:00:14 -05:00
dependabot[bot]
5b09c154bb
chore(deps): bump modernc.org/sqlite from 1.29.2 to 1.29.3 ( #2699 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.2 to 1.29.3.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.2...v1.29.3 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-07 13:00:02 -05:00
dependabot[bot]
1b121ac3f4
chore(deps): bump golang.org/x/net from 0.21.0 to 0.22.0 ( #2689 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.21.0 to 0.22.0.
- [Commits](https://github.com/golang/net/compare/v0.21.0...v0.22.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-06 14:25:56 -05:00
Keith Zantow
f9e09aef19
docs: add simplest example from regsitry ( #2691 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-03-06 14:25:37 -05:00
anchore-actions-token-generator[bot] and spiffcs
d2ac672f8f
chore(deps): update tools to latest versions ( #2688 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-03-06 14:25:13 -05:00
dependabot[bot]
5e3fde04a5
chore(deps): bump anchore/sbom-action from 0.15.8 to 0.15.9 ( #2694 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.8 to 0.15.9.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/b6a39da80722a2cb0ef5d197531764a89b5d48c3...9fece9e20048ca9590af301449208b2b8861333b )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-06 14:24:56 -05:00
dependabot[bot]
e214645394
chore(deps): bump github.com/charmbracelet/lipgloss from 0.9.1 to 0.10.0 ( #2695 )
...
Bumps [github.com/charmbracelet/lipgloss](https://github.com/charmbracelet/lipgloss ) from 0.9.1 to 0.10.0.
- [Release notes](https://github.com/charmbracelet/lipgloss/releases )
- [Commits](https://github.com/charmbracelet/lipgloss/compare/v0.9.1...v0.10.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/lipgloss
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-06 14:24:46 -05:00
dependabot[bot]
5bd1cd5c13
chore(deps): bump golang.org/x/mod from 0.15.0 to 0.16.0 ( #2690 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.15.0 to 0.16.0.
- [Commits](https://github.com/golang/mod/compare/v0.15.0...v0.16.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-05 10:15:18 -05:00
dependabot[bot]
fe4f17286f
chore(deps): bump github.com/stretchr/testify from 1.8.4 to 1.9.0 ( #2684 )
...
Bumps [github.com/stretchr/testify](https://github.com/stretchr/testify ) from 1.8.4 to 1.9.0.
- [Release notes](https://github.com/stretchr/testify/releases )
- [Commits](https://github.com/stretchr/testify/compare/v1.8.4...v1.9.0 )
---
updated-dependencies:
- dependency-name: github.com/stretchr/testify
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-01 13:51:18 -05:00
dependabot[bot]
d7e58964ef
chore(deps): bump actions/cache from 4.0.0 to 4.0.1 ( #2685 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 4.0.0 to 4.0.1.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/13aacd865c20de90d75de3b17ebe84f7a17d57d2...ab5e6d0c87105b4c9c2047343972218f562e4319 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-01 13:50:49 -05:00
dependabot[bot]
59d54d6154
chore(deps): bump github/codeql-action from 3.24.5 to 3.24.6 ( #2686 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.5 to 3.24.6.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/47b3d888fe66b639e431abf22ebca059152f1eea...8a470fddafa5cbb6266ee11b37ef4d8aae19c571 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-03-01 13:50:34 -05:00
Christopher Angelo Phillips
4d0dd02d5a
chore: update stereoscope ( #2683 )
...
* chore: update stereoscope to account for traversal bug fix
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-29 13:32:18 -05:00
Harm Weites
356f7c92b4
fix: match OpenSSL letter releases ( #2682 )
...
* chore: match openssl 1.1 letter releases
Signed-off-by: Harm Weites <harm@weites.com >
* chore: include image sha
Signed-off-by: Harm Weites <harm@weites.com >
---------
Signed-off-by: Harm Weites <harm@weites.com >
2024-02-29 14:39:23 +00:00
Alex Goodman
6377465440
Mark duplicated rows in table output ( #2679 )
...
* mark duplicated rows in table output
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix unit test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-29 09:33:00 -05:00
William Murphy
3ad91f2678
fix: trim path from deps.json in portable way ( #2674 )
...
* fix: trim path from deps.json in portable way
Previously, the path trimming regex would leave leading path separator
in place on Windows.
Probably a better long term fix is to a library path operation.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-29 09:31:55 -05:00
anchore-actions-token-generator[bot] and spiffcs
5ef83fdc79
chore(deps): update tools to latest versions ( #2680 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-02-29 09:27:37 -05:00
Alex Goodman
06ff1a353a
enforce breaking change bump major version ( #2635 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-28 15:48:20 -05:00
Keith Zantow
326ec57d4a
docs: fix incorrect flag name in readme ( #2677 )
2024-02-28 15:39:43 -05:00
Alex Goodman
48e5672a87
Consider filesystem types for mount points when ignoring system paths ( #2675 )
...
* consider fs types for mount points when ignoring system paths
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address feedback
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-28 15:37:17 -05:00
William Murphy
63171b55dd
fix: stop emitting bus events on go mod events ( #2673 )
...
Previously, the TUI would hang when scanning directories with lots of go
packages, possibly because this path was spamming the TUI with too
many events. Since checking on a particular go module is fast, don't
show TUI events for each one.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-28 14:14:46 -05:00
dependabot[bot]
acc473fc30
chore(deps): bump peter-evans/create-pull-request from 6.0.0 to 6.0.1 ( #2676 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 6.0.0 to 6.0.1.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/b1ddad2c994a25fbc81a28b3ec0e368bb2021c50...a4f52f8033a6168103c2538976c07b467e8163bc )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-28 09:31:29 -05:00
Keith Zantow
a978966cad
feat: add --from flag, refactor source providers ( #2610 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-27 16:44:37 -05:00
dependabot[bot]
928511ea0f
chore(deps): bump modernc.org/sqlite from 1.29.1 to 1.29.2 ( #2671 )
2024-02-26 10:57:06 -05:00
dependabot[bot]
33b72ccbf8
chore(deps): bump github/codeql-action from 3.24.4 to 3.24.5 ( #2666 )
2024-02-23 14:10:26 +00:00
Keith Zantow
2995c3c4fd
fix: SPDX tag value version selector ( #2665 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-23 08:22:10 -05:00
Stefan Hacker
170ac079d4
fix(install): return appropriate error codes ( #2664 )
...
Signed-off-by: Stefan Hacker <mail@hacst.net >
2024-02-22 19:34:51 -05:00
Keith Zantow
108a5dae9b
chore: update busybox image for acceptance tests ( #2663 )
...
Signed-off-by: Keith Zantow <kzantow@gmail.com >
2024-02-22 15:32:17 -05:00
dependabot[bot]
cdf1e0bacb
chore(deps): bump github/codeql-action from 3.24.3 to 3.24.4 ( #2662 )
2024-02-22 16:50:53 +00:00
Alex Goodman
0c3b8ca4ed
rename binary classifier cataloger name ( #2643 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-20 13:52:11 -05:00
Alex Goodman
434b6ad506
add cataloger selection example ( #2646 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-20 11:44:42 -05:00
anchore-actions-token-generator[bot] and spiffcs
3598cb4f8f
chore(deps): update tools to latest versions ( #2651 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-02-20 11:39:54 -05:00
anchore-actions-token-generator[bot]
8260bce057
chore(deps): update stereoscope to 6171ee21e1d584f6bde910f354d126c9cd70deaa ( #2655 )
2024-02-17 10:22:56 -05:00
dependabot[bot]
578ac9cf2d
chore(deps): bump github/codeql-action from 3.24.1 to 3.24.3 ( #2649 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.1 to 3.24.3.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e675ced7a7522a761fc9c8eb26682c8b27c42b2b...379614612a29c9e28f31f39a59013eb8012a51f0 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-15 09:13:29 -05:00
Alex Goodman
a1b23bd57d
add syft version used to SBOM tool info by default ( #2647 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:57:31 -05:00
Alex Goodman
65cadda486
Survive indexing dead symlinks ( #2645 )
...
* survive indexing branches that start with a bad symlink
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add log statement
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 21:06:22 +00:00
Alex Goodman
a909e3cec9
fix considering base path when ignoring known bad unix paths ( #2644 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 15:57:38 -05:00
Alex Goodman
8e62ff9831
test for field conventions in json schema ( #2642 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 11:11:53 -05:00
Alexandr Hacicheant and Alex Goodman
96ee2db875
feat: Add Wordpress cataloger ( #2218 )
...
* Closes #1911 Wordpress cataloger
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed a few unit tests and static analizer notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `README.md`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `golangci-lint` notices
Added integration test for `wordpress-plugin`
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed `gosimports` notices
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated `json schema` version
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed CLI tests, increased expected package count
Signed-off-by: disc <a.hacicheant@gmail.com >
* Read first 4Kb of a plugins file's content
Signed-off-by: disc <a.hacicheant@gmail.com >
* replace JSON schema version
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change wording on source info for wordpress packages
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Minor changes after a huge refactoring
Signed-off-by: disc <a.hacicheant@gmail.com >
* Removed unused files
Signed-off-by: disc <a.hacicheant@gmail.com >
* Updated schema
Signed-off-by: disc <a.hacicheant@gmail.com >
* Fixed integration tests
Signed-off-by: disc <a.hacicheant@gmail.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* Renamed `metadata.Name` to `metadata.PluginInstallDirectory`
Signed-off-by: disc <a.hacicheant@gmail.com >
* rename fields to be compliant with json conventions
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: disc <a.hacicheant@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 16:03:25 +00:00
Alex Goodman
98b700e83c
rename binary cataloger to be more unique ( #2633 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-14 11:01:55 -05:00
Christopher Angelo Phillips
9803db2949
fix: update runner size to use larger HD for codeql ( #2641 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-14 10:31:05 -05:00
17ef243956
chore(deps): update tools to latest versions ( #2616 )
...
* chore(deps): update tools to latest versions
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix: update to new linter rules
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-14 14:59:49 +00:00
dependabot[bot]
3ac7369068
chore(deps): bump github/codeql-action from 3.24.0 to 3.24.1 ( #2638 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.24.0 to 3.24.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e8893c57a1f3a2b659b6b55564fdfdbbd2982911...e675ced7a7522a761fc9c8eb26682c8b27c42b2b )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-14 09:21:21 -05:00
dependabot[bot]
4d4efa4963
chore(deps): bump dawidd6/action-homebrew-bump-formula ( #2639 )
...
Bumps [dawidd6/action-homebrew-bump-formula](https://github.com/dawidd6/action-homebrew-bump-formula ) from 3.10.1 to 3.11.0.
- [Release notes](https://github.com/dawidd6/action-homebrew-bump-formula/releases )
- [Commits](https://github.com/dawidd6/action-homebrew-bump-formula/compare/75ed025ff3ad1d617862838b342b06d613a0ddf3...baf2b60c51fc1f8453c884b0c61052668a71bd1d )
---
updated-dependencies:
- dependency-name: dawidd6/action-homebrew-bump-formula
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-14 09:21:05 -05:00
dependabot[bot]
a7da2270c7
chore(deps): bump modernc.org/sqlite from 1.29.0 to 1.29.1 ( #2640 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.29.0 to 1.29.1.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.29.0...v1.29.1 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-14 09:20:54 -05:00
Keith Zantow
6288530835
fix: add BOMRef to CycloneDX OS Component ( #2634 )
2024-02-14 08:18:16 -05:00
dependabot[bot]
25d3c06962
chore(deps): bump github.com/saferwall/pe from 1.5.0 to 1.5.2 ( #2629 )
...
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe ) from 1.5.0 to 1.5.2.
- [Release notes](https://github.com/saferwall/pe/releases )
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md )
- [Commits](https://github.com/saferwall/pe/compare/v1.5.0...v1.5.2 )
---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-13 11:23:35 -05:00
dependabot[bot]
79b71be0ee
chore(deps): bump modernc.org/sqlite from 1.28.0 to 1.29.0 ( #2630 )
...
Bumps [modernc.org/sqlite](https://gitlab.com/cznic/sqlite ) from 1.28.0 to 1.29.0.
- [Commits](https://gitlab.com/cznic/sqlite/compare/v1.28.0...v1.29.0 )
---
updated-dependencies:
- dependency-name: modernc.org/sqlite
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-13 11:23:22 -05:00
Alex Goodman
25ae7bf55f
fix getting union reader for sif images ( #2631 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-13 15:12:31 +00:00
dependabot[bot]
e72dec8e9e
chore(deps): bump golang.org/x/net from 0.20.0 to 0.21.0 ( #2607 )
...
Bumps [golang.org/x/net](https://github.com/golang/net ) from 0.20.0 to 0.21.0.
- [Commits](https://github.com/golang/net/compare/v0.20.0...v0.21.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/net
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-12 14:31:44 -05:00
dependabot[bot]
3398e72066
chore(deps): bump github.com/saferwall/pe from 1.4.8 to 1.5.0 ( #2625 )
...
Bumps [github.com/saferwall/pe](https://github.com/saferwall/pe ) from 1.4.8 to 1.5.0.
- [Release notes](https://github.com/saferwall/pe/releases )
- [Changelog](https://github.com/saferwall/pe/blob/main/CHANGELOG.md )
- [Commits](https://github.com/saferwall/pe/compare/v1.4.8...v1.5.0 )
---
updated-dependencies:
- dependency-name: github.com/saferwall/pe
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-12 14:31:31 -05:00
Keith Zantow
d26a5c4d30
fix: ensure version output to stdout ( #2621 )
2024-02-09 20:59:25 +00:00
Alex Goodman
84576b93e1
Guess go main module version based on binary contents ( #2608 )
...
* guess go main module version based on binary contents
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add configuration options for golang main module version heuristics
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix test setup for go bin cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix unit test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix incorrect test assert ordering
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* handle error from seek
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-09 19:52:42 +00:00
737c4e44c5
chore(deps): update stereoscope to 681f6715b0e35686d6e6f40bce109176de1ee274 ( #2617 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-09 14:06:28 -05:00
Alex Goodman
7444a9f976
fix readme around templating options ( #2612 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-09 13:44:41 -05:00
Alex Goodman
8683cba081
suppress executable parsing issues ( #2614 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-09 17:13:58 +00:00
Christopher Angelo Phillips
c0f43e5e2d
chore: update license list, cpe dictionary ( #2620 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-09 11:31:42 -05:00
anchore-actions-token-generator[bot] and spiffcs
397cf210de
chore(deps): update tools to latest versions ( #2606 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-02-08 10:39:18 -05:00
Christopher Angelo Phillips
bd0cb916df
fix: incorrect conversion between integer types ( #2605 )
...
* chore: match strconv.ParseInt to file mode type
if a string is parsed into an int using strconv.Atoi,
and subsequently that int is converted into another integer type of a smaller size,
the result can produce unexpected values.
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-02-07 20:41:00 +00:00
dependabot[bot]
da31eed637
chore(deps): bump golang.org/x/mod from 0.14.0 to 0.15.0 ( #2602 )
...
Bumps [golang.org/x/mod](https://github.com/golang/mod ) from 0.14.0 to 0.15.0.
- [Commits](https://github.com/golang/mod/compare/v0.14.0...v0.15.0 )
---
updated-dependencies:
- dependency-name: golang.org/x/mod
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-07 11:31:49 -05:00
dependabot[bot]
704155eb22
chore(deps): bump github.com/docker/docker ( #2601 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 25.0.2+incompatible to 25.0.3+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v25.0.2...v25.0.3 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-07 11:31:41 -05:00
William Murphy
ce67927a98
Fix: unmarshal key values in Java, Go, and Conan metadata ( #2603 )
...
Previously, Syft represented several metadata fields as map[string]string,
however this representation erased ordering, so Syft now represents these values
as []KeyValue. Add custom unmarshaling so that JSON that was written by
older versions of Syft using the map[string]string representation can be parsed
into the new []KeyValue representation.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-07 11:26:23 -05:00
Weston Steimel
bbd34f61fd
fix(dotnet): prefer portable executable product version when semantically greater than file version ( #2600 )
...
Signed-off-by: Weston Steimel <weston.steimel@anchore.com >
2024-02-07 13:28:37 +00:00
Alex Goodman and mikey strauss
c61f59e7b7
Finalize Conan v2 support ( #2587 )
...
* Add support for conan lock v2 (#2461 )
* conan lock 2.x requires field support
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* PR review, struct renaming
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
* decompose conanlock parser + add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: houdini91 <mdstrauss91@gmail.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: mikey strauss <mdstrauss91@gmail.com >
2024-02-07 08:24:02 -05:00
anchore-actions-token-generator[bot] and spiffcs
00d6269e3c
chore(deps): update tools to latest versions ( #2595 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-02-06 10:48:01 -05:00
dependabot[bot]
0bc5971085
chore(deps): bump actions/upload-artifact from 4.3.0 to 4.3.1 ( #2597 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.3.0 to 4.3.1.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/26f96dfa697d77e81fd5907df203aa23a56210a8...5d5d22a31266ced268874388b861e4b58bb5c2f3 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-06 10:44:51 -05:00
anchore-actions-token-generator[bot] and kzantow
91d7a8a992
chore(deps): update stereoscope to bfa15e446f061bda7f68305d2d6240b053f17e0c ( #2589 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-02-05 10:27:12 -05:00
dependabot[bot]
05fa8ba4e9
chore(deps): bump actions/cache from 3.3.2 to 4.0.0 ( #2592 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 3.3.2 to 4.0.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/v3.3.2...13aacd865c20de90d75de3b17ebe84f7a17d57d2 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-05 10:26:55 -05:00
dependabot[bot]
e813a427b9
chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.0 to 0.5.2 ( #2591 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.5.0 to 0.5.2.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.5.0...v0.5.2 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-05 10:26:39 -05:00
dependabot[bot]
0618b2cb35
chore(deps): bump github/codeql-action from 3.23.2 to 3.24.0 ( #2593 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.23.2 to 3.24.0.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/b7bf0a3ed3ecfa44160715d7c442788f65f0f923...e8893c57a1f3a2b659b6b55564fdfdbbd2982911 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-05 09:46:22 -05:00
Alex Goodman
fd3844853a
labeler should ignore latest version ( #2588 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 18:08:15 -05:00
William Murphy
b735106848
chore: copy latest schema to stable path for easier diff ( #2586 )
...
Because we generate a new JSON schema file every time the schema version
changes, the git diff always shows that the file is completely new.
Therefore, every time the file is re-generated, also write the schema to
a stable path, so that the actual changes to the schema are easily
visible in the git diff of the latest schema file.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 17:09:28 -05:00
Asi Greenholts and Alex Goodman
98de2e2f62
Adding metadata fields when parsing yarn.lock and poetry.lock ( #2350 )
...
* Adding the resolved and integrity fields of yarn.lock to the parsed metadata. This addition is similar to the metadata added when parsing package-lock.json.
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* fix comment
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* Adding the Index field to metadeta when parsing poetry.lock similarly to the existing Pipfile metadata
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* fixing struct accoding to tests
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
* remove old schema change
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove empty constants
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* re-generate JSON schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update document ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: asi-cider <88270351+asi-cider@users.noreply.github.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 19:53:42 +00:00
Laurent Goderre and Alex Goodman
d7b9cc70b0
Add Erlang OTP Application cataloger ( #2403 )
...
* Add cataloger for Erlang OTP applications
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Add OTP Package type and Purl for ErLang
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* remove erlang OTP metadata type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use OTP purl type
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore otp fixture and adjust tests for dir-only results
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 13:40:18 -05:00
Alex Goodman
3023a5a7bc
Detect ELF security features ( #2443 )
...
* add detection of ELF security features
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix linting
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update json schema with file executable data
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* update expected fixure when no tty present
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* more detailed differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* use json differ
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove json schema addition
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* regenerate json schema
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix mimtype set ref
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 16:51:18 +00:00
Alex Goodman
3da679066e
Add API examples ( #2517 )
...
* [wip] initial syft api examples
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* smooth over some rough edges in the API
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* embed example file
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* address review comments
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* change name of builder function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-02 16:26:44 +00:00
William Murphy
b7a6d5e946
feat: Record where CPEs come from ( #2552 )
...
Syft can get CPEs from several source, including generating them based on
package data, finding them in the NVD CPE dictionary, or finding them declared
in a manifest or existing SBOM. Record where Syft got CPEs so that consumers of
SBOMs can reason about how trustworthy they are.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-02-02 16:17:52 +00:00
anchore-actions-token-generator[bot] and kzantow
4fe50f4169
chore(deps): update stereoscope to 37291e81936d2b43b3cef56667a741ef715fbfe4 ( #2583 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-02-02 10:27:26 -05:00
dependabot[bot]
78d362f91a
chore(deps): bump github.com/charmbracelet/bubbles from 0.17.1 to 0.18.0 ( #2584 )
...
Bumps [github.com/charmbracelet/bubbles](https://github.com/charmbracelet/bubbles ) from 0.17.1 to 0.18.0.
- [Release notes](https://github.com/charmbracelet/bubbles/releases )
- [Commits](https://github.com/charmbracelet/bubbles/compare/v0.17.1...v0.18.0 )
---
updated-dependencies:
- dependency-name: github.com/charmbracelet/bubbles
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-02 10:27:09 -05:00
Alex Goodman
5a9b664fef
swap format readseekers for readers ( #2581 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-01 14:18:13 -05:00
Alex Goodman
6107e5e2ad
translate maps to sequences in pkg metadata ( #2553 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-02-01 11:58:10 -05:00
anchore-actions-token-generator[bot] and spiffcs
fef0e54c0f
chore(deps): update tools to latest versions ( #2576 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: spiffcs <32073428+spiffcs@users.noreply.github.com >
2024-02-01 10:27:01 -05:00
dependabot[bot]
4a98f9fbd3
chore(deps): bump anchore/sbom-action from 0.15.7 to 0.15.8 ( #2578 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.7 to 0.15.8.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/767b08fd8822486ad890abb8f1d31721bebd651c...b6a39da80722a2cb0ef5d197531764a89b5d48c3 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 10:26:47 -05:00
dependabot[bot]
db49c145f0
chore(deps): bump marocchino/sticky-pull-request-comment ( #2579 )
...
Bumps [marocchino/sticky-pull-request-comment](https://github.com/marocchino/sticky-pull-request-comment ) from 2.8.0 to 2.9.0.
- [Release notes](https://github.com/marocchino/sticky-pull-request-comment/releases )
- [Commits](https://github.com/marocchino/sticky-pull-request-comment/compare/efaaab3fd41a9c3de579aba759d2552635e590fd...331f8f5b4215f0445d3c07b4967662a32a2d3e31 )
---
updated-dependencies:
- dependency-name: marocchino/sticky-pull-request-comment
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 10:26:37 -05:00
dependabot[bot]
3ac7e43e3e
chore(deps): bump github.com/docker/docker ( #2580 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 25.0.1+incompatible to 25.0.2+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v25.0.1...v25.0.2 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-02-01 10:26:25 -05:00
anchore-actions-token-generator[bot] and kzantow
216e211dc8
chore(deps): update stereoscope to db7a4bedaba6ad93becf22ce794f306dfb07fcb9 ( #2577 )
...
Signed-off-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: kzantow <3009477+kzantow@users.noreply.github.com >
2024-02-01 08:32:13 +00:00
William Murphy and Alex Goodman
bbddac1f9d
Fix attest with --key ( #2551 )
...
Fix passing "--key" to the attest command. Additionally, pull in an update to
the clio CLI library to permit unit testing that flags and env vars are parsed
to the correct field on command options structs. This testing strategy was
needed here because testing attestation in an end to end test requires a
prohibitive amount of setup.
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Will Murphy <will.murphy@anchore.com >
Co-authored-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-31 16:39:17 -05:00
Weston Steimel
3893f80052
fix(java): improve identification for org.apache.kafka artifacts ( #2573 )
...
Signed-off-by: Weston Steimel <weston.steimel@proton.me >
2024-01-31 16:34:56 -05:00
Christopher Angelo Phillips
630e7153e6
chore: pluralize the flag ( #2564 )
...
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-01-31 13:21:09 -05:00
anchore-actions-token-generator[bot] and spiffcs
28e9ee7106
chore(deps): update tools to latest versions ( #2566 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com >
2024-01-31 13:20:34 -05:00
dependabot[bot]
43837f47f5
chore(deps): bump peter-evans/create-pull-request from 5.0.2 to 6.0.0 ( #2567 )
...
Bumps [peter-evans/create-pull-request](https://github.com/peter-evans/create-pull-request ) from 5.0.2 to 6.0.0.
- [Release notes](https://github.com/peter-evans/create-pull-request/releases )
- [Commits](https://github.com/peter-evans/create-pull-request/compare/153407881ec5c347639a548ade7d8ad1d6740e38...b1ddad2c994a25fbc81a28b3ec0e368bb2021c50 )
---
updated-dependencies:
- dependency-name: peter-evans/create-pull-request
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-31 13:20:17 -05:00
dependabot[bot]
e880e6dcd6
chore(deps): bump anchore/sbom-action from 0.15.6 to 0.15.7 ( #2568 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.6 to 0.15.7.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/c6aed38a4323b393d05372c58a74c39ae8386d02...767b08fd8822486ad890abb8f1d31721bebd651c )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-31 13:19:50 -05:00
Alex Goodman
6ae5b2904d
re-add cosign signing checksums file ( #2572 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-31 13:19:41 -05:00
Alex Goodman
377538e4a6
revert cosign signing of release checksums file ( #2571 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-31 16:58:24 +00:00
Alex Goodman
bbe7fa180a
bump archiver and stereoscope ( #2570 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-31 11:24:33 -05:00
William Murphy
31e0fc36e3
fix: Better test for group ID in filename ( #2565 )
...
This fixes an issue where filenames containing a period that aren't a
group ID, such as some-jar.12.jar, would be mistakenly be reported as
having the name "12" by syft, instead of the name "some-jar.12".
It works by testing whether the parts of the filename split on "."
are all valid Java identifiers.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-01-31 08:21:33 -05:00
Alex Goodman
aa702a72b4
Sign checksums file and add SBOMs on release ( #2548 )
...
* with release signature of checksums file
* attach SBOMs to the release
* update acceptance tests
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-30 13:16:40 -05:00
dependabot[bot]
b113391638
chore(deps): bump anchore/sbom-action from 0.15.5 to 0.15.6 ( #2560 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.5 to 0.15.6.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/24b0d5238516480139aa8bc6f92eeb7b54a9eb0a...c6aed38a4323b393d05372c58a74c39ae8386d02 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-30 13:15:22 -05:00
dependabot[bot]
d4f31d6a3e
chore(deps): bump github.com/google/go-containerregistry ( #2561 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.18.0 to 0.19.0.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.18.0...v0.19.0 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-30 13:15:13 -05:00
dependabot[bot]
bd4bcc4e89
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.3 to 6.5.4 ( #2562 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.3 to 6.5.4.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.3...v6.5.4 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-30 13:15:06 -05:00
anchore-actions-token-generator[bot] and spiffcs
cf48c3a0c9
chore(deps): update tools to latest versions ( #2554 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com >
2024-01-29 12:32:53 -05:00
dependabot[bot]
b4f565a620
chore(deps): bump github.com/sassoftware/go-rpmutils from 0.2.0 to 0.3.0 ( #2556 )
...
Bumps [github.com/sassoftware/go-rpmutils](https://github.com/sassoftware/go-rpmutils ) from 0.2.0 to 0.3.0.
- [Release notes](https://github.com/sassoftware/go-rpmutils/releases )
- [Commits](https://github.com/sassoftware/go-rpmutils/compare/v0.2.0...v0.3.0 )
---
updated-dependencies:
- dependency-name: github.com/sassoftware/go-rpmutils
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-29 12:32:37 -05:00
dependabot[bot]
2e0149fd9e
chore(deps): bump 8398a7/action-slack from 3.15.1 to 3.16.2 ( #2557 )
...
Bumps [8398a7/action-slack](https://github.com/8398a7/action-slack ) from 3.15.1 to 3.16.2.
- [Release notes](https://github.com/8398a7/action-slack/releases )
- [Commits](https://github.com/8398a7/action-slack/compare/fbd6aa58ba854a740e11a35d0df80cb5d12101d8...28ba43ae48961b90635b50953d216767a6bea486 )
---
updated-dependencies:
- dependency-name: 8398a7/action-slack
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-29 12:32:30 -05:00
dependabot[bot]
87bbc507ee
chore(deps): bump github/codeql-action from 3.23.1 to 3.23.2 ( #2558 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.23.1 to 3.23.2.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/0b21cf2492b6b02c465a3e5d7c473717ad7721ba...b7bf0a3ed3ecfa44160715d7c442788f65f0f923 )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-29 12:32:22 -05:00
Alex Goodman
f893933336
internalize format helpers ( #2543 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-26 12:16:26 -05:00
Alex Goodman
b6cbf82389
Internalize CPE generation logic ( #2541 )
...
* migrate CPE generation logic to internal
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove create function
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-26 12:16:05 -05:00
anchore-actions-token-generator[bot] and spiffcs
7f90b8f1eb
chore(deps): update tools to latest versions ( #2550 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com >
2024-01-26 10:40:44 -05:00
Laurent Goderre
d7c51e5c82
Implement golang Purl subpath ( #2547 )
...
* Added test for golang package that include subpath into the module
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
* Implement golang purl subpath
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
---------
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-01-25 17:04:28 -05:00
Alex Goodman
414fb2f8ad
fix migration of integration test ( #2546 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-25 15:18:36 +00:00
Alex Goodman
a32b8d7fc6
Use the json schema as input for templating ( #2542 )
...
* use the json schema as input for templating
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix cli tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-25 14:00:35 +00:00
Alex Goodman
11c0b1c234
Unexport types and functions cataloger packages ( #2530 )
...
* unexport as many types and functions from cataloger packages as possible
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* capture type and signature information in convention test
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* check that we return pkg.Cataloger from constructors
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-24 16:12:46 -05:00
Alex Goodman
e0e1c4ba0a
Internalize majority of cmd package ( #2533 )
...
* internalize majority of cmd package and migrate integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add internal api encoder
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* create internal representation of all formats
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* export capability to get default encoders
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* restore test fixtures
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-24 13:29:51 -05:00
Alex Goodman
bf3cd9ed3b
allow for RPM modularity to be optional ( #2540 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-24 13:21:59 -05:00
dependabot[bot]
ad2843bf50
chore(deps): bump actions/upload-artifact from 4.2.0 to 4.3.0 ( #2536 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.2.0 to 4.3.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/694cdabd8bdb0f10b2cea11669e1bf5453eed0a6...26f96dfa697d77e81fd5907df203aa23a56210a8 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-24 10:11:43 -05:00
dependabot[bot]
0bb94099b0
chore(deps): bump github.com/google/uuid from 1.5.0 to 1.6.0 ( #2538 )
...
Bumps [github.com/google/uuid](https://github.com/google/uuid ) from 1.5.0 to 1.6.0.
- [Release notes](https://github.com/google/uuid/releases )
- [Changelog](https://github.com/google/uuid/blob/master/CHANGELOG.md )
- [Commits](https://github.com/google/uuid/compare/v1.5.0...v1.6.0 )
---
updated-dependencies:
- dependency-name: github.com/google/uuid
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-24 10:11:33 -05:00
dependabot[bot]
97d0108bd5
chore(deps): bump github.com/docker/docker ( #2537 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 25.0.0+incompatible to 25.0.1+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v25.0.0...v25.0.1 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-24 10:11:24 -05:00
William Murphy
878df69330
chore: stop re-exporting wfn.Attributes ( #2534 )
...
* chore: stop re-exporting wfn.Attributes
Previously, Syft re-exported wfn.Attributes from the nvdtools package as
a member of the Package struct. However, Syft doesn't own this struct,
and so after Syft 1.0, might be forced to bump a semver major version
due to a breaking change in wfn.Attributes. Rather than incur this risk
going into 1.0, instead replace Syft's use of wfn.Attributes with Syft's
own cpe.CPE type. That type has some pass-through calls to
wfn.Attributes, but hides the dependency from the rest of the
application.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
* chore: make cpe.CPE type a Stringer
Previously, the cpe.CPE type was an alias for wfn.Attributes from
nvdtools. Now that it is a type we control, make the String method take
the CPE as a receiver, rather than as a normal parameter, so that Syft's
cpe.CPE type implements Stringer.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
---------
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-01-24 08:59:03 -05:00
Alex Goodman
0fe13888d5
swap format readseekers for readers ( #2515 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-23 16:44:57 -05:00
dependabot[bot]
8e39ca6dfc
chore(deps): bump anchore/sbom-action from 0.15.4 to 0.15.5 ( #2531 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.4 to 0.15.5.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/41f7a6c033dbcdf78917f23b652c8b8146298c85...24b0d5238516480139aa8bc6f92eeb7b54a9eb0a )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-23 10:14:05 -05:00
dependabot[bot]
935b885ba2
chore(deps): bump github.com/gkampitakis/go-snaps from 0.4.12 to 0.5.0 ( #2532 )
...
Bumps [github.com/gkampitakis/go-snaps](https://github.com/gkampitakis/go-snaps ) from 0.4.12 to 0.5.0.
- [Release notes](https://github.com/gkampitakis/go-snaps/releases )
- [Commits](https://github.com/gkampitakis/go-snaps/compare/v0.4.12...v0.5.0 )
---
updated-dependencies:
- dependency-name: github.com/gkampitakis/go-snaps
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-23 10:13:51 -05:00
Alex Goodman
cdad5e767a
plumb context through catalogers ( #2528 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 15:54:51 -05:00
Alex Goodman
c5d15d1d6c
Remove CLI and API deprecations ( #2508 )
...
* remove api deprecations
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* remove deprecated NAME cli flag
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 12:55:30 -05:00
Alex Goodman
03b7938fbf
Turn off the SBOM cataloger by default ( #2527 )
...
* turn off the SBOM cataloger by default
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix integration tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 12:32:45 -05:00
Alex Goodman
4c77783461
Re-introduce linux kernel cataloger ( #2526 )
...
* re-add linux kernel cataloger
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* ensure there is at least a directory or image tag on each task
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* fix CLI tests to account for kernel finding (+2)
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-22 16:31:41 +00:00
William Murphy
c6ce1de928
make AllLocations accept a context ( #2518 )
...
The previous implementation would leak a goroutine if the caller of
AllLocations stopped iterating early. Now, accept a context so that the
caller can cancel the AllLocations iterator rather than leak the
goroutine.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-01-22 11:05:59 -05:00
anchore-actions-token-generator[bot] and wagoodman
3046d43a8a
chore(deps): update CPE dictionary index ( #2523 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: wagoodman <wagoodman@users.noreply.github.com >
2024-01-22 08:32:31 -05:00
Dan Luhring
df582e8463
fix: minor cataloger and docs nits ( #2519 )
...
Signed-off-by: Dan Luhring <dluhring@chainguard.dev >
2024-01-19 17:29:47 -05:00
Alex Goodman
3eab5932e5
Deduplicate digests from user configuration ( #2522 )
...
* deduplicate digests from user configuration
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* backout pointer reciever change on imageSource
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-19 21:51:55 +00:00
Alex Goodman
0bc31f4e27
update readme and help output to be accurate to syft api ( #2520 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-19 16:18:47 -05:00
Christopher Angelo Phillips
22f3a29fd7
fix: remove second call to finalize as the task handles it ( #2516 )
...
* fix: remove second call to finalize as the task handles it
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
* test: add test to protect against dupe relationships in final SBOM
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-01-19 14:12:29 -05:00
anchore-actions-token-generator[bot] and kzantow
969b5f1764
chore(deps): update stereoscope to eb656fc717935ad5abeb8e1379a5c4e11c957120 ( #2510 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: kzantow <kzantow@users.noreply.github.com >
2024-01-19 10:25:31 -05:00
dependabot[bot]
1b6c2470b0
chore(deps): bump github.com/docker/docker ( #2512 )
...
Bumps [github.com/docker/docker](https://github.com/docker/docker ) from 24.0.7+incompatible to 25.0.0+incompatible.
- [Release notes](https://github.com/docker/docker/releases )
- [Commits](https://github.com/docker/docker/compare/v24.0.7...v25.0.0 )
---
updated-dependencies:
- dependency-name: github.com/docker/docker
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-19 10:04:07 -05:00
dependabot[bot]
ec802dfc80
chore(deps): bump actions/upload-artifact from 4.1.0 to 4.2.0 ( #2513 )
...
Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact ) from 4.1.0 to 4.2.0.
- [Release notes](https://github.com/actions/upload-artifact/releases )
- [Commits](https://github.com/actions/upload-artifact/compare/1eb3cb2b3e0f29609092a73eb033bb759a334595...694cdabd8bdb0f10b2cea11669e1bf5453eed0a6 )
---
updated-dependencies:
- dependency-name: actions/upload-artifact
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-19 09:31:12 -05:00
dependabot[bot]
8845c938ce
chore(deps): bump anchore/sbom-action from 0.15.3 to 0.15.4 ( #2514 )
...
Bumps [anchore/sbom-action](https://github.com/anchore/sbom-action ) from 0.15.3 to 0.15.4.
- [Release notes](https://github.com/anchore/sbom-action/releases )
- [Commits](https://github.com/anchore/sbom-action/compare/c7f031d9249a826a082ea14c79d3b686a51d485a...41f7a6c033dbcdf78917f23b652c8b8146298c85 )
---
updated-dependencies:
- dependency-name: anchore/sbom-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-19 09:28:37 -05:00
dependabot[bot]
308dc6f9b8
chore(deps): bump github/codeql-action from 3.23.0 to 3.23.1 ( #2506 )
...
Bumps [github/codeql-action](https://github.com/github/codeql-action ) from 3.23.0 to 3.23.1.
- [Release notes](https://github.com/github/codeql-action/releases )
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md )
- [Commits](https://github.com/github/codeql-action/compare/e5f05b81d5b6ff8cfa111c80c22c5fd02a384118...0b21cf2492b6b02c465a3e5d7c473717ad7721ba )
---
updated-dependencies:
- dependency-name: github/codeql-action
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-18 09:45:04 -05:00
dependabot[bot]
42dd04699f
chore(deps): bump github.com/google/go-containerregistry ( #2507 )
...
Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry ) from 0.17.0 to 0.18.0.
- [Release notes](https://github.com/google/go-containerregistry/releases )
- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml )
- [Commits](https://github.com/google/go-containerregistry/compare/v0.17.0...v0.18.0 )
---
updated-dependencies:
- dependency-name: github.com/google/go-containerregistry
dependency-type: direct:production
update-type: version-update:semver-minor
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-18 09:44:45 -05:00
William Murphy
c816c73341
chore: enable automatic approval of dependabot PRs ( #2505 )
...
To reduce toil in this repo, enable dependabot PRs to be automatically
approved, but not merged. They are not automatically merged because if
the default GitHub token is used to automatically merge a PR, the
resulting commit will not trigger workflows on main. Rather than
generate a more potent token, just automatically review them, which
reduces toil by eliminating several clicks and page loads for
maintainers who are trying to merge dependabot PRs.
Signed-off-by: Will Murphy <will.murphy@anchore.com >
2024-01-18 08:35:23 -05:00
Alex Goodman
297ece6904
include binary cataloger configuration defaults ( #2504 )
...
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
2024-01-17 17:06:37 +00:00
Laurent Goderre
5602c80edb
feat: classifier for wordpress cli binary ( #2473 )
...
Signed-off-by: Laurent Goderre <laurent.goderre@docker.com >
2024-01-17 11:42:03 -05:00
dependabot[bot]
fe271e89f6
chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.5.2 to 6.5.3 ( #2502 )
...
Bumps [github.com/jedib0t/go-pretty/v6](https://github.com/jedib0t/go-pretty ) from 6.5.2 to 6.5.3.
- [Release notes](https://github.com/jedib0t/go-pretty/releases )
- [Commits](https://github.com/jedib0t/go-pretty/compare/v6.5.2...v6.5.3 )
---
updated-dependencies:
- dependency-name: github.com/jedib0t/go-pretty/v6
dependency-type: direct:production
update-type: version-update:semver-patch
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-17 10:07:57 -05:00
dependabot[bot]
0409eef615
chore(deps): bump actions/cache from 3.3.3 to 4.0.0 ( #2503 )
...
Bumps [actions/cache](https://github.com/actions/cache ) from 3.3.3 to 4.0.0.
- [Release notes](https://github.com/actions/cache/releases )
- [Changelog](https://github.com/actions/cache/blob/main/RELEASES.md )
- [Commits](https://github.com/actions/cache/compare/e12d46a63a90f2fae62d114769bbf2a179198b5c...13aacd865c20de90d75de3b17ebe84f7a17d57d2 )
---
updated-dependencies:
- dependency-name: actions/cache
dependency-type: direct:production
update-type: version-update:semver-major
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-17 10:07:41 -05:00
anchore-actions-token-generator[bot] and spiffcs
bdda3481c7
chore(deps): update tools to latest versions ( #2500 )
...
Signed-off-by: GitHub <noreply@github.com >
Co-authored-by: spiffcs <spiffcs@users.noreply.github.com >
2024-01-17 10:33:11 +00:00
dependabot[bot]
6f4fb61a1c
chore(deps): bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 ( #2501 )
...
Bumps [github.com/cloudflare/circl](https://github.com/cloudflare/circl ) from 1.3.3 to 1.3.7.
- [Release notes](https://github.com/cloudflare/circl/releases )
- [Commits](https://github.com/cloudflare/circl/compare/v1.3.3...v1.3.7 )
---
updated-dependencies:
- dependency-name: github.com/cloudflare/circl
dependency-type: indirect
...
Signed-off-by: dependabot[bot] <support@github.com >
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2024-01-17 10:08:51 +00:00
313d9212b6
Add cataloger list command ( #2366 )
...
* add cataloger list command
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* add tests
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
* chore: tidy go mod
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
---------
Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com >
Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com >
Co-authored-by: Christopher Angelo Phillips <32073428+spiffcs@users.noreply.github.com >
Co-authored-by: Christopher Phillips <christopher.phillips@anchore.com >
2024-01-16 09:41:58 -05:00
Alex Goodman
fb2b54a6dc
condense binary cataloger config in JSON output ( #2499 )
2024-01-16 09:18:18 -05:00
