# only pull in version updates that were released more than a week ago (low-pass filter for quickly-retracted releases)
cooldown: 7d

# Most tools (binny, chronicle, cosign, golangci-lint, goreleaser, gosimports,
# bouncer, quill, syft, task, gh) are inherited from anchore/go-make's embedded
# .binny.yaml — see https://github.com/anchore/go-make. Only syft-specific tools
# or version overrides should live here.
tools:
  # used in integration tests to verify JSON schemas
  - name: yajsv
    version:
      want: v1.4.1
    method: github-release
    with:
      repo: neilpa/yajsv

  # used to upload test fixture cache
  - name: oras
    version:
      want: v1.3.1
    method: github-release
    with:
      repo: oras-project/oras

  # used to parse JSON/YAML annotations on the fixture cache image
  - name: yq
    version:
      want: v4.52.5
    method: github-release
    with:
      repo: mikefarah/yq