fix(deps): update module github.com/anchore/syft to v1 #2343

renovate · 2024-02-29T17:52:48Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/syft	`v0.100.0` -> `v1.4.1`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

anchore/syft (github.com/anchore/syft)

`v1.4.1`

Compare Source

Bug Fixes

Fix redundant package deletions when considering ELF packages [#2862 @wagoodman]

(Full Changelog)

`v1.4.0`

Compare Source

Added Features

Add detection for newer version of ErLang/OTP [#2829 @LaurentGoderre]
Add missing CPE for traefik, memcached, and postgres binaries [#2845 @LaurentGoderre]
Add binary classifier for ArangoDB [#2830 @LaurentGoderre]
Add relationships to ELF packages [#2715 @brian-ebarb]
Add relationships for ALPM packages (arch linux) [#2851 @wagoodman]

Bug Fixes

close temp rpmdb file [#2792 @testwill]
fix Windows file paths in local go mod cache [#2654 @willmurphyscode]
Package Count doesn't match list of packages [#2304 #2839 @wagoodman]
New version 1.3.0 leads to "too many open files" while scanning bigger images [#2819 #2823 @willmurphyscode]
license_info_in_file is mandatory in SPDX-2.2 [#2163 #2168 @kzantow]
Wrong CPE for dnsmasq [#2636 #2659 @kzantow]
SPDX originator is not always populated [#2632 #2822 @wagoodman]

Additional Changes

Improve linting for defer Close type issues [#2826]
use ruleguard to test for missing defer statements [#2837 @willmurphyscode]
Publish security policy [#2835 @wagoodman]
fix function name in comment [#2771 @camcui]
enable go-critic deferInLoop lint [#2825 @willmurphyscode]

(Full Changelog)

`v1.3.0`

Compare Source

Added Features

index known CPEs for go modules [#2816 @westonsteimel]
support multiple known CPEs in index [#2813 @westonsteimel]
index known CPEs for PHP Composer packagist.org packages [#2804 @westonsteimel]
index known cpes for PHP extensions [#2777 @westonsteimel]

Bug Fixes

re-use embedded union reader if possible [#2814 @willmurphyscode]
prefer non-deprecated CPEs and include jenkins plugins from plugins.jenkins.io [#2806 @westonsteimel]
improvements to known CPE index construction [#2801 @westonsteimel]
Syft panics when scanning OCI image that contains packaged helm chart [#2745 #2757 @willmurphyscode]
Pom parser not resolving all dependency versions [#2776 #2781 @willmurphyscode]
exclude known instrumentation jars from being erroneously identified [#2796 @kzantow]
return empty string if dereferncing pom var fails [#2797 @willmurphyscode]

(Full Changelog)

`v1.2.0`

Compare Source

Added Features

Differentiate between JRE and JDK [#2748 @LaurentGoderre]
Add support for dnf packages [#2758]

Bug Fixes

more robust go main version extraction [#2767 @kzantow]
Regression in 1.1 cataloging openjdk: generates version containing a null byte [#2750 #2766 @LaurentGoderre]

(Full Changelog)

`v1.1.1`

Compare Source

Bug Fixes

update anchore/packageurl-go to use latest commits [#2746 @spiffcs]
fix panic scanning binaries without symtab [#2736 #2739 @kzantow]

(Full Changelog)

`v1.1.0`

Compare Source

Added Features

Adding the ability to retrieve remote licenses from package-lock.json [#2708 @coheigea]
Show binary exports, entrypoint, and imports [#2626 @wagoodman]
Add detection for Oracle GraalVM [#2705 @LaurentGoderre]

Bug Fixes

reduce duplicate case SwiftPkg [#2696 @testwill]

(Full Changelog)

`v1.0.1`

Compare Source

Bug Fixes

Unable to scan OCI images with syft v0.105.1 [#2678 #2683 @spiffcs]

(Full Changelog)

`v1.0.0`

Compare Source

🎉 Checkout the blog post about v1!

Added Features

Allow source type input via CLI flag (not scheme) [#1783 #2610 @kzantow]

Bug Fixes

OpenSSL binary matcher fails to properly detect letter releases [#2681 #2682 @harmw]
TUI package count does not match package count in default table output [#2672 #2679 @wagoodman]
.NET NuGet - dotnet-deps cataloger not working with syft v0.94.0 [#2264 #2674 @willmurphyscode]
New path filtering logic excluding large number of unintended paths [#2667 #2675 @wagoodman]
Syft TUI can hang when using license fetching from go modules [#2653 #2673 @willmurphyscode]

(Full Changelog)

`v0.105.1`

Compare Source

Bug Fixes

return error codes from install script [#2664 @hacst]
SPDX tag value version selector [#2665 @kzantow]

Additional Changes

Add syft version used to SBOM tool info by default [#2647 @wagoodman]

(Full Changelog)

`v0.105.0`

Compare Source

Added Features

Guess go main module version based on binary contents [#2608 @wagoodman]
Catalog wordpress plugins [#1911 #2218 @disc]

Bug Fixes

ensure version output to stdout [#2621 @kzantow]
Survive indexing dead symlinks [#2645 @wagoodman]
unable to index filesystem for amazonlinux images [#2627 #2644 @wagoodman]
CycloneDX OS component does not have a bom-ref [#2101 #2634 @kzantow]
v0.104.0 interface conversion error when creating bom from singularity image [#2628 #2631 @wagoodman]

Additional Changes

Rename binary cataloger to be more unique [#2633 @wagoodman]
Suppress executable parsing issues [#2614 @wagoodman]
update license list, cpe dictionary [#2620 @spiffcs]

(Full Changelog)

`v0.104.0`

Compare Source

Added Features

Adding metadata fields when parsing yarn.lock and poetry.lock [#2350 @asi-cider]
Add Erlang OTP Application cataloger [#2403 @LaurentGoderre]
Support Conan lockfiles v0.5 [#2050]
Identify security-features-of-interest within binaries [#2434 #2443 @wagoodman]
Top-level API should be more composable [#558 #2517 @wagoodman]
Annotate where each CPE on a package is sourced from [#2282 #2552 @willmurphyscode]

Bug Fixes

unmarshal key values in Java, Go, and Conan metadata [#2603 @willmurphyscode]
incorrect conversion between integer types [#2605 @spiffcs]
prefer portable executable product version when semantically greater than file version [#2600 @westonsteimel]
Stop iterating maps in catalogers [#2405 #2553 @wagoodman]
unknown flag: --key when use syft attest --key [KEY] [#2544 #2551 @willmurphyscode]
purl generation broken for kafka jars [#2385 #2573 @westonsteimel]

Breaking Changes

Top-level API should be more composable [#558 #2517 @wagoodman]
Annotate where each CPE on a package is sourced from [#2282 #2552 @willmurphyscode]

(Full Changelog)

`v0.103.1`

Compare Source

Security Fixes

Bump archiver and stereoscope to address path traversal issues [#2570 @wagoodman]

Bug Fixes

Revert cosign signing of release checksums file [#2571 @wagoodman]
java archive parser incorrectly splitting filenames [#2563 #2565 @willmurphyscode]

Breaking Changes

Internalize format helpers [#2543 @wagoodman]
Internalize CPE generation logic [#2541 @wagoodman]

(Full Changelog)

`v0.103.0`

Compare Source

`v0.102.0`

Compare Source

Added Features

Swap format uses of io.ReadSeeker for io.Reader [#2515 @wagoodman]
Cataloger interface should accept context.Context [#2521 #2528 @wagoodman]

Bug Fixes

Implement golang Purl subpath [#2547 @LaurentGoderre]
CPE definition on pkg.Package is coupled to an external package as a type alias [#2529 #2534 @willmurphyscode]
Turn off SBOM cataloger by default [#1555 #2527 @wagoodman]
Syft missing linux kernel archives from SBOM results [#2524 #2526 @wagoodman]
LocationResolver can leak goroutines [#2487 #2518 @willmurphyscode]
Duplicates in Syft JSON "artifactRelationships" [#2251]

Breaking Changes

Use the json schema as input for templating [#2542 @wagoodman]
Unexport types and functions cataloger packages [#2530 @wagoodman]
Internalize majority of cmd package [#2533 @wagoodman]
Allow for RPM modularity to be optional [#2540 @wagoodman]
CPE definition on pkg.Package is coupled to an external package as a type alias [#2529 #2534 @willmurphyscode]
Cataloger interface should accept context.Context [#2521 #2528 @wagoodman]
Remove deprecated API features [#2257 #2508 @wagoodman]
Remove deprecated configuration [#1864 #2508 @wagoodman]
Turn off SBOM cataloger by default [#1555 #2527 @wagoodman]

Additional Changes

Fix migration of integration test [#2546 @wagoodman]
minor cataloger and docs nits [#2519 @luhring]

(Full Changelog)

`v0.101.1`

Compare Source

Bug Fixes

Deduplicate digests from user configuration [#2522 @wagoodman]
Duplicate relationships in final SBOM [#2509 #2516 @spiffcs]

(Full Changelog)

`v0.101.0`

Compare Source

Security Fixes

bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 [#2501 @dependabot]

Added Features

Added binary classifier for GCC [#2479 @LaurentGoderre]
Add binary classifier for pypy [#2474 @LaurentGoderre]
Add binary classifiers for Percona Software for MySQL [#2478 @abg]
Added classifier for wordpress cli binary [#2473 @LaurentGoderre]
Add cataloger list command [#2366 @wagoodman]
Add ability to enable or disable individual catalogers [#1731 #1383 @wagoodman]
Improve cataloger selection capabilities [#1039 #1383 @wagoodman]

Bug Fixes

Include binary cataloger configuration defaults [#2504 @wagoodman]
Condense binary cataloger config in JSON output [#2499 @wagoodman]
Add support for the traefik binary from the official Docker image [#2484 @LaurentGoderre]
When specify java-cataloger, java-pom-cataloger will also be selected [#2136 #1383 @wagoodman]

(Full Changelog)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR has been generated by Mend Renovate. View repository job log here.

renovate · 2024-02-29T17:52:49Z

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
warning: ignoring symlink /tmp/renovate/repos/github/defenseunicorns/zarf/src/test/packages/34-manifest-with-symlink/manifests/resources/img
go: downloading github.com/prometheus/client_golang v1.18.0
go: downloading github.com/anchore/stereoscope v0.0.3-0.20240423181235-8b297badafd5
go: downloading cuelang.org/go v0.7.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.1
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.1
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.1
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.1
go: downloading github.com/docker/docker v26.1.0+incompatible
go: downloading github.com/prometheus/common v0.45.0
go: downloading github.com/anchore/packageurl-go v0.1.1-0.20240312213626-055233e539b4
go: downloading golang.org/x/mod v0.17.0
go: downloading github.com/golang/protobuf v1.5.3
go: downloading github.com/aws/aws-sdk-go-v2 v1.24.1
go: downloading github.com/aws/aws-sdk-go-v2/config v1.26.6
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.27.9
go: downloading github.com/jellydator/ttlcache/v3 v3.1.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1
go: downloading cloud.google.com/go/kms v1.15.7
go: downloading google.golang.org/api v0.166.0
go: downloading github.com/hashicorp/vault/api v1.10.0
go: downloading github.com/rivo/uniseg v0.4.7
go: downloading github.com/sahilm/fuzzy v0.1.1-0.20230530133925-c48e322e2a8f
go: downloading github.com/charmbracelet/lipgloss v0.10.0
go: downloading github.com/jedib0t/go-pretty/v6 v6.5.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.48.0
go: downloading go.opentelemetry.io/otel/trace v1.23.0
go: downloading go.opentelemetry.io/otel v1.23.0
go: downloading github.com/moby/docker-image-spec v1.3.1
go: downloading google.golang.org/grpc v1.61.1
go: downloading github.com/spdx/tools-golang v0.5.4
go: downloading github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0
go: downloading github.com/aws/smithy-go v1.19.0
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.16.16
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.18.7
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.26.7
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1
go: downloading github.com/googleapis/gax-go/v2 v2.12.1
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20240221002015-b0ce06bbee7c
go: downloading github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd
go: downloading go.opentelemetry.io/otel/metric v1.23.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240221002015-b0ce06bbee7c
go: downloading github.com/elliotchance/phpserialize v1.4.0
go: downloading github.com/knqyf263/go-rpmdb v0.1.0
go: downloading cuelabs.dev/go/oci/ociregistry v0.0.0-20231103182354-93e78c079a13
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.48.0
go: downloading github.com/aws/aws-sdk-go v1.50.0
go: downloading github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de
go: downloading github.com/moby/sys/mountinfo v0.7.1
go: downloading modernc.org/sqlite v1.29.8
go: downloading modernc.org/libc v1.49.3
go: downloading modernc.org/memory v1.8.0
go: github.com/defenseunicorns/zarf/src/internal/packager/sbom imports
	github.com/anchore/syft/syft/pkg/cataloger: cannot find module providing package github.com/anchore/syft/syft/pkg/cataloger

netlify · 2024-02-29T17:53:04Z

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	`80e12a7`
🔍 Latest deploy log	https://app.netlify.com/sites/zarf-docs/deploys/664e50c734e8000008e7b3c8

renovate · 2024-05-09T19:46:34Z

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
warning: ignoring symlink /tmp/renovate/repos/github/defenseunicorns/zarf/src/test/packages/34-manifest-with-symlink/manifests/resources/img
go: downloading github.com/anchore/stereoscope v0.0.3-0.20240501181043-2e9894674185
go: downloading github.com/anchore/packageurl-go v0.1.1-0.20240312213626-055233e539b4
go: downloading golang.org/x/mod v0.17.0
go: downloading github.com/docker/docker v26.1.2+incompatible
go: downloading github.com/rivo/uniseg v0.4.7
go: downloading github.com/sahilm/fuzzy v0.1.1-0.20230530133925-c48e322e2a8f
go: downloading github.com/charmbracelet/lipgloss v0.10.0
go: downloading github.com/jedib0t/go-pretty/v6 v6.5.9
go: downloading github.com/spdx/tools-golang v0.5.4
go: downloading github.com/moby/docker-image-spec v1.3.1
go: downloading github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd
go: downloading github.com/charmbracelet/bubbletea v0.26.2
go: downloading github.com/cloudflare/circl v1.3.8
go: downloading github.com/elliotchance/phpserialize v1.4.0
go: downloading github.com/knqyf263/go-rpmdb v0.1.0
go: downloading github.com/sassoftware/go-rpmutils v0.4.0
go: downloading github.com/erikgeiser/coninput v0.0.0-20211004153227-1c3628e74d0f
go: downloading github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6
go: downloading github.com/moby/sys/mountinfo v0.7.1
go: downloading modernc.org/sqlite v1.29.9
go: downloading modernc.org/libc v1.49.3
go: downloading modernc.org/memory v1.8.0
go: github.com/defenseunicorns/zarf/src/internal/packager/sbom imports
	github.com/anchore/syft/syft/pkg/cataloger: cannot find module providing package github.com/anchore/syft/syft/pkg/cataloger

renovate bot requested review from jeff-mccoy, Racer159, Noxsios and lucasrod16 as code owners February 29, 2024 17:52

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 7 times, most recently from a01a511 to 97270a6 Compare March 4, 2024 18:01

renovate bot requested a review from AustinAbro321 as a code owner March 4, 2024 18:01

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 10 times, most recently from 7b35398 to d7d57fc Compare March 8, 2024 18:49

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 6 times, most recently from 0924ef8 to 7d0738a Compare March 13, 2024 16:08

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 38d38d8 to 077527b Compare May 9, 2024 19:46

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 8 times, most recently from 432f8c8 to 8d56db7 Compare May 15, 2024 03:22

renovate bot requested a review from dgershman as a code owner May 15, 2024 03:22

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 13 times, most recently from 761b344 to 5b0b627 Compare May 22, 2024 11:30

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 4 times, most recently from e64536e to 2453b4c Compare May 22, 2024 19:26

fix(deps): update module github.com/anchore/syft to v1

80e12a7

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from 2453b4c to 80e12a7 Compare May 22, 2024 20:08

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update module github.com/anchore/syft to v1 #2343

fix(deps): update module github.com/anchore/syft to v1 #2343

renovate bot commented Feb 29, 2024 •

edited

renovate bot commented Feb 29, 2024 •

edited

netlify bot commented Feb 29, 2024 •

edited

renovate bot commented May 9, 2024 •

edited

fix(deps): update module github.com/anchore/syft to v1 #2343

Are you sure you want to change the base?

fix(deps): update module github.com/anchore/syft to v1 #2343

Conversation

renovate bot commented Feb 29, 2024 • edited

Release Notes

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Breaking Changes

Security Fixes

Bug Fixes

Breaking Changes

Added Features

Bug Fixes

Breaking Changes

Additional Changes

Bug Fixes

Security Fixes

Added Features

Bug Fixes

Configuration

renovate bot commented Feb 29, 2024 • edited

⚠ Artifact update problem

File name: go.sum

netlify bot commented Feb 29, 2024 • edited

✅ Deploy Preview for zarf-docs canceled.

renovate bot commented May 9, 2024 • edited

⚠️ Artifact update problem

File name: go.sum

renovate bot commented Feb 29, 2024 •

edited

renovate bot commented Feb 29, 2024 •

edited

netlify bot commented Feb 29, 2024 •

edited

renovate bot commented May 9, 2024 •

edited