fix(deps): update module github.com/anchore/syft to v1 - autoclosed #2343

renovate · 2024-02-29T17:52:48Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/syft	`v0.100.0` -> `v1.10.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

anchore/syft (github.com/anchore/syft)

`v1.10.0`

Compare Source

Added Features

Detect go main module from partial package builds [#3060 @wagoodman]
Support traefik in linux/arm/v6, linux/riscv64 [#3038 #3077 @witchcraze]
Catalog TiDB binary [#2763]
Generate a Maven friendly CPE [#3042 #3045 @kzantow]

Bug Fixes

Only match ldflag version if it matches the main module or targets main.version [#3062 @LaurentGoderre]
python requirements.txt cataloger: allow dots in python package names [#3070 @Mikcl]
SPDX output performance with many relationships [#3053 @kzantow]
Order CPEs deterministically for SBOM reproducibility [#2967 #3085 @kzantow]
Python packages: name normalization [#3064 #3069 @Mikcl]
Syft report panics with the golang cataloger [#3037 #3043 @willmurphyscode]

Additional Changes

add debug logging for errors reading RPM files [#3051 @kzantow]

(Full Changelog)

`v1.9.0`

Compare Source

Added Features

Add detection of Erlang in Alpine linux [#2996 @LaurentGoderre]
Add version 3 support for swift package manager of the resolved files [#3001 @4ell0]
Map the downloadLocation field for PHP Composer packages [#3011 @LaurentGoderre]

Bug Fixes

Infer the package type from ELF package notes [#3008 @wagoodman]
Order CPEs deterministically for SBOM reproducibility [#2967 #3009 @spiffcs]

(Full Changelog)

`v1.8.0`

Compare Source

Added Features

Add CycloneDX 1.6 Support [#2974 #2978 @ragaskar]

Bug Fixes

Fixed the detection of arangodb 3.12 [#2979 @LaurentGoderre]
Syft tries to create the cache directory at a location that has no permission [#2984 #2985 @kzantow]

(Full Changelog)

`v1.7.0`

Compare Source

Added Features

index known CPEs for wordpress plugins and themes [#2963 @westonsteimel]
Consider Author field for wordpress plugins when generating CPEs [#2946 @wagoodman]

Bug Fixes

improve version extraction from ldflags for pingcap TiDB [#2962 @westonsteimel]
Trim whitespace from wordpress values [#2945 @wagoodman]
Issue scanning Poetry Project with Syft 1.6 and cataloger=python-package-cataloger [#2954 #2965 @spiffcs]
Poetry's multiple constraints seems to break the parser [#2947 #2965 @spiffcs]
Golang: Search remote licenses not working in a CI pipeline when scanning Docker image [#2798 #2852 @kzantow]

(Full Changelog)

`v1.6.0`

Compare Source

Added Features

Add relationships for go binary packages [#2912 @wagoodman]
Add classifier for util-linux [#2933 @LaurentGoderre]
Lua: Add support for more advanced syntax [#2908 @LaurentGoderre]
add license field to ELF binary package metadata [#2890 @brian-ebarb]
install.sh: check checksums file's signature [#2884 #2941 @wagoodman]
Detect ELF package notes from fedora binaries [#2713 #2939 @wagoodman]

Bug Fixes

Use redhat as namespace for redhat rpms [#2914 @ralphbean]
Close sqlite driver after testing sqlite availability [#2922 @ttc0419]
syft does not find anything in archives if /tmp is a tmpfs [#2894 #2918 @willmurphyscode]
Scanning a git repository folder present in /tmp produce an empty sbom [#2847 #2918 @willmurphyscode]

Additional Changes

update unit tests to use pinned patch version [#2932 @spiffcs]
fix comments and spelling [#2920 @dufucun]

(Full Changelog)

`v1.5.0`

Compare Source

Added Features

Add abstraction for adding relationships from package cataloger results [#2853 @wagoodman]
Capture dependencies when parsing SPDX SBOMs [#2869 @russellhaering]
Add python wheel egg relationships [#2903 @wagoodman]
Added functionality to convert major, minor, patch to version [#2864 @LaurentGoderre]
Add support for RPM DB package relationships [#2872 @wagoodman]
Detect fluent-bit binaries [#2904 #2905 @kzantow]
Add syft config command [#2598 #2892 @kzantow]

Bug Fixes

Fix DecoderCollection discarding input from non-seekable Readers [#2878 @russellhaering]
Handle GOEXPERIMENTs in go version [#2893 @jonjohnsonjr]
Go Mod Cataloger: Remove Replaced Packages [#2891 @russellhaering]
Use values in relationship To/From fields [#2871 @wagoodman]
Java package names showing up namespaced packages [#2230]

Additional Changes

update spdx license list to 3.24.0 [#2895 @spiffcs]

(Full Changelog)

`v1.4.1`

Compare Source

Bug Fixes

Fix redundant package deletions when considering ELF packages [#2862 @wagoodman]

(Full Changelog)

`v1.4.0`

Compare Source

Added Features

Add detection for newer version of ErLang/OTP [#2829 @LaurentGoderre]
Add missing CPE for traefik, memcached, and postgres binaries [#2845 @LaurentGoderre]
Add binary classifier for ArangoDB [#2830 @LaurentGoderre]
Add relationships to ELF packages [#2715 @brian-ebarb @cdivers18 ]
Add relationships for ALPM packages (arch linux) [#2851 @wagoodman]

Bug Fixes

close temp rpmdb file [#2792 @testwill]
fix Windows file paths in local go mod cache [#2654 @willmurphyscode]
Package Count doesn't match list of packages [#2304 #2839 @wagoodman]
New version 1.3.0 leads to "too many open files" while scanning bigger images [#2819 #2823 @willmurphyscode]
license_info_in_file is mandatory in SPDX-2.2 [#2163 #2168 @kzantow]
Wrong CPE for dnsmasq [#2636 #2659 @kzantow]
SPDX originator is not always populated [#2632 #2822 @wagoodman]

Additional Changes

Improve linting for defer Close type issues [#2826]
use ruleguard to test for missing defer statements [#2837 @willmurphyscode]
Publish security policy [#2835 @wagoodman]
fix function name in comment [#2771 @camcui]
enable go-critic deferInLoop lint [#2825 @willmurphyscode]

(Full Changelog)

`v1.3.0`

Compare Source

Added Features

index known CPEs for go modules [#2816 @westonsteimel]
support multiple known CPEs in index [#2813 @westonsteimel]
index known CPEs for PHP Composer packagist.org packages [#2804 @westonsteimel]
index known cpes for PHP extensions [#2777 @westonsteimel]

Bug Fixes

re-use embedded union reader if possible [#2814 @willmurphyscode]
prefer non-deprecated CPEs and include jenkins plugins from plugins.jenkins.io [#2806 @westonsteimel]
improvements to known CPE index construction [#2801 @westonsteimel]
Syft panics when scanning OCI image that contains packaged helm chart [#2745 #2757 @willmurphyscode]
Pom parser not resolving all dependency versions [#2776 #2781 @willmurphyscode]
exclude known instrumentation jars from being erroneously identified [#2796 @kzantow]
return empty string if dereferncing pom var fails [#2797 @willmurphyscode]

(Full Changelog)

`v1.2.0`

Compare Source

Added Features

Differentiate between JRE and JDK [#2748 @LaurentGoderre]
Add support for dnf packages [#2758]

Bug Fixes

more robust go main version extraction [#2767 @kzantow]
Regression in 1.1 cataloging openjdk: generates version containing a null byte [#2750 #2766 @LaurentGoderre]

(Full Changelog)

`v1.1.1`

Compare Source

Bug Fixes

update anchore/packageurl-go to use latest commits [#2746 @spiffcs]
fix panic scanning binaries without symtab [#2736 #2739 @kzantow]

(Full Changelog)

`v1.1.0`

Compare Source

Added Features

Adding the ability to retrieve remote licenses from package-lock.json [#2708 @coheigea]
Show binary exports, entrypoint, and imports [#2626 @wagoodman]
Add detection for Oracle GraalVM [#2705 @LaurentGoderre]

Bug Fixes

reduce duplicate case SwiftPkg [#2696 @testwill]

(Full Changelog)

`v1.0.1`

Compare Source

Bug Fixes

Unable to scan OCI images with syft v0.105.1 [#2678 #2683 @spiffcs]

(Full Changelog)

`v1.0.0`

Compare Source

🎉 Checkout the blog post about v1!

Added Features

Allow source type input via CLI flag (not scheme) [#1783 #2610 @kzantow]

Bug Fixes

OpenSSL binary matcher fails to properly detect letter releases [#2681 #2682 @harmw]
TUI package count does not match package count in default table output [#2672 #2679 @wagoodman]
.NET NuGet - dotnet-deps cataloger not working with syft v0.94.0 [#2264 #2674 @willmurphyscode]
New path filtering logic excluding large number of unintended paths [#2667 #2675 @wagoodman]
Syft TUI can hang when using license fetching from go modules [#2653 #2673 @willmurphyscode]

(Full Changelog)

`v0.105.1`

Compare Source

Bug Fixes

return error codes from install script [#2664 @hacst]
SPDX tag value version selector [#2665 @kzantow]

Additional Changes

Add syft version used to SBOM tool info by default [#2647 @wagoodman]

(Full Changelog)

`v0.105.0`

Compare Source

Added Features

Guess go main module version based on binary contents [#2608 @wagoodman]
Catalog wordpress plugins [#1911 #2218 @disc]

Bug Fixes

ensure version output to stdout [#2621 @kzantow]
Survive indexing dead symlinks [#2645 @wagoodman]
unable to index filesystem for amazonlinux images [#2627 #2644 @wagoodman]
CycloneDX OS component does not have a bom-ref [#2101 #2634 @kzantow]
v0.104.0 interface conversion error when creating bom from singularity image [#2628 #2631 @wagoodman]

Additional Changes

Rename binary cataloger to be more unique [#2633 @wagoodman]
Suppress executable parsing issues [#2614 @wagoodman]
update license list, cpe dictionary [#2620 @spiffcs]

(Full Changelog)

`v0.104.0`

Compare Source

Added Features

Adding metadata fields when parsing yarn.lock and poetry.lock [#2350 @asi-cider]
Add Erlang OTP Application cataloger [#2403 @LaurentGoderre]
Support Conan lockfiles v0.5 [#2050]
Identify security-features-of-interest within binaries [#2434 #2443 @wagoodman]
Top-level API should be more composable [#558 #2517 @wagoodman]
Annotate where each CPE on a package is sourced from [#2282 #2552 @willmurphyscode]

Bug Fixes

unmarshal key values in Java, Go, and Conan metadata [#2603 @willmurphyscode]
incorrect conversion between integer types [#2605 @spiffcs]
prefer portable executable product version when semantically greater than file version [#2600 @westonsteimel]
Stop iterating maps in catalogers [#2405 #2553 @wagoodman]
unknown flag: --key when use syft attest --key [KEY] [#2544 #2551 @willmurphyscode]
purl generation broken for kafka jars [#2385 #2573 @westonsteimel]

Breaking Changes

Top-level API should be more composable [#558 #2517 @wagoodman]
Annotate where each CPE on a package is sourced from [#2282 #2552 @willmurphyscode]

(Full Changelog)

`v0.103.1`

Compare Source

Security Fixes

Bump archiver and stereoscope to address path traversal issues [#2570 @wagoodman]

Bug Fixes

Revert cosign signing of release checksums file [#2571 @wagoodman]
java archive parser incorrectly splitting filenames [#2563 #2565 @willmurphyscode]

Breaking Changes

Internalize format helpers [#2543 @wagoodman]
Internalize CPE generation logic [#2541 @wagoodman]

(Full Changelog)

`v0.103.0`

Compare Source

`v0.102.0`

Compare Source

Added Features

Swap format uses of io.ReadSeeker for io.Reader [#2515 @wagoodman]
Cataloger interface should accept context.Context [#2521 #2528 @wagoodman]

Bug Fixes

Implement golang Purl subpath [#2547 @LaurentGoderre]
CPE definition on pkg.Package is coupled to an external package as a type alias [#2529 #2534 @willmurphyscode]
Turn off SBOM cataloger by default [#1555 #2527 @wagoodman]
Syft missing linux kernel archives from SBOM results [#2524 #2526 @wagoodman]
LocationResolver can leak goroutines [#2487 #2518 @willmurphyscode]
Duplicates in Syft JSON "artifactRelationships" [#2251]

Breaking Changes

Use the json schema as input for templating [#2542 @wagoodman]
Unexport types and functions cataloger packages [#2530 @wagoodman]
Internalize majority of cmd package [#2533 @wagoodman]
Allow for RPM modularity to be optional [#2540 @wagoodman]
CPE definition on pkg.Package is coupled to an external package as a type alias [#2529 #2534 @willmurphyscode]
Cataloger interface should accept context.Context [#2521 #2528 @wagoodman]
Remove deprecated API features [#2257 #2508 @wagoodman]
Remove deprecated configuration [#1864 #2508 @wagoodman]
Turn off SBOM cataloger by default [#1555 #2527 @wagoodman]

Additional Changes

Fix migration of integration test [#2546 @wagoodman]
minor cataloger and docs nits [#2519 @luhring]

(Full Changelog)

`v0.101.1`

Compare Source

Bug Fixes

Deduplicate digests from user configuration [#2522 @wagoodman]
Duplicate relationships in final SBOM [#2509 #2516 @spiffcs]

(Full Changelog)

`v0.101.0`

Compare Source

Security Fixes

bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 [#2501 @dependabot]

Added Features

Added binary classifier for GCC [#2479 @LaurentGoderre]
Add binary classifier for pypy [#2474 @LaurentGoderre]
Add binary classifiers for Percona Software for MySQL [#2478 @abg]
Added classifier for wordpress cli binary [#2473 @LaurentGoderre]
Add cataloger list command [#2366 @wagoodman]
Add ability to enable or disable individual catalogers [#1731 #1383 @wagoodman]
Improve cataloger selection capabilities [#1039 #1383 @wagoodman]

Bug Fixes

Include binary cataloger configuration defaults [#2504 @wagoodman]
Condense binary cataloger config in JSON output [#2499 @wagoodman]
Add support for the traefik binary from the official Docker image [#2484 @LaurentGoderre]
When specify java-cataloger, java-pom-cataloger will also be selected [#2136 #1383 @wagoodman]

(Full Changelog)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-02-29T17:52:49Z

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

any of the package files in this branch needs updating, or
the branch becomes conflicted, or
you click the rebase/retry checkbox if found above, or
you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
warning: ignoring symlink /tmp/renovate/repos/github/defenseunicorns/zarf/src/test/packages/34-manifest-with-symlink/manifests/resources/img
go: downloading github.com/prometheus/client_golang v1.18.0
go: downloading github.com/anchore/stereoscope v0.0.3-0.20240423181235-8b297badafd5
go: downloading cuelang.org/go v0.7.0
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/aws v1.8.1
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/azure v1.8.1
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/gcp v1.8.1
go: downloading github.com/sigstore/sigstore/pkg/signature/kms/hashivault v1.8.1
go: downloading github.com/docker/docker v26.1.0+incompatible
go: downloading github.com/prometheus/common v0.45.0
go: downloading github.com/anchore/packageurl-go v0.1.1-0.20240312213626-055233e539b4
go: downloading golang.org/x/mod v0.17.0
go: downloading github.com/golang/protobuf v1.5.3
go: downloading github.com/aws/aws-sdk-go-v2 v1.24.1
go: downloading github.com/aws/aws-sdk-go-v2/config v1.26.6
go: downloading github.com/aws/aws-sdk-go-v2/service/kms v1.27.9
go: downloading github.com/jellydator/ttlcache/v3 v3.1.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/azcore v1.9.1
go: downloading github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1
go: downloading cloud.google.com/go/kms v1.15.7
go: downloading google.golang.org/api v0.166.0
go: downloading github.com/hashicorp/vault/api v1.10.0
go: downloading github.com/rivo/uniseg v0.4.7
go: downloading github.com/sahilm/fuzzy v0.1.1-0.20230530133925-c48e322e2a8f
go: downloading github.com/charmbracelet/lipgloss v0.10.0
go: downloading github.com/jedib0t/go-pretty/v6 v6.5.8
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.48.0
go: downloading go.opentelemetry.io/otel/trace v1.23.0
go: downloading go.opentelemetry.io/otel v1.23.0
go: downloading github.com/moby/docker-image-spec v1.3.1
go: downloading google.golang.org/grpc v1.61.1
go: downloading github.com/spdx/tools-golang v0.5.4
go: downloading github.com/matttproud/golang_protobuf_extensions/v2 v2.0.0
go: downloading github.com/aws/smithy-go v1.19.0
go: downloading github.com/aws/aws-sdk-go-v2/credentials v1.16.16
go: downloading github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.14.11
go: downloading github.com/aws/aws-sdk-go-v2/internal/ini v1.7.3
go: downloading github.com/aws/aws-sdk-go-v2/service/sso v1.18.7
go: downloading github.com/aws/aws-sdk-go-v2/service/ssooidc v1.21.7
go: downloading github.com/aws/aws-sdk-go-v2/service/sts v1.26.7
go: downloading github.com/aws/aws-sdk-go-v2/internal/configsources v1.2.10
go: downloading github.com/Azure/azure-sdk-for-go/sdk/internal v1.5.1
go: downloading github.com/googleapis/gax-go/v2 v2.12.1
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20240221002015-b0ce06bbee7c
go: downloading github.com/google/pprof v0.0.0-20240409012703-83162a5b38cd
go: downloading go.opentelemetry.io/otel/metric v1.23.0
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240221002015-b0ce06bbee7c
go: downloading github.com/elliotchance/phpserialize v1.4.0
go: downloading github.com/knqyf263/go-rpmdb v0.1.0
go: downloading cuelabs.dev/go/oci/ociregistry v0.0.0-20231103182354-93e78c079a13
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.10.4
go: downloading github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.10.10
go: downloading github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.5.10
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.48.0
go: downloading github.com/aws/aws-sdk-go v1.50.0
go: downloading github.com/mpvl/unique v0.0.0-20150818121801-cbe035fff7de
go: downloading github.com/moby/sys/mountinfo v0.7.1
go: downloading modernc.org/sqlite v1.29.8
go: downloading modernc.org/libc v1.49.3
go: downloading modernc.org/memory v1.8.0
go: github.com/defenseunicorns/zarf/src/internal/packager/sbom imports
	github.com/anchore/syft/syft/pkg/cataloger: cannot find module providing package github.com/anchore/syft/syft/pkg/cataloger

netlify · 2024-02-29T17:53:04Z

✅ Deploy Preview for zarf-docs canceled.

Name	Link
🔨 Latest commit	`a71bbdb`
🔍 Latest deploy log	https://app.netlify.com/sites/zarf-docs/deploys/6698294b49d1c00008e102ba

renovate bot requested review from jeff-mccoy, Racer159, Noxsios and lucasrod16 as code owners February 29, 2024 17:52

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 7 times, most recently from a01a511 to 97270a6 Compare March 4, 2024 18:01

renovate bot requested a review from AustinAbro321 as a code owner March 4, 2024 18:01

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 10 times, most recently from 7b35398 to d7d57fc Compare March 8, 2024 18:49

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 6 times, most recently from 0924ef8 to 7d0738a Compare March 13, 2024 16:08

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 22 times, most recently from a0f504a to 3cfe97d Compare July 29, 2024 19:15

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch 3 times, most recently from c0ec21e to b2a3106 Compare July 31, 2024 14:38

fix(deps): update module github.com/anchore/syft to v1

5063d39

renovate bot force-pushed the renovate/github.com-anchore-syft-1.x branch from b2a3106 to 5063d39 Compare July 31, 2024 14:50

renovate bot changed the title ~~fix(deps): update module github.com/anchore/syft to v1~~ fix(deps): update module github.com/anchore/syft to v1 - autoclosed Jul 31, 2024

renovate bot closed this Jul 31, 2024

renovate bot deleted the renovate/github.com-anchore-syft-1.x branch July 31, 2024 14:56

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix(deps): update module github.com/anchore/syft to v1 - autoclosed #2343

fix(deps): update module github.com/anchore/syft to v1 - autoclosed #2343

renovate bot commented Feb 29, 2024 •

edited

Loading

renovate bot commented Feb 29, 2024 •

edited

Loading

netlify bot commented Feb 29, 2024 •

edited

Loading

fix(deps): update module github.com/anchore/syft to v1 - autoclosed #2343

fix(deps): update module github.com/anchore/syft to v1 - autoclosed #2343

Conversation

renovate bot commented Feb 29, 2024 • edited Loading

Release Notes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Added Features

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Additional Changes

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Breaking Changes

Security Fixes

Bug Fixes

Breaking Changes

Added Features

Bug Fixes

Breaking Changes

Additional Changes

Bug Fixes

Security Fixes

Added Features

Bug Fixes

Configuration

renovate bot commented Feb 29, 2024 • edited Loading

⚠ Artifact update problem

File name: go.sum

netlify bot commented Feb 29, 2024 • edited Loading

✅ Deploy Preview for zarf-docs canceled.

renovate bot commented Feb 29, 2024 •

edited

Loading

renovate bot commented Feb 29, 2024 •

edited

Loading

netlify bot commented Feb 29, 2024 •

edited

Loading