deps: update module github.com/anchore/syft to v1.19.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/syft	v1.11.1 -> v1.19.0

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.19.0

Compare Source

Added Features

• add license parsing from vendor dirs [#​3522 @​dschmidt]
• Support cataloging NuGet packages [#​373 #​3484 @​Kemosabert]

Bug Fixes

• Syft generates invalid PURLs when name contains : [#​3577 #​3596 @​spiffcs @​jkugler]
• warn instead of error if zero package catalogers are select - user might still run file metadata cataloger, for example [#​3128 #​3468 @​tomersein]
• sbom report: missing licenses [#​3527 #​3549 @​kzantow]

Additional Changes

• bump stereoscope to v0.0.13 [#​3601 @​spiffcs]

(Full Changelog)

v1.18.1

Compare Source

Bug Fixes

• Runtime Error with Syft on Singularity .sif file (panic: index out of range) [#​3390]
• SPDX expressions are lost from CycloneDX if they contain extra parenthesis [#​3441 #​3517 @​willmurphyscode]

Additional Changes

• migrate syft to use anchore fork of archiver without replace [#​3516 @​spiffcs]

(Full Changelog)

v1.18.0

Compare Source

Added Features

• convert spdx absolute to relative [#​3509 @​spiffcs]
• Add relationships for rust audit binary packages [#​3500 @​wagoodman]
• support configuration of layer size in Syft [#​3428 #​3464 @​tomersein]
• Support Dart arm/v7 in 3.x and 2.x [#​3278 #​3475 @​witchcraze]

Bug Fixes

• fix order of rust dependencies and support git sources in Cargo.lock dependencies [#​3502 @​willmurphyscode]
• Use file indexer directly when scanning with file source [#​3333 @​adammcclenaghan]
• Remove incorrect power-user help text that only image sources are supported [#​2046]
• Invalid SPDX: missing copyright text [#​3346 #​3495 @​spiffcs]
• Scanning a source tree with duplicate conanfile.txt dependencies generates multiple components [#​3403]

(Full Changelog)

v1.17.0

Compare Source

Added Features

• Surface Rust dependency relationships [#​2353 #​3443 @​willmurphyscode]
• Support node 6.x versions [#​3404 #​3419 @​witchcraze]

Bug Fixes

• Restore log on UI teardown [#​3427 @​wagoodman]
• Syft should log warnings even when no TTY is present [#​3081 #​3466 @​willmurphyscode]
• Special characters (tab, newline) in license URL [#​3122 #​3449 @​spiffcs]
• LicenseDeclared not as per SPDX License List [#​3030 #​3461 @​spiffcs]

Additional Changes

• doc: Add official Syft logo license information [#​3421 @​popey]

(Full Changelog)

v1.16.0

Compare Source

Added Features

• omit devDependencies for package-lock.json files by default [#​2348 #​3371 @​njv299]

Bug Fixes

• add support for dependencies and purl for Native Image SBOMs [#​3399 @​rudsberg]
• stop bubbling fileResolver errors from binary cataloger [#​3410 @​spiffcs]
• malformed pom.xml may cause recursive loop [#​3391 @​kzantow]
• syft convert: broken link in help - documentation no longer existing [#​3143 #​3407 @​Makefolder]

(Full Changelog)

v1.15.0

Compare Source

Added Features

• Merge config files hierarchically and add support for config profiles [#​3337 @​kzantow]
• Enable cargo-auditable-binary-cataloger for files/directories [#​3376 @​ariel-miculas]
• Improve mariadb binary classifer to detect older versions [#​3052]
• Look for dpkg status file at additional globs [#​2692 #​3373 @​njv299]
• Emit relationships for Java dependencies [#​3189 #​3363 @​kzantow]

(Full Changelog)

v1.14.2

Compare Source

Bug Fixes

• Use single license scanner for all catalogers [#​3348 @​wagoodman]
• use official CPE for linux kernel [#​3343 @​westonsteimel]
• improve mariadb binary classifer to detect older versions [#​3339 @​westonsteimel]

Additional Changes

• Update to latest packageurl-go [#​3347 @​wagoodman]

(Full Changelog)

v1.14.1

Compare Source

Bug Fixes

• stop some log.Warn spam due parsing an empty string as a CPE [#​3330 @​willmurphyscode]
• improve go binary semver extraction for traefik [#​3325 @​westonsteimel]

(Full Changelog)

v1.14.0

Compare Source

Added Features

• Report known unknowns directly in the output SBOM [#​518 #​2998 @​kzantow]
• Identify bash.preinst [#​3191 #​3228 @​wagoodman]
• Support HAProxy rc and some old versions [#​3233 #​3277 @​witchcraze]
• Support Redis arm/v5, arm/v7, 386 in 7.2, 7.4, 8.0 [#​3279 #​3281 @​witchcraze]
• Support node old versions [#​3236 #​3284 @​witchcraze]
• Support rubylang/ruby dev versions [#​3239 #​3285 @​witchcraze]
• Support ruby rc, preview [#​3238 #​3285 @​witchcraze]

Bug Fixes

• performance: instantiate license check scanner to prevent memory leak [#​3290 @​govrin]
• Parse package.json with non-standard fields in 'author' section [#​3300 @​nuada]
• make failed CPE validation correctly return error [#​2762 @​willmurphyscode]
• Improve subpath to mount matching [#​3269 @​cdupuis]

Additional Changes

• add pull request template [#​3294 @​willmurphyscode]

(Full Changelog)

v1.13.0

Compare Source

Added Features

• --enrich flag for data enrichment feature enablement [#​3182 @​kzantow]
• Add classifier for Dart lang [#​3265 @​LaurentGoderre]
• add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and sqlcipher [#​3252 @​krysgor]
• Catalog JDKs more completely [#​3188 #​3217 @​wagoodman]
• Show richer information for JVM installations [#​1426 #​3217 @​wagoodman]
• Allow for stubbing unknown versions over dropping packages [#​2652 #​3257 @​wagoodman]
• Name and Version empty for Java package when scanning provided image [#​2132 #​3257 @​wagoodman]
• Support bitnami/mysql:8.x [#​3025]

Bug Fixes

• OpenJDK CPEs [#​2422 #​3217 @​wagoodman]
• SBOM generated from poetry lock file contains no license information on any dependencies [#​3204]
• Scanning a folder with a jar archive with no metadata creates a SPDX package without versionInfo (Non-NTIA compliant) [#​2039 #​3257 @​wagoodman]
• Using replace in a go.mod creates a SPDX package without versionInfo (Non-NTIA compliant) [#​2038 #​3257 @​wagoodman]
• Command make add-snippet can fail in some cases [#​3249]

(Full Changelog)

v1.12.2

Compare Source

Added Features

• Detect curl binaries [#​3146 @​krysgor]
• Add haskell binaries cataloger [#​3078 @​LaurentGoderre]
• add the Ocaml ecosystem [#​3112 @​LaurentGoderre]
• Support HAProxy dev [#​3134 #​3180 @​witchcraze]

Bug Fixes

• Fix improper decoding of SPDX license expressions in the CycloneDX format [#​3175 @​NyanKiyoshi]
• improve generated cpes for binaries with existing classifiers [#​3169 @​westonsteimel]
• improve known CPEs and set NVD as source for all current binary classifiers [#​3167 @​westonsteimel]
• Respond to authoratative CPEs from catalogers [#​3166 @​wagoodman]
• Set cataloger names within package cataloger task [#​3165 @​wagoodman]
• use official CPE for curl binary cataloger [#​3164 @​westonsteimel]
• Fix ELF package correlations [#​3151 @​wagoodman]
• no space left and Could not retrieve mirrorlist in test [#​3181 #​3190 @​wagoodman]
• Multiple versions of libssl3 and libcrypto3 present in SBOM while only one version is installed [#​3195]
• CycloneDX convertion into Syft improperly handles SPDX licenses [#​3172]
• Syft Cause stack overflow [goroutine stack exceeds 1000000-byte limit] [#​3163 #​3170 @​kzantow]
• Mysql binary detection version incorrect for 8.0.x [#​3141 #​3142 @​kzantow]

Additional Changes

• Less verbose java logging when non-fatal issues arise [#​3208 @​wagoodman]

(Full Changelog)

v1.12.1

Compare Source

v1.12.0

Compare Source

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 65 additional dependencies were updated

Details:

Package	Change
github.com/anchore/stereoscope	v0.0.3 -> v0.0.13
github.com/stretchr/testify	v1.9.0 -> v1.10.0
dario.cat/mergo	v1.0.0 -> v1.0.1
github.com/CycloneDX/cyclonedx-go	v0.9.0 -> v0.9.2
github.com/Masterminds/semver/v3	v3.2.0 -> v3.3.0
github.com/Masterminds/sprig/v3	v3.2.3 -> v3.3.0
github.com/Microsoft/go-winio	v0.6.1 -> v0.6.2
github.com/Microsoft/hcsshim	v0.11.4 -> v0.11.7
github.com/ProtonMail/go-crypto	v1.0.0 -> v1.1.3
github.com/adrg/xdg	v0.5.0 -> v0.5.3
github.com/anchore/packageurl-go	v0.1.1-0.20240507183024-848e011fc24f -> v0.1.1-0.20250117185454-edf36a908b10
github.com/andybalholm/brotli	v1.1.0 -> v1.1.1
github.com/bmatcuk/doublestar/v4	v4.6.1 -> v4.8.0
github.com/charmbracelet/lipgloss	v0.12.1 -> v1.0.0
github.com/charmbracelet/x/ansi	v0.1.4 -> v0.4.5
github.com/containerd/containerd	v1.7.13 -> v1.7.24
github.com/containerd/stargz-snapshotter/estargz	v0.14.3 -> v0.16.3
github.com/containerd/ttrpc	v1.2.2 -> v1.2.5
github.com/cyphar/filepath-securejoin	v0.2.4 -> v0.3.6
github.com/docker/cli	v27.1.1+incompatible -> v27.5.0+incompatible
github.com/docker/docker	v27.1.2+incompatible -> v27.5.0+incompatible
github.com/docker/docker-credential-helpers	v0.7.0 -> v0.8.2
github.com/docker/go-connections	v0.4.0 -> v0.5.0
github.com/felixge/httpsnoop	v1.0.3 -> v1.0.4
github.com/gabriel-vasile/mimetype	v1.4.4 -> v1.4.8
github.com/github/go-spdx/v2	v2.3.1 -> v2.3.2
github.com/go-git/go-billy/v5	v5.5.0 -> v5.6.2
github.com/huandu/xstrings	v1.3.3 -> v1.5.0
github.com/klauspost/compress	v1.17.8 -> v1.17.11
github.com/klauspost/pgzip	v1.2.5 -> v1.2.6
github.com/magiconair/properties	v1.8.7 -> v1.8.9
github.com/mattn/go-runewidth	v0.0.15 -> v0.0.16
github.com/moby/sys/user	v0.1.0 -> v0.3.0
github.com/nwaples/rardecode	v1.1.0 -> v1.1.3
github.com/pelletier/go-toml/v2	v2.1.0 -> v2.2.2
github.com/pierrec/lz4/v4	v4.1.19 -> v4.1.21
github.com/saferwall/pe	v1.5.4 -> v1.5.6
github.com/shopspring/decimal	v1.2.0 -> v1.4.0
github.com/skeema/knownhosts	v1.2.2 -> v1.3.0
github.com/spf13/afero	v1.11.0 -> v1.12.0
github.com/spf13/cast	v1.6.0 -> v1.7.0
github.com/spf13/viper	v1.18.2 -> v1.19.0
github.com/sylabs/sif/v2	v2.17.1 -> v2.20.2
github.com/sylabs/squashfs	v1.0.0 -> v1.0.4
github.com/vbatts/tar-split	v0.11.3 -> v0.11.6
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.45.0 -> v0.58.0
go.opentelemetry.io/otel	v1.19.0 -> v1.33.0
go.opentelemetry.io/otel/metric	v1.19.0 -> v1.33.0
go.opentelemetry.io/otel/trace	v1.19.0 -> v1.33.0
golang.org/x/crypto	v0.31.0 -> v0.32.0
golang.org/x/mod	v0.20.0 -> v0.22.0
golang.org/x/tools	v0.24.0 -> v0.29.0
golang.org/x/xerrors	v0.0.0-20220907171357-04be3eba64a2 -> v0.0.0-20231012003039-104605ab7028
google.golang.org/genproto	v0.0.0-20231106174013-bbf56f31fb17 -> v0.0.0-20241118233622-e639e219e697
google.golang.org/genproto/googleapis/rpc	v0.0.0-20231120223509-83a465c0220f -> v0.0.0-20241223144023-3abc09e42ca8
google.golang.org/grpc	v1.59.0 -> v1.67.3
github.com/go-git/go-git/v5	v5.12.0 -> v5.13.1
github.com/google/go-containerregistry	v0.20.2 -> v0.20.3
golang.org/x/net	v0.33.0 -> v0.34.0
golang.org/x/oauth2	v0.21.0 -> v0.25.0
golang.org/x/sys	v0.28.0 -> v0.29.0
golang.org/x/term	v0.27.0 -> v0.28.0
golang.org/x/time	v0.5.0 -> v0.8.0
google.golang.org/appengine	v1.6.7 -> v1.6.8
google.golang.org/protobuf	v1.34.2 -> v1.36.3