deps: update module github.com/anchore/grype to v0.85.0 #538

renovate · 2024-09-13T22:10:08Z

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/grype	`v0.80.0` -> `v0.85.0`

Release Notes

anchore/grype (github.com/anchore/grype)

`v0.85.0`

Compare Source

Added Features

Add support for gradle in Java [#2236]
Prefer direct match information over indirect matches [#1931 #2241 @wagoodman]

Bug Fixes

Restore log on UI teardown [#2248 @wagoodman]

Additional Changes

Display warnings even when -v is not passed and no tty is present [#2180 #2268 @willmurphyscode]
core dependencies: latest syft v1.17.0 and latest stereoscope v0.0.9 [#2275 @willmurphyscode]

(Full Changelog)

`v0.84.0`

Compare Source

Added Features

Add support for scanning single purl from the CLI [#2225 #2223 @wagoodman]

Bug Fixes

Docker reports 0 vulnerabilities. Same file reports many vulnerabilites when ran directly on linux server [#2235]
Flaky checks on STDIN for purl provider [#2192 #2223 @wagoodman]
Missing alpine patch version yields inaccurate results [#2222 #2226 @wagoodman]

Additional Changes

update Syft to v1.16.0 [#2237 @anchore-actions-token-generator]

(Full Changelog)

`v0.83.0`

Compare Source

Added Features

Merge config files hierarchically and add support for config profiles [#2009 #2194 @kzantow]
Add DB providers command [#2131 #2174 @ADorigi]

(Full Changelog)

`v0.82.2`

Compare Source

Bug Fixes

azurelinux considered as comprehensive distro [#2197 @westonsteimel]
Java archive cataloger performance in 0.82.x much slower than 0.81.0 [#2200]

Additional Changes

Update to Syft v1.14.2 [#2203 @wagoodman]

(Full Changelog)

`v0.82.1`

Compare Source

Bug Fixes

Skip matching on packages with missing version info [#2182 @wagoodman]
correctly identify version of traefik binaries [#2178 #2179 @westonsteimel]
RPM version comparison oddity with release field [#398 #2188 @wagoodman]
purl with epoch should be used even if version is missing epoch [#2170 #2186 @wagoodman]

Additional Changes

bump syft in quality gate to v1.14.0 [#2187 @westonsteimel]

(Full Changelog)

`v0.82.0`

Compare Source

Added Features

performance: only check for a new DB once every 2 hours (configurable) [#2148 @wagoodman]
wordpress-plugin support [#1553 @disc]

Bug Fixes

use fix info from secDB in APK matcher even if NVD fix info present [#2162 @willmurphyscode]

Breaking Changes

Split v1-5 DB distribution concerns to a new legacy package [#2124 #2144 @wagoodman]

Additional Changes

Add a space following the "Name:" label in html.tmpl [#2155 @deftdawg]

(Full Changelog)

`v0.81.0`

Compare Source

Added Features

add distro mapping for azure linux 3 [#1848 @willmurphyscode]
Support for Azure Linux 3.0 [#1829]

(Full Changelog)

`v0.80.2`

Compare Source

Bug Fixes

find secdb entries for origin packages [#1602 @luhring]
Matching java binary packages with NVD records is problematic [#1718 #2114 @wagoodman]
LoadVulnerabilityDB could be faster with ValidateByHashOnGet [#1502 #2054 @lucasrod16]

Additional Changes

update Syft to v1.13.0 [#2140 @anchore-actions-token-generator]
include file specifier in help [#2121 @willmurphyscode]

(Full Changelog)

`v0.80.1`

Compare Source

Bug Fixes

CVE-2024-3154 found with latest version [#1834 #2091 @spiffcs]

Additional Changes

Update Syft to 1.12.2 [#2108]

(Full Changelog)

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2024-09-13T22:10:10Z

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

40 additional dependencies were updated
The go directive was updated for compatibility reasons

Details:

Package	Change
`go`	`1.22.5` -> `1.23.3`
`github.com/anchore/stereoscope`	`v0.0.3` -> `v0.0.9`
`github.com/anchore/syft`	`v1.11.1` -> `v1.17.0`
`dario.cat/mergo`	`v1.0.0` -> `v1.0.1`
`github.com/Masterminds/semver/v3`	`v3.2.1` -> `v3.3.0`
`github.com/Masterminds/sprig/v3`	`v3.2.3` -> `v3.3.0`
`github.com/adrg/xdg`	`v0.5.0` -> `v0.5.3`
`github.com/anchore/clio`	`v0.0.0-20240522144804-d81e109008aa` -> `v0.0.0-20241115144204-29e89f9fa837`
`github.com/anchore/fangs`	`v0.0.0-20240508143433-f016b099950f` -> `v0.0.0-20241014225144-4e1713cafd77`
`github.com/charmbracelet/lipgloss`	`v0.12.1` -> `v1.0.0`
`github.com/charmbracelet/x/ansi`	`v0.1.4` -> `v0.4.5`
`github.com/containerd/errdefs`	`v0.1.0` -> `v0.3.0`
`github.com/cyphar/filepath-securejoin`	`v0.2.4` -> `v0.2.5`
`github.com/github/go-spdx/v2`	`v2.3.1` -> `v2.3.2`
`github.com/huandu/xstrings`	`v1.4.0` -> `v1.5.0`
`github.com/mattn/go-runewidth`	`v0.0.15` -> `v0.0.16`
`github.com/pelletier/go-toml/v2`	`v2.2.0` -> `v2.2.2`
`github.com/saferwall/pe`	`v1.5.4` -> `v1.5.5`
`github.com/shopspring/decimal`	`v1.3.1` -> `v1.4.0`
`github.com/spf13/viper`	`v1.18.2` -> `v1.19.0`
`golang.org/x/exp`	`v0.0.0-20240325151524-a685a6edb6d8` -> `v0.0.0-20240719175910-8a7402abbf56`
`github.com/CycloneDX/cyclonedx-go`	`v0.9.0` -> `v0.9.1`
`github.com/ProtonMail/go-crypto`	`v1.0.0` -> `v1.1.2`
`github.com/anchore/packageurl-go`	`v0.1.1-0.20240507183024-848e011fc24f` -> `v0.1.1-0.20241018175412-5c22e6360c4f`
`github.com/bmatcuk/doublestar/v4`	`v4.6.1` -> `v4.7.1`
`github.com/containerd/containerd`	`v1.7.14` -> `v1.7.23`
`github.com/docker/cli`	`v27.1.1+incompatible` -> `v27.3.1+incompatible`
`github.com/docker/docker`	`v27.1.2+incompatible` -> `v27.3.1+incompatible`
`github.com/gabriel-vasile/mimetype`	`v1.4.5` -> `v1.4.7`
`github.com/go-git/go-billy/v5`	`v5.5.0` -> `v5.6.0`
`github.com/sylabs/sif/v2`	`v2.17.1` -> `v2.20.0`
`golang.org/x/crypto`	`v0.27.0` -> `v0.29.0`
`golang.org/x/mod`	`v0.21.0` -> `v0.22.0`
`golang.org/x/net`	`v0.28.0` -> `v0.31.0`
`golang.org/x/sync`	`v0.8.0` -> `v0.9.0`
`golang.org/x/term`	`v0.24.0` -> `v0.26.0`
`gorm.io/gorm`	`v1.25.11` -> `v1.25.12`
`modernc.org/sqlite`	`v1.32.0` -> `v1.34.1`
`github.com/spf13/cast`	`v1.6.0` -> `v1.7.0`
`golang.org/x/sys`	`v0.25.0` -> `v0.27.0`
`golang.org/x/text`	`v0.18.0` -> `v0.20.0`

renovate bot added the kind/dependencies Pull requests that update a dependency file label Sep 13, 2024

github-actions bot added the size/M Denotes a PR that changes 30-99 lines, ignoring generated files. label Sep 13, 2024

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.80.1~~ deps: update module github.com/anchore/grype to v0.81.0 Sep 27, 2024

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from 9b0206b to d700b54 Compare September 27, 2024 22:29

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from d700b54 to 5b8e104 Compare October 11, 2024 22:26

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.81.0~~ deps: update module github.com/anchore/grype to v0.82.0 Oct 11, 2024

github-actions bot added size/L Denotes a PR that changes 100-499 lines, ignoring generated files. and removed size/M Denotes a PR that changes 30-99 lines, ignoring generated files. labels Oct 11, 2024

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from 5b8e104 to 64ada50 Compare October 19, 2024 01:12

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.82.0~~ deps: update module github.com/anchore/grype to v0.82.1 Oct 19, 2024

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from 64ada50 to 5216180 Compare October 26, 2024 00:17

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.82.1~~ deps: update module github.com/anchore/grype to v0.82.2 Oct 26, 2024

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from 5216180 to 94926b2 Compare November 2, 2024 00:47

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.82.2~~ deps: update module github.com/anchore/grype to v0.83.0 Nov 2, 2024

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from 94926b2 to b86375c Compare November 9, 2024 00:56

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.83.0~~ deps: update module github.com/anchore/grype to v0.84.0 Nov 9, 2024

deps: update module github.com/anchore/grype to v0.85.0

493bc42

renovate bot force-pushed the renovate/github.com-anchore-grype-0.x branch from b86375c to 493bc42 Compare November 23, 2024 01:22

renovate bot changed the title ~~deps: update module github.com/anchore/grype to v0.84.0~~ deps: update module github.com/anchore/grype to v0.85.0 Nov 23, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

deps: update module github.com/anchore/grype to v0.85.0 #538

deps: update module github.com/anchore/grype to v0.85.0 #538

renovate bot commented Sep 13, 2024 •

edited

Loading

renovate bot commented Sep 13, 2024 •

edited

Loading

deps: update module github.com/anchore/grype to v0.85.0 #538

Are you sure you want to change the base?

deps: update module github.com/anchore/grype to v0.85.0 #538

Conversation

renovate bot commented Sep 13, 2024 • edited Loading

Release Notes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Additional Changes

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Breaking Changes

Additional Changes

Added Features

Bug Fixes

Additional Changes

Bug Fixes

Additional Changes

Configuration

renovate bot commented Sep 13, 2024 • edited Loading

ℹ Artifact update notice

File name: go.mod

renovate bot commented Sep 13, 2024 •

edited

Loading

renovate bot commented Sep 13, 2024 •

edited

Loading