deps: update dependency anchore/syft to v1.29.0

[red-hat-konflux]

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	1.19.0 -> 1.29.0

---

Release Notes

anchore/syft (anchore/syft)

v1.29.0

Compare Source

Added Features

• Catalog python uv.lock files [#​3268 #​3763 @​jkugler]

Additional Changes

• Pkg Metadata type unmarshal bug [#​4043 @​houdini91]

(Full Changelog)

v1.28.0

Compare Source

Added Features

• add native support for snap packages [#​1088 #​3929 @​wagoodman]

Additional Changes

• upgrade tablewriter dependency to use new API [#​3990 @​cpanato]

(Full Changelog)

v1.27.1

Compare Source

Bug Fixes

• Allow decoding of enterprise-modified anchorectl json files [#​3997 @​wagoodman]
• Allow decoding of anchorectl json files [#​3973 @​wagoodman]

Additional Changes

• provide separate nonroot image [#​3998 @​kzantow]

(Full Changelog)

v1.27.0

Compare Source

Added Features

• add syft schema version to version command [#​3949 @​spiffcs]

Bug Fixes

• Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#​3967 @​jayvdb]
• Remove CPE product candidates for opentelemetry and redis Rust crates [#​3962 @​jayvdb]
• Harden Container Runtime with Non-Root User [#​3941 @​MikeTheCyberGuy]
• terraform provider lock entries should not require constraints [#​3934 @​ghouscht]
• sbom cataloger returning upstream package [#​3662 #​3981 @​kzantow]
• Syft missing md5 sums and list data for dpkg packages under status.d/ [#​3912]
• Failure to detect dependency relationships between Python packages [#​3958 #​3965 @​christoph-blessing]
• Heavy memory consumption when directory scanning deb source [#​3928 #​3953 @​kzantow]
• In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#​3942 #​3944 @​kzantow]
• Syft incorrectly reports multiple APKs as parents of symlinked files [#​3847 #​3923 @​luhring]

(Full Changelog)

v1.26.1

Compare Source

Bug Fixes

• Dotnet deps binary cataloger hangs [#​3919 #​3930 @​kzantow]

(Full Changelog)

v1.26.0

Compare Source

Added Features

• Read version resources from non-.NET DLLs and executables [#​3842 #​3911 @​wagoodman]

Bug Fixes

• pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#​3922 @​wagoodman]
• syft 1.24.0 debug container - wget fails TLS [#​3891 #​3915 @​spiffcs]

(Full Changelog)

v1.25.1

Compare Source

Additional Changes

• remove go-rpmdb replace directive [#​3908 @​wagoodman]

(Full Changelog)

v1.25.0

Compare Source

Added Features

• Add PHP interpreter + extensions cataloger [#​2585 @​LaurentGoderre]

Bug Fixes

• update license content filtering default case to be 'none' for no content [#​3903 @​spiffcs]
• Distinguish openjdk vs jdk when using file source [#​3895 @​adammcclenaghan]
• Make it discoverable if Native Image contains no embedded SBOM [#​3731 #​3805 @​sathiya06]

(Full Changelog)

v1.24.0

Compare Source

Added Features

• Add cataloger for Dart pubspec [#​3292 @​LaurentGoderre]
• Translate Portage license strings to SPDX expressions [#​1763 @​wagoodman]
• Use package ID from decoded SBOMs when provided [#​1872 @​jneate]
• Annotate visible/hidden paths when all-layers scope [#​3855 @​wagoodman]
• Add support for PHP Pear [#​2775 @​LaurentGoderre]
• Detect whether full license text or a license name has been provided [#​3088 #​3876 @​spiffcs #​3450 @​spiffcs]
• Add Cataloger for Homebrew on macOS [#​3632 #​3724 @​rezmoss]
• Provide a way to get the LayerID the package was first found in [#​435 #​3858 @​wagoodman #​3138 @​tomersein]
• Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#​3324 #​3873 @​wagoodman]
• Upgrade base Docker image to gcr.io/distroless/static-debian12 [#​3840 #​3862 @​bgoareguer]
• Return full license string instead of SHA256 hash when license string exceeds 64 characters [#​3780 #​3844 @​spiffcs]
• Detect nix dependencies [#​3814 #​3837 @​wagoodman]

Bug Fixes

• update license sort to be stable with contents field [#​3860 @​spiffcs]
• Improve detection of erlang binary in alpine Linux [#​3839 @​avodotiiets]
• Do not search for main module versions within binary contents by default [#​3874 @​wagoodman]
• dpkg license improvement for non SPDX licenses [#​3090 #​3888 @​spiffcs]
• CycloneDX group field not symmetrically handled by encoder/decoders [#​2981 #​3853 @​kzantow]
• Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#​3872 #​3875 @​wagoodman]
• Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#​3864]
• .NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#​3866 #​3869 @​wagoodman]
• Propagate error in FileSourceProvider instead of warn log [#​3831 #​3845 @​Rupikz]
• Update github.com/Masterminds/semver package [#​3829 #​3836 @​popey]
• go-module-file-cataloger fails if symlinks in path [#​3614 #​3783 @​VictorHuu]
• Support fluent-bit some versions of arm/s390x images [#​3793 #​3817 @​VictorHuu]

Additional Changes

• update rust test fixtures to latest [#​3852 @​spiffcs]

(Full Changelog)

v1.23.1

Compare Source

Additional Changes

• Resolve owned file paths when searching for overlaps [#​3828 @​wagoodman]

(Full Changelog)

v1.23.0

Compare Source

Added Features

• Support skipping archive extraction with file source [#​3795 @​adammcclenaghan]
• Use the R cataloger in directory scans [#​3774 @​spiffcs]
• Add support for detecting javascript assets in .NET projects using libman [#​3825 @​wagoodman]
• Parse GitHub actions comments [#​3776 @​wagoodman]
• Support chrome binary detection [#​3174 #​3136 @​lem-onade]
• Add support for detecting undeclared license files scanning from python installations [#​2624 #​3779 @​wagoodman]

Bug Fixes

• .NET cataloger should consider compile target paths from deps.json [#​3821 @​wagoodman]
• Skip license scanner injection [#​3796 @​adammcclenaghan]
• Delete collection name/type key entries when empty [#​3797 @​adammcclenaghan]
• Use module name over relative paths in go.mod replace directives [#​3812 @​VictorHuu]
• Correct variable names for Conan lock parsing version handling [#​3802 @​musangk]
• Consider DLL claims for dependencies of .NET packages from deps.json [#​3822 @​wagoodman]
• Empty source during decoding an SBOM document should not be fatal [#​3791 @​wagoodman]
• Dpkg are not detected when scanning a directory [#​3726 #​3820 @​VictorHuu]
• Support golang tip image [#​3681 #​3757 @​VictorHuu]
• syft cataloger list should flatten options [#​3801 #​3804 @​kzantow]
• Unable to generate a correct SBOM for C++ project [#​3755]

(Full Changelog)

v1.22.0

Compare Source

Added Features

• Improve .NET package CPE generation [#​3764 @​wagoodman]
• Catalog deb archives directly [#​3315 #​3704 @​popey]

Bug Fixes

• Dotnet-Portable-Executable-Cataloger uses wrong component version for dotnet runtime libraries [#​3282 #​3768 @​wagoodman]
• Dotnet deps cataloger returns "wrong" dotnet-framework dependencies and misses out on the runtime (for applications) [#​2347 #​3768 @​wagoodman]
• .NET deps.json should be considered as installation evidence [#​3570 #​3563 @​wagoodman]
• Dotnet PE binary cataloger is detecting false positives [#​3469 #​3563 @​wagoodman]
• Long Processing Time in dpkg-db-cataloger with all-layers Option (Syft 1.20.0) [#​3683 #​3636 @​kzantow]

(Full Changelog)

v1.21.0

Compare Source

Added Features

• Support extracting symbols in .dynsym section for GraalVM Native Images [#​3647 @​rudsberg]
• Support fluent-bit 1.7.0 dev, rc [#​3133 #​3701 @​popey]

Bug Fixes

• Suppress "file already closed" errors [#​3695 @​wagoodman]
• Add set ID to dotnet (lock) packages [#​3719 @​houdini91]
• Location order on packages should consider evidence annotations when sorting [#​3720 @​wagoodman]
• Fix /etc/redhat-release file parsing when resolving distro details [#​3688 @​wagoodman]
• Syft fileresolver.containsPath allocates unnecessarily [#​3729 #​3730 @​yoav-orca]
• Dart: Syft incorrectly generates SBOM with version 0.0.0 for SDK dependencies [#​3158 #​3572 @​sgreg]
• Download location is not a valid URI [#​3696 #​3697 @​stgrace]

Additional Changes

• Update rustaudit module name [#​3689 @​tofay]
• bump golang.org/x/net from 0.35.0 to 0.36.0 [#​3709 @​dependabot]

(Full Changelog)

v1.20.0

Compare Source

Added Features

• Add file catalogers to selection configuration [#​3505 @​wagoodman]
• Configuration for including license contents in SBOM [#​3626 #​3631 @​spiffcs]
• Support Bitnami embedded SBOMs [#​3065 #​3341 @​juan131] [#​3676 @​willmurphyscode]

Bug Fixes

• Version parse caused by line breaks on different platforms [#​3672 @​idhyt]
• License files which do not match an SPDX expression are erroneously handled as 'unlicensed' [#​3412 #​3366 @​HeyeOpenSource]
• Incorrect URL encoding of package url (purl) [#​3533 #​3678 @​kzantow]
• syft should not warn on known bad package.json [#​3470 #​3645 @​kzantow]
• Scanning a project with many DLLs is slow [#​3455 #​3677 @​rogueai]
• cyclone-dx presenter drops files, includes only packages [#​3435 #​3539 @​spiffcs]
• "syft config" output swaps comments for search-indexed-archives / search-unindexed-archives [#​3624 #​3630 @​spiffcs]
• dpkg license improvement for non SPDX licenses [#​3090 #​3366 @​HeyeOpenSource]
• RPM-based PURLs sometimes have incorrect namespace (specifically OpenSUSE) [#​3534 #​3615 @​mprpic]

Additional Changes

• update to go 1.24.x [#​3660 @​westonsteimel]
• replace all shorthand tags of mapstruct -> mapstructure [#​3633 @​spiffcs]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

This PR has been generated by MintMaker (powered by Renovate Bot).

[chmeliik]

Ignore PRs like this, I don't know how to stop Mintmaker from opening them.

[red-hat-konflux]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.