fix(deps): Fix vulnerabilities

.github/workflows/documentation.yml

@@ -27,7 +27,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.4'
 
       - name: Install Groovy
         run: sudo apt-get update && sudo apt-get install groovy -y

.github/workflows/upload-go-master.yml

@@ -17,7 +17,7 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.4'
       - env:
           CGO_ENABLED: 0
         run: |

.github/workflows/verify-go.yml

@@ -9,7 +9,7 @@ on:
       - master
 
 env:
-  DEFAULT_GOLANG: '1.25.0'
+  DEFAULT_GOLANG: '1.26.4'
 
 permissions:
   contents: read  # default for all jobs (checkout); only `unit` overrides for the cancel action
@@ -52,7 +52,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.4'
       - name: Cache Golang Packages
         uses: actions/cache@v5
         with:
@@ -72,7 +72,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.4'
       - name: checkout
         uses: actions/checkout@v4
         with:
@@ -87,7 +87,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.4'
       - name: Cache Golang Packages
         uses: actions/cache@v5
         with:
@@ -107,7 +107,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.0'
+          go-version: '1.26.4'
       - name: Cache Golang Packages
         uses: actions/cache@v5
         with:

pkg/certutils/certutils_test.go

@@ -66,7 +66,7 @@ func TestCertificateUpdate(t *testing.T) {
 		fileUtils.AddFile(caCertsFile, []byte("initial cert\n"))
 
 		err := CertificateUpdate([]string{"http://non-existing-url"}, client, fileUtils, caCertsFile)
-		assert.Contains(t, err.Error(), "failed to load certificate from url: request to http://non-existing-url returned with response 404")
+		assert.Contains(t, err.Error(), "failed to load certificate from url: request to http://non-existing-url returned with response 404 Not Found")
 	})
 
 }
@@ -101,7 +101,7 @@ func TestDownloadCACertbunde(t *testing.T) {
 		{
 			name:        "bad link",
 			certsLinks:  []string{badCaseLink},
-			expectedErr: fmt.Sprintf("failed to load certificate from url: request to %s returned with response 404", badCaseLink),
+			expectedErr: fmt.Sprintf("failed to load certificate from url: request to %s returned with response 404 Not Found", badCaseLink),
 		},
 	}
 

pkg/log/sentryHook.go

@@ -63,15 +63,17 @@ func (sentryHook *SentryHook) Fire(entry *logrus.Entry) error {
 	errValue := ""
 	sentryHook.tags["correlationId"] = sentryHook.correlationID
 	sentryHook.tags["category"] = GetErrorCategory().String()
+	extra := make(map[string]interface{}, len(entry.Data))
 	for k, v := range entry.Data {
 		if k == "stepName" || k == "category" {
 			sentryHook.tags[k] = fmt.Sprint(v)
 		}
 		if k == "error" {
 			errValue = fmt.Sprint(v)
 		}
-		sentryHook.Event.Extra[k] = v
+		extra[k] = v
 	}
+	sentryHook.Event.Contexts["extra"] = extra
 	sentryHook.Hub.Scope().SetTags(sentryHook.tags)
 
 	exception := sentry.Exception{

pkg/orchestrator/github_actions.go

@@ -5,6 +5,7 @@ import (
 	"context"
 	"fmt"
 	"io"
+	"net/http"
 	"regexp"
 	"slices"
 	"strconv"
@@ -118,15 +119,15 @@ func (g *githubActionsConfigProvider) FullLogs() ([]byte, error) {
 	for i := range jobs {
 		i := i // https://golang.org/doc/faq#closures_and_goroutines
 		wg.Go(func() error {
-			_, resp, err := g.client.Actions.GetWorkflowJobLogs(g.ctx, g.owner, g.repo, jobs[i].ID, 1)
+			logsURL, _, err := g.client.Actions.GetWorkflowJobLogs(g.ctx, g.owner, g.repo, jobs[i].ID, 1)
 			if err != nil {
-				// GetWorkflowJobLogs returns "200 OK" as error when log download is successful.
-				// Therefore, ignore this error.
-				// GitHub API returns redirect URL instead of plain text logs. See:
-				// https://docs.github.com/en/enterprise-server@3.9/rest/actions/workflow-jobs?apiVersion=2022-11-28#download-job-logs-for-a-workflow-run
-				if err.Error() != "unexpected status code: 200 OK" {
-					return fmt.Errorf("fetching job logs failed: %w", err)
-				}
+				return fmt.Errorf("fetching job logs URL failed: %w", err)
+			}
+
+			//nolint:noctx
+			resp, err := http.Get(logsURL.String())
+			if err != nil {
+				return fmt.Errorf("downloading job logs failed: %w", err)
 			}
 			defer resp.Body.Close()
 

pkg/syft/syft_test.go

@@ -84,7 +84,7 @@ func TestGenerateSBOM(t *testing.T) {
 	t.Run("error case: failed to download archive (not found)", func(t *testing.T) {
 		err := syft.GenerateSBOM("http://not-found.com/syft.tar.gz", "", &execMock, &fileMock, client, "my-registry", []string{"img"})
 		assert.Error(t, err)
-		assert.Equal(t, "failed to install syft: failed to download syft binary: request to http://not-found.com/syft.tar.gz returned with response 404", err.Error())
+		assert.Equal(t, "failed to install syft: failed to download syft binary: request to http://not-found.com/syft.tar.gz returned with response 404 Not Found", err.Error())
 	})
 
 	t.Run("error case: failed to download archive (network error)", func(t *testing.T) {

pkg/whitesource/reporting.go

@@ -484,7 +484,7 @@ func transformAlertsToVulnerabilities(scan *Scan, alerts *[]Alert) []cdx.Vulnera
 			BOMRef: purl.ToString(),
 			ID:     alert.Vulnerability.Name,
 			Source: &cdx.Source{URL: alert.Vulnerability.URL},
-			Tools: &[]cdx.Tool{
+			Tools: &cdx.ToolsChoice{Tools: &[]cdx.Tool{
 				{
 					Name:    scan.AgentName,
 					Version: scan.AgentVersion,
@@ -496,7 +496,7 @@ func transformAlertsToVulnerabilities(scan *Scan, alerts *[]Alert) []cdx.Vulnera
 						},
 					},
 				},
-			},
+			}},
 			Recommendation: alert.Vulnerability.FixResolutionText,
 			Detail:         alert.Vulnerability.URL,
 			Ratings: &[]cdx.VulnerabilityRating{
@@ -585,13 +585,10 @@ func transformToUniqueFlatList(libraries *[]Library, flatMapRef *map[string]Libr
 }
 
 func declareDependency(parentPurl *packageurl.PackageURL, dependents *[]Library, collection *[]cdx.Dependency) {
-	localDependencies := []cdx.Dependency{}
+	localDependencies := []string{}
 	for _, lib := range *dependents {
 		purl := lib.ToPackageUrl()
-		// Define the dependency graph
-		// https://cyclonedx.org/use-cases/#dependency-graph
-		localDependency := cdx.Dependency{Ref: purl.ToString()}
-		localDependencies = append(localDependencies, localDependency)
+		localDependencies = append(localDependencies, purl.ToString())
 
 		if len(lib.Dependencies) > 0 {
 			declareDependency(purl, &lib.Dependencies, collection)

pkg/whitesource/testdata/sbom.golden

@@ -1,5 +1,5 @@
 <?xml version="1.0" encoding="UTF-8"?>
-<bom xmlns="http://cyclonedx.org/schema/bom/1.4" version="1">
+<bom xmlns="http://cyclonedx.org/schema/bom/1.7" version="1">
   <metadata>
     <component bom-ref="pkg:maven/com.sap/myproduct@1.3.4" type="library">
       <group>com.sap</group>