deps: update dependency anchore/syft to v1.23.1

[red-hat-konflux]

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	1.19.0 -> 1.23.1

---

Release Notes

anchore/syft (anchore/syft)

v1.23.1

Compare Source

Additional Changes

• Resolve owned file paths when searching for overlaps [#​3828 @​wagoodman]

(Full Changelog)

v1.23.0

Compare Source

Added Features

• Support skipping archive extraction with file source [#​3795 @​adammcclenaghan]
• Use the R cataloger in directory scans [#​3774 @​spiffcs]
• Add support for detecting javascript assets in .NET projects using libman [#​3825 @​wagoodman]
• Parse GitHub actions comments [#​3776 @​wagoodman]
• Support chrome binary detection [#​3174 #​3136 @​lem-onade]
• Add support for detecting undeclared license files scanning from python installations [#​2624 #​3779 @​wagoodman]

Bug Fixes

• .NET cataloger should consider compile target paths from deps.json [#​3821 @​wagoodman]
• Skip license scanner injection [#​3796 @​adammcclenaghan]
• Delete collection name/type key entries when empty [#​3797 @​adammcclenaghan]
• Use module name over relative paths in go.mod replace directives [#​3812 @​VictorHuu]
• Correct variable names for Conan lock parsing version handling [#​3802 @​musangk]
• Consider DLL claims for dependencies of .NET packages from deps.json [#​3822 @​wagoodman]
• Empty source during decoding an SBOM document should not be fatal [#​3791 @​wagoodman]
• Dpkg are not detected when scanning a directory [#​3726 #​3820 @​VictorHuu]
• Support golang tip image [#​3681 #​3757 @​VictorHuu]
• syft cataloger list should flatten options [#​3801 #​3804 @​kzantow]
• Unable to generate a correct SBOM for C++ project [#​3755]

(Full Changelog)

v1.22.0

Compare Source

Added Features

• Improve .NET package CPE generation [#​3764 @​wagoodman]
• Catalog deb archives directly [#​3315 #​3704 @​popey]

Bug Fixes

• Dotnet-Portable-Executable-Cataloger uses wrong component version for dotnet runtime libraries [#​3282 #​3768 @​wagoodman]
• Dotnet deps cataloger returns "wrong" dotnet-framework dependencies and misses out on the runtime (for applications) [#​2347 #​3768 @​wagoodman]
• .NET deps.json should be considered as installation evidence [#​3570 #​3563 @​wagoodman]
• Dotnet PE binary cataloger is detecting false positives [#​3469 #​3563 @​wagoodman]
• Long Processing Time in dpkg-db-cataloger with all-layers Option (Syft 1.20.0) [#​3683 #​3636 @​kzantow]

(Full Changelog)

v1.21.0

Compare Source

Added Features

• Support extracting symbols in .dynsym section for GraalVM Native Images [#​3647 @​rudsberg]
• Support fluent-bit 1.7.0 dev, rc [#​3133 #​3701 @​popey]

Bug Fixes

• Suppress "file already closed" errors [#​3695 @​wagoodman]
• Add set ID to dotnet (lock) packages [#​3719 @​houdini91]
• Location order on packages should consider evidence annotations when sorting [#​3720 @​wagoodman]
• Fix /etc/redhat-release file parsing when resolving distro details [#​3688 @​wagoodman]
• Syft fileresolver.containsPath allocates unnecessarily [#​3729 #​3730 @​yoav-orca]
• Dart: Syft incorrectly generates SBOM with version 0.0.0 for SDK dependencies [#​3158 #​3572 @​sgreg]
• Download location is not a valid URI [#​3696 #​3697 @​stgrace]

Additional Changes

• Update rustaudit module name [#​3689 @​tofay]
• bump golang.org/x/net from 0.35.0 to 0.36.0 [#​3709 @​dependabot]

(Full Changelog)

v1.20.0

Compare Source

Added Features

• Add file catalogers to selection configuration [#​3505 @​wagoodman]
• Configuration for including license contents in SBOM [#​3626 #​3631 @​spiffcs]
• Support Bitnami embedded SBOMs [#​3065 #​3341 @​juan131] [#​3676 @​willmurphyscode]

Bug Fixes

• Version parse caused by line breaks on different platforms [#​3672 @​idhyt]
• License files which do not match an SPDX expression are erroneously handled as 'unlicensed' [#​3412 #​3366 @​HeyeOpenSource]
• Incorrect URL encoding of package url (purl) [#​3533 #​3678 @​kzantow]
• syft should not warn on known bad package.json [#​3470 #​3645 @​kzantow]
• Scanning a project with many DLLs is slow [#​3455 #​3677 @​rogueai]
• cyclone-dx presenter drops files, includes only packages [#​3435 #​3539 @​spiffcs]
• "syft config" output swaps comments for search-indexed-archives / search-unindexed-archives [#​3624 #​3630 @​spiffcs]
• dpkg license improvement for non SPDX licenses [#​3090 #​3366 @​HeyeOpenSource]
• RPM-based PURLs sometimes have incorrect namespace (specifically OpenSUSE) [#​3534 #​3615 @​mprpic]

Additional Changes

• update to go 1.24.x [#​3660 @​westonsteimel]
• replace all shorthand tags of mapstruct -> mapstructure [#​3633 @​spiffcs]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

To execute skipped test pipelines write comment /ok-to-test.

This PR has been generated by MintMaker (powered by Renovate Bot).