deps: update dependency anchore/syft to v1.40.0 #126

renovate · 2025-07-30T22:53:33Z

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	`1.29.0` → `1.40.0`

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

anchore/syft (anchore/syft)

`v1.40.0`

Compare Source

Added Features

Exclude development or test dependencies for PNPM Package type [#4430 #4487 @rezmoss]
Catalog istio binary (pilot-discovery, pilot-agent) [#4508 #4521 @witchcraze]
Catalog envoy binary [#4506 #4530 @witchcraze]
Catalog grafana binary [#4505 #4516 @witchcraze]
Add a binary classifier for valkey [#3400 #4509 @witchcraze]

Bug Fixes

old bitnami images without spdx files arent getting picked up correctly in the catalog [#4529 #4532 @rezmoss]
wrong traefik rc versions at binary detection [#3535 #4499 @rezmoss]
FromPOSIX() in internals\windows\path.go assumes that all Windows root paths must have a colon terminator [#4070 #4075 @luissantosHCIT]
binary cataloger is picking up the go version instead of the actual binary version in traefik experimental images [#4498 #4499 @rezmoss]

(Full Changelog)

`v1.39.0`

Compare Source

Added Features

add support for Gemfile.next.lock [#4457 @HatiCode]
Command output to give more information on what catalogers look for and what they can find [#4155 #4317 @wagoodman]
Support reading lzma compressed .go.buildinfo sections with upx [#4411 #4480 @wagoodman]
Specify specific snap revision to pull [#4389 #4439 @VictorHuu]
Cannot detect embedded deps.json metadata in single-file .NET binaries [#4344 #4375 @rezmoss]
ELF note cataloger does not pick up OS field, but should [#4384 #4438 @VictorHuu]

Bug Fixes

remove debug print statement in dependency parser [#4412 @cgreeno]
dotnet-deps cataloger should skip project references with type "project" when building the sbom [#4423 #4436 @rezmoss]
File digests not computed when using --base-path [#4410 #4478 @wagoodman]
Syft should not define subpaths by default in PURLs [#4394 #4395 @rezmoss]
go: valid purl but incorrect name [#1737 #4395 @rezmoss]
Incorrect Go module PURL generation when module path contains /vN (e.g. /v5) [#4316 #4395 @rezmoss]
Failing to convert npm repository information correctly to SPDX [#4362 #4390 @kendrickm]

(Full Changelog)

`v1.38.2`

Compare Source

Bug Fixes

drop cpe from gguf [#4383 @spiffcs]
emit lua rockspec dependencies in metadata [#4376 @willmurphyscode]
Invalid SBOMs are created when GO replace directive is used [#4415 #4419 @VictorHuu]
Incorrect CPE for Vercel's Next js [#4443 #4450 @willmurphyscode]
v1.38.0 generates empty sbom for tgz sources [#4416 #4421 @VictorHuu]
Syft: The dependency graph does not include all Requires-Dist relationships defined in the package’s METADATA file [#4401 #4408 @willmurphyscode]

(Full Changelog)

`v1.38.0`

Compare Source

Added Features

add support for cataloging GGUF models [#4184 #4279 @spiffcs]
Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]

Bug Fixes

Support extras statements in Python PDM cataloger [#4352 @wagoodman]
Preserve --from argument order [#4350 @wagoodman]
SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
empty PURL output in dependency snapshot format breaks sbom-action [#4311]
Interface includes constraint elements, can only be used in type parameters [#4346]
Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
Upgrade to Golang 1.25.4 [#4341]

Additional Changes

migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
Add license enrichment from pypi to python packages [#4295 @timols]
license file search [#4327 @kzantow]

(Full Changelog)

`v1.37.0`

Compare Source

Added Features

Refactor fileresolver to not require base path [#4298 @Rupikz]
Describe cataloger capabilities via test observations [#4318 @wagoodman]
Support Java resource adapter extension .far as a Java archive [#4183 #4193 @kyounghunJang]
Add Java resource adapter extension ".rar" as supported Java archive [#4136 #4137 @thomassui]

Bug Fixes

fix empty PURL Github format [#4312 @rezmoss]
Canonicalize Ghostscript CPE/PURL for ghostscript packages from PE Binaries [#4308 @kdt523]
Respect "rpmmod" PURL qualifier [#4314 @willmurphyscode]
fix dpkg packages that are in deinstalled state should not be in SBOM [#3063 #4231 @rkirk-nos]

(Full Changelog)

`v1.36.0`

Compare Source

Added Features

Add the ability to fetch remote licenses for pnpm-lock.yaml files [#4286 @timols]
support universal (fat) mach-o binary files [#4278 @JoeyShapiro]
pdm support [#2709 #4234 @paulslaby]

Bug Fixes

Remove duplicate image source providers [#4289 @Rupikz]
syft can't extract go module information from executables on Windows [#4271 #4285 @JoeyShapiro]

(Full Changelog)

`v1.34.2`

Compare Source

Bug Fixes

Extract zip archive with multiple entries [#4283 @Rupikz]
panic while resolving maven properties in archive parser [#4288 #4290 @kzantow]

(Full Changelog)

`v1.34.1`

Compare Source

Added Features

feat: enhance setup.py parser to handle unquoted dependencies [#4255 @HalaAli198]
feat: support for identifying ffmpeg/libav libraries [#4227 @popey]
feat: PNPM latest lockfile (version 9.0) [#3927 #4256 @bernardoamc]
Add Windows ARM64 releases [#4179 #4237 @compnerd]

Bug Fixes

fix: SBOM CPE mismatch for Qt5 causes Grype to miss CVE matches [#4036 #4093 @hawkaii]
fix: use of manifest files present in Snap packages when generating SBOMs [#4147 #4151 @popey]
fix: Pom xml only archive parser [#4272 @douglasclarke]

(Full Changelog)

`v1.33.0`

Compare Source

Added Features

Modify RpmDBEntry to include modularityLabel for cyclonedx [#4212 @sfc-gh-rmaj]
Add locations onto packages read from Java native image SBOMs [#4186 @rudsberg]

(Full Changelog)

`v1.32.0`

Compare Source

Added Features

Catalog entire build list for Go projects, not just packages listed in go.mod [#432 #4127 @spiffcs]
package.json authors keyword parsing [#2250 #4003 @popey]
Conda ecosystem support (basic) [#4002 @SimeonStoykovQC]

Bug Fixes

When scanning the FFmpeg binary with Syft a new package is now added [#3988 #3994 @popey]
Warn loudly if SQLite driver is not present when needed [#3234 #4150 @kzantow]

Additional Changes

Update dependencies to use go.yaml.in/yaml [#4157 @n-bes]

(Full Changelog)

`v1.31.0`

Compare Source

Added Features

Option to set PackageSupplier in root of SPDX document generated by CLI [#3098 #4131 @spiffcs]

Bug Fixes

closed reader during java binary detection [#4129 @kzantow]
support multiple letters in openssl patch version [#4106 @honigbot]
Can not have license ID [#1964 #4132 @spiffcs]
Syft sometimes reports URL for license value when scanning JARs with a URL in Bundle-License field of manifest [#3186]

(Full Changelog)

`v1.30.0`

Compare Source

Added Features

add binary classifier for hashicorp vault [#4121 @willmurphyscode]

Bug Fixes

fix: update nondeterministic Java archive cataloging and improve groupID [#3521 #4118 @kzantow]

(Full Changelog)

`v1.29.1`

Compare Source

Bug Fixes

Missing license information for tzdata [#4102]
Improve JVM Scan Accuracy for JDK and JRE Detection [#4071 #4046 @kzantow]
Azul JDK classified as Oracle JRE [#3893 #4046 @kzantow]

(Full Changelog)

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

github-actions · 2025-08-13T17:13:39Z

Please check the build process changes in v1.29.0..v1.31.0 (may need to address them accordingly).

Click here to see the diff

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-08-27T01:08:41Z

Please check the build process changes in v1.29.0..v1.32.0 (may need to address them accordingly).

Click here to see the diff

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-09-16T06:09:19Z

Please check the build process changes in v1.29.0..v1.33.0 (may need to address them accordingly).

Click here to see the diff

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-10-15T18:57:52Z

Please check the build process changes in v1.29.0..v1.34.1 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-10-16T15:37:10Z

Please check the build process changes in v1.29.0..v1.34.2 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-10-22T20:42:04Z

Please check the build process changes in v1.29.0..v1.36.0 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-11-03T20:29:50Z

Please check the build process changes in v1.29.0..v1.37.0 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-11-18T02:10:10Z

Please check the build process changes in v1.29.0..v1.38.0 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-12-10T03:02:59Z

Please check the build process changes in v1.29.0..v1.38.2 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2025-12-23T02:27:04Z

Please check the build process changes in v1.29.0..v1.39.0 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions · 2026-01-08T18:13:40Z

Please check the build process changes in v1.29.0..v1.40.0 (may need to address them accordingly).

Click here to see the diff

commit e9a8bc5ab97f94b7f9210d7a0f4a981cdbb22232
Author: Christopher Angelo Phillips <[email protected]>
Date:   Wed Oct 15 11:12:20 2025 -0400

    chore: update to use old configuration on new cosign (#4287)
    
    Signed-off-by: Christopher Phillips <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index bb278f1a..eaf89dfc 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -337,6 +337,7 @@ signs:
     certificate: "${artifact}.pem"
     args:
       - "sign-blob"
+      - "--use-signing-config=false"
       - "--oidc-issuer=https://token.actions.githubusercontent.com"
       - "--output-certificate=${certificate}"
       - "--output-signature=${signature}"

commit 21d50d7c31fa3d5d8940c091ed0444748b5219e6
Author: Saleem Abdulrasool <[email protected]>
Date:   Wed Sep 24 12:29:03 2025 -0700

    feat: add ARM64 Windows build target (#4237)
    
    Signed-off-by: Saleem Abdulrasool <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index 957aca6c..bb278f1a 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -42,7 +42,7 @@ builds:
     dir: ./cmd/syft
     binary: syft
     goos: [windows]
-    goarch: [amd64]
+    goarch: [amd64, arm64]
     mod_timestamp: *build-timestamp
     ldflags: *build-ldflags
 

commit 21496e7a816bdf8578c9c7656dc291d342775cca
Author: Emmanuel Ferdman <[email protected]>
Date:   Mon Aug 11 16:38:33 2025 +0300

    chore: update GoReleaser configurations (#4128)
    
    Signed-off-by: Emmanuel Ferdman <[email protected]>

diff --git a/.goreleaser.yaml b/.goreleaser.yaml
index de69b0eb..957aca6c 100644
--- a/.goreleaser.yaml
+++ b/.goreleaser.yaml
@@ -48,12 +48,13 @@ builds:
 
 archives:
   - id: linux-archives
-    builds: [linux-build]
+    ids: [linux-build]
   - id: darwin-archives
-    builds: [darwin-build]
+    ids: [darwin-build]
   - id: windows-archives
-    format: zip
-    builds: [windows-build]
+    formats:
+      - zip
+    ids: [windows-build]
 
 nfpms:
   - license: "Apache 2.0"

github-actions bot mentioned this pull request Jul 30, 2025

sync: deps: update dependency anchore/syft to v1.39.0 #127

Open

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.29.1~~ deps: update dependency anchore/syft to v1.30.0 Aug 8, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch 2 times, most recently from fc145da to 1ff175a Compare August 13, 2025 17:13

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.30.0~~ deps: update dependency anchore/syft to v1.31.0 Aug 13, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch 2 times, most recently from ce40edb to e5f5321 Compare August 27, 2025 01:08

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.31.0~~ deps: update dependency anchore/syft to v1.32.0 Aug 27, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from e5f5321 to e77f0d8 Compare September 16, 2025 06:08

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.32.0~~ deps: update dependency anchore/syft to v1.33.0 Sep 16, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from e77f0d8 to b67b00c Compare October 15, 2025 18:57

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.33.0~~ deps: update dependency anchore/syft to v1.34.1 Oct 15, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from b67b00c to 80120be Compare October 16, 2025 15:36

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.34.1~~ deps: update dependency anchore/syft to v1.34.2 Oct 16, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from 80120be to bfd011f Compare October 22, 2025 20:40

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.34.2~~ deps: update dependency anchore/syft to v1.36.0 Oct 22, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from bfd011f to eca0194 Compare November 3, 2025 20:29

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.36.0~~ deps: update dependency anchore/syft to v1.37.0 Nov 3, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from eca0194 to 9152f44 Compare November 18, 2025 02:09

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.37.0~~ deps: update dependency anchore/syft to v1.38.0 Nov 18, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from 9152f44 to c2c7959 Compare December 10, 2025 03:02

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.38.0~~ deps: update dependency anchore/syft to v1.38.2 Dec 10, 2025

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from c2c7959 to 87020ea Compare December 23, 2025 02:26

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.38.2~~ deps: update dependency anchore/syft to v1.39.0 Dec 23, 2025

deps: update dependency anchore/syft to v1.40.0

c5aa4c1

renovate bot force-pushed the midstream/renovate/anchore-syft-1.x branch from 87020ea to c5aa4c1 Compare January 8, 2026 18:13

renovate bot changed the title ~~deps: update dependency anchore/syft to v1.39.0~~ deps: update dependency anchore/syft to v1.40.0 Jan 8, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

deps: update dependency anchore/syft to v1.40.0 #126

deps: update dependency anchore/syft to v1.40.0 #126

Uh oh!

renovate bot commented Jul 30, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Aug 13, 2025

Uh oh!

github-actions bot commented Aug 27, 2025

Uh oh!

github-actions bot commented Sep 16, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 16, 2025

Uh oh!

github-actions bot commented Oct 22, 2025

Uh oh!

github-actions bot commented Nov 3, 2025

Uh oh!

github-actions bot commented Nov 18, 2025

Uh oh!

github-actions bot commented Dec 10, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

deps: update dependency anchore/syft to v1.40.0 #126

Are you sure you want to change the base?

deps: update dependency anchore/syft to v1.40.0 #126

Uh oh!

Conversation

renovate bot commented Jul 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Added Features

Bug Fixes

Added Features

Added Features

Bug Fixes

Additional Changes

Added Features

Bug Fixes

Added Features

Bug Fixes

Bug Fixes

Configuration

Uh oh!

github-actions bot commented Aug 13, 2025

Uh oh!

github-actions bot commented Aug 27, 2025

Uh oh!

github-actions bot commented Sep 16, 2025

Uh oh!

github-actions bot commented Oct 15, 2025

Uh oh!

github-actions bot commented Oct 16, 2025

Uh oh!

github-actions bot commented Oct 22, 2025

Uh oh!

github-actions bot commented Nov 3, 2025

Uh oh!

github-actions bot commented Nov 18, 2025

Uh oh!

github-actions bot commented Dec 10, 2025

Uh oh!

github-actions bot commented Dec 23, 2025

Uh oh!

github-actions bot commented Jan 8, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate bot commented Jul 30, 2025 •

edited

Loading