chore: update dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

Update Request | Renovate Bot

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
@tailwindcss/cli (source)	4.2.2 → 4.3.2
@tailwindcss/typography	0.5.19 → 0.5.20
github.com/anchore/clio	v0.1.0 → v0.1.1
github.com/anchore/grype	v0.112.0 → v0.115.0
github.com/anchore/syft	v1.44.0 → v1.46.0
github.com/google/go-containerregistry	v0.21.6 → v0.21.7
github.com/jellydator/ttlcache/v3	v3.4.0 → v3.4.1
github.com/klauspost/compress	v1.18.6 → v1.19.0
github.com/knadh/koanf/v2	v2.3.4 → v2.3.5
github.com/minio/minio-go/v7	v7.2.0 → v7.2.1
github.com/siderolabs/gen	v0.8.6 → v0.8.7
github.com/siderolabs/go-blockdevice/v2	v2.0.29 → v2.0.31
github.com/siderolabs/talos	v1.14.0-alpha.1 → v1.14.0-alpha.2
github.com/siderolabs/talos/pkg/machinery	v1.14.0-alpha.1 → v1.14.0-alpha.2
github.com/sigstore/cosign/v3	v3.0.6 → v3.1.1
github.com/sigstore/rekor	v1.5.2 → v1.5.3
github.com/sigstore/sigstore	v1.10.7 → v1.10.8
github.com/sigstore/sigstore-go	v1.1.4 → v1.2.1
go.yaml.in/yaml/v4	v4.0.0-rc.4 → v4.0.0-rc.6
golang.org/x/crypto	v0.52.0 → v0.53.0
golang.org/x/sync	v0.20.0 → v0.21.0
golang.org/x/sys	v0.45.0 → v0.46.0
golang.org/x/text	v0.37.0 → v0.38.0
tailwindcss (source)	4.2.2 → 4.3.2

---

Release Notes

tailwindlabs/tailwindcss (@​tailwindcss/cli)

v4.3.2

Compare Source

Fixed

• Support bare spacing values for auto-rows-* and auto-cols-* utilities (e.g. auto-rows-12 and auto-cols-16) (#​20229)
• Prevent @tailwindcss/cli in --watch mode from crashing on Windows when @source points to a directory that doesn't exist (#​20242)
• Prevent @tailwindcss/vite from crashing in Deno v2.8.x when context.parentURL is not a valid URL (#​20245)
• Ensure @tailwindcss/cli in --watch mode rebuilds when the input CSS file changes in an ignored directory (#​20246)
• Allow @variant rules used in addBase(…) to use custom variants defined later (#​20247)
• Prevent @tailwindcss/vite from crashing during HMR when scanned files or directories are deleted (#​20259)
• Generate font-size instead of color declarations for text-[--spacing(…)] (#​20260)
• Prevent @source patterns from scanning unrelated sibling files and folders (#​20263)
• Extract class candidates adjacent to Template Toolkit delimiters like %]…[% in .tt, .tt2, and .tx files (#​20269)
• Extract class candidates from conditional Maud syntax like p.text-black[condition] (#​20269)
• Prevent @position-try rules from triggering unknown at-rule warnings when optimizing CSS (#​20277)
• Support class suggestions for named opacity modifiers from --opacity theme values (#​20287)
• Prevent type errors in @tailwindcss/postcss when used with newer PostCSS patch releases (#​20289)

v4.3.1

Compare Source

Added

• Add --silent option to suppress output in @tailwindcss/cli (#​20100)

Fixed

• Remove deprecation warnings by using Module#registerHooks instead of Module#register on Node 26+ (#​20028)
• Canonicalization: don't crash when plugin utilities throw for unsupported values (#​20052)
• Allow @apply to be used with CSS mixins (#​19427)
• Ensure not-* correctly negates @container queries, including style(…) queries (#​20059)
• Ensure drop-shadow-* color utilities work with custom shadow values containing calc(…) (#​20080)
• Fix 'Sourcemap is likely to be incorrect' warnings when using @tailwindcss/vite (#​20103)
• Ensure @tailwindcss/webpack can be installed in Rspack projects without requiring webpack as a peer dependency (#​20027)
• Canonicalization: don't suggest invalid calc(…) expressions (e.g. px-[calc(1rem+0px)] → px-[calc(1rem+0)]) (#​20127)
• Canonicalization: avoid suggesting large spacing-scale values for arbitrary lengths (e.g. left-[99999px] → left-[99999px], not left-24999.75) (#​20130)
• Ensure @tailwindcss/cli in --watch mode recovers when a tracked dependency is deleted and restored (#​20137)
• Ensure standalone @tailwindcss/cli binaries are ignored when scanning for class candidates (#​20139)
• Ensure class candidates are extracted from Twig addClass(…) and removeClass(…) calls (#​20198)
• Don't crash in the Ruby or Vue preprocessors when scanning files containing invalid UTF-8 bytes (#​19588)
• Allow @variant to be used inside addBase (#​19480)
• Ensure @source globs with symlinks are preserved (#​20203)
• Ensure later @source rules can re-include files excluded by earlier @source not rules (#​20203)
• Upgrade: don't migrate empty class rules to invalid @utility rules (#​20205)
• Ensure transitions between inset-shadow-none and other inset shadows work correctly (#​20208)
• Ensure explicitly referenced @source directories are scanned even when ignored by git (#​20214)
• Ensure @source globs ending in **/* preserve dynamic path segments to avoid scanning too many files (#​20217)
• Canonicalization: don't fold calc(…) divisions when the result would require high precision (e.g. w-[calc(100%/3.5)] → w-[calc(100%/3.5)], not w-[28.571428571428573%]) (#​20221)
• Serve ESM type declarations to ESM importers of @tailwindcss/postcss (#​20228)

Changed

• Generate 0 instead of calc(var(--spacing) * 0) for spacing utilities like m-0 and left-0 (#​20196)
• Generate var(--spacing) instead of calc(var(--spacing) * 1) for spacing utilities like m-1 and left-1 (#​20196)

v4.3.0

Compare Source

Added

• Add @container-size utility (#​18901)
• Add scrollbar-{auto,thin,none} utilities for scrollbar-width, and scrollbar-thumb-* / scrollbar-track-* color utilities for scrollbar-color (#​19981, #​20019)
• Add scrollbar-gutter-* utilities (#​20018)
• Add zoom-* utilities (#​20020)
• Add tab-* utilities (#​20022)
• Allow using @variant with stacked variants (e.g. @variant hover:focus { … }) (#​19996)
• Allow using @variant with compound variants (e.g. @variant hover, focus { … }) (#​19996)
• Support --default(…) in --value(…) and --modifier(…) for functional @utility definitions (#​19989)

Fixed

• Ensure @plugin resolves package JavaScript entries instead of browser CSS entries when using @tailwindcss/vite (#​19949)
• Fix relative @import and @plugin paths resolving from the wrong directory when using @tailwindcss/vite (#​19965)
• Ensure CSS files containing @variant are processed by @tailwindcss/vite (#​19966)
• Resolve imports relative to base when result.opts.from is not provided when using @tailwindcss/postcss (#​19980)
• Canonicalization: preserve significant _ whitespace in arbitrary values (#​19986)
• Canonicalization: add parentheses when removing whitespace from arbitrary values would hurt readability (e.g. w-[calc(100%---spacing(60))] → w-[calc(100%-(--spacing(60)))]) (#​19986)
• Canonicalization: preserve the original unit in arbitrary values instead of normalizing to base units (e.g. -mt-[20in] → mt-[-20in], not mt-[-1920px]) (#​19988)
• Canonicalization: migrate arbitrary :has() variants from [&:has(…)] to has-[…] (#​19991)
• Upgrade: don’t migrate inline style attributes (e.g. style="flex-grow: 1" → style="flex-grow: 1", not style="grow: 1") (#​19918)
• Allow multiple @utility definitions with the same name but different value types (#​19777)
• Export missing PluginWithConfig type from tailwindcss/plugin to fix errors when inferring plugin config types (#​19707)
• Ensure start and end legacy utilities without values do not generate CSS (#​20003)
• Ensure --value(…) is required in functional @utility definitions (#​20005)
• Canonicalization: preserve required whitespace around operators in negated arbitrary values (e.g. -left-[(var(--a)+var(--b))]) (#​20011)

v4.2.4

Compare Source

Fixed

• Ensure imports in @import and @plugin still resolve correctly when using Vite aliases in @tailwindcss/vite (#​19947)

v4.2.3

Compare Source

Fixed

• Canonicalization: improve canonicalizations for tracking-* utilities by preferring non-negative utilities (e.g. -tracking-tighter → tracking-wider) (#​19827)
• Fix crash due to invalid characters in candidate (exceeding valid unicode code point range) (#​19829)
• Ensure query params in imports are considered unique resources when using @tailwindcss/webpack (#​19723)
• Canonicalization: collapse arbitrary values into shorthand utilities (e.g. px-[1.2rem] py-[1.2rem] → p-[1.2rem]) (#​19837)
• Canonicalization: collapse border-{t,b}-* into border-y-*, border-{l,r}-* into border-x-*, and border-{t,r,b,l}-* into border-* (#​19842)
• Canonicalization: collapse scroll-m{t,b}-* into scroll-my-*, scroll-m{l,r}-* into scroll-mx-*, and scroll-m{t,r,b,l}-* into scroll-m-* (#​19842)
• Canonicalization: collapse scroll-p{t,b}-* into scroll-py-*, scroll-p{l,r}-* into scroll-px-*, and scroll-p{t,r,b,l}-* into scroll-p-* (#​19842)
• Canonicalization: collapse overflow-{x,y}-* into overflow-* (#​19842)
• Canonicalization: collapse overscroll-{x,y}-* into overscroll-* (#​19842)
• Read from --placeholder-color instead of --background-color for placeholder-* utilities (#​19843)
• Upgrade: ensure files are not emptied out when killing the upgrade process while it's running (#​19846)
• Upgrade: use config.content when migrating from Tailwind CSS v3 to Tailwind CSS v4 (#​19846)
• Upgrade: never migrate files that are ignored by git (#​19846)
• Add .env and .env.* to default ignored content files (#​19846)
• Canonicalization: migrate overflow-ellipsis into text-ellipsis (#​19849)
• Canonicalization: migrate start-full → inset-s-full, start-auto → inset-s-auto, start-px → inset-s-px, and start-<number> → inset-s-<number> as well as negative versions (#​19849)
• Canonicalization: migrate end-full → inset-e-full, end-auto → inset-e-auto, end-px → inset-e-px, and end-<number> → inset-e-<number> as well as negative versions (#​19849)
• Canonicalization: move the - sign inside the arbitrary value -left-[9rem] → left-[-9rem] (#​19858)
• Canonicalization: move the - sign outside the arbitrary value ml-[calc(-1*var(--width))] → -ml-(--width) (#​19858)
• Improve performance when scanning JSONL / NDJSON files (#​19862)
• Support NODE_PATH environment variable in standalone CLI (#​19617)

tailwindlabs/tailwindcss-typography (@​tailwindcss/typography)

v0.5.20

Compare Source

Fixed

• Support installing with stable versions of Tailwind CSS v4 (#​424)

anchore/clio (github.com/anchore/clio)

v0.1.1

Compare Source

Additional Changes

• Use released shared workflow [PR #​218 @​wagoodman]
• update anchore dependencies [PR #​206 @​anchore-oss-update-bot]
• Chore fix tests [PR #​210 @​willmurphyscode]
• restore Go version to 1.25.0 [PR #​209 @​wagoodman]
• update tool versions [PR #​208 @​anchore-oss-update-bot]
• update tool versions [PR #​203 @​anchore-oss-update-bot]
• update Go version [PR #​205 @​anchore-oss-update-bot]

Dependencies

20 dependency changes (18 updated, 2 removed). 1 vulnerability remediated.

🟢 Remediated (1)

• GO-2026-5024 (Low) — golang.org/x/sys

Toolchains (1)

• Go minimum version: 1.24.0 → 1.25.0

Updated (18 packages)

• dario.cat/mergo v1.0.1 → v1.0.2
• github.com/anchore/fangs v0.0.0-a269841 → v0.1.1
• github.com/anchore/go-homedir v0.0.0-c296685 → v0.1.1
• github.com/anchore/go-logger v0.0.0-07ae343 → v0.1.1
• github.com/anchore/go-make v0.1.0 → v0.8.0
• github.com/fsnotify/fsnotify v1.8.0 → v1.9.0
• github.com/go-viper/mapstructure/v2 v2.4.0 → v2.5.0
• github.com/gookit/color v1.6.0 → v1.6.1
• github.com/pelletier/go-toml/v2 v2.2.3 → v2.2.4
• github.com/sagikazarmark/locafero v0.7.0 → v0.11.0
• github.com/sourcegraph/conc v0.3.0 → v0.3.1-0.5f936ab
• github.com/spf13/afero v1.12.0 → v1.15.0
• github.com/spf13/cast v1.7.1 → v1.10.0
• github.com/spf13/viper v1.20.0 → v1.21.0
• golang.org/x/mod v0.34.0 → v0.37.0
• golang.org/x/sys v0.41.0 → v0.46.0 (🟢 remediated GO-2026-5024)
• golang.org/x/term v0.40.0 → v0.44.0
• golang.org/x/text v0.23.0 → v0.28.0

Removed (2 packages)

• go.uber.org/atomic v1.9.0
• go.uber.org/multierr v1.9.0

(Full Changelog)

anchore/grype (github.com/anchore/grype)

v0.115.0

Compare Source

Added Features

• emit golang.org/x/net vulns from govlundb [PR #​3534 @​willmurphyscode]
• Merge Go vuln matches with GHSA matches [Issue #​3515]

Bug Fixes

• only emit records for stdlib [PR #​3527 @​willmurphyscode]
• mark hummingbird distro as rolling [PR #​3521 @​willmurphyscode]
• disable go stdlib CPE matching by default [PR #​3517 @​willmurphyscode]
• merge in custom ranges when applicable [PR #​3514 @​willmurphyscode]
• exclude linux-kbuild deb indirect matches by default [PR #​3506 @​westonsteimel]
• avoid panic on invalid RHEL version IDs [PR #​3490 @​jspilman]
• Support reading CycloneDX 1.7 SBOMs [Issue #​3373]
• Grype cannot read mariadb version correctly [Issue #​3452]
• grype hangs when downloading certain images using registry client [Issue #​3492]
• Can we get a fix for these Critical findings reported for grype [Issue #​3484]

Additional Changes

• Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #​3493]
• Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #​3494]

Dependencies

35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
• GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
• GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
• GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
• GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

• github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
• github.com/anchore/bubbly v0.2.0 → v0.2.1
• github.com/anchore/clio v0.1.0 → v0.1.1
• github.com/anchore/fangs v0.1.0 → v0.1.1
• github.com/anchore/go-collections v0.1.0 → v0.1.1
• github.com/anchore/go-homedir v0.1.0 → v0.1.1
• github.com/anchore/go-logger v0.1.0 → v0.1.1
• github.com/anchore/go-lzo v0.1.0 → v0.1.1
• github.com/anchore/go-macholibre v0.1.0 → v0.1.1
• github.com/anchore/go-make v0.5.0 → v0.8.0
• github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
• github.com/anchore/go-sync v0.1.0 → v0.1.1
• github.com/anchore/stereoscope v0.2.1 → v0.2.2
• github.com/anchore/syft v1.45.1 → v1.46.0
• github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
• github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
• github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
• github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
• github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
• github.com/google/go-containerregistry v0.21.6 → v0.21.7
• github.com/mattn/go-runewidth v0.0.19 → v0.0.21
• github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
• github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
• golang.org/x/crypto v0.52.0 → v0.53.0
• golang.org/x/mod v0.36.0 → v0.37.0
• golang.org/x/net v0.55.0 → v0.56.0
• golang.org/x/sync v0.20.0 → v0.21.0
• golang.org/x/sys v0.45.0 → v0.46.0
• golang.org/x/term v0.43.0 → v0.44.0
• golang.org/x/text v0.37.0 → v0.38.0
• golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

• github.com/piprate/json-gold v0.7.0
• github.com/pquerna/cachecontrol v0.0.0-1555304
• github.com/tailscale/hujson v0.0.0-ecc657c

Removed (1 package)

• github.com/google/osv-scanner v1.9.2

(Full Changelog)

v0.114.0

Compare Source

Added Features

• Add ability to scan zarf packages [#​3329 #​3366 @​brandtkeller]

Additional Changes

• respect withdrawn status of Go Vuln DB OSV records [#​3495 @​willmurphyscode]
• Govulndb OSV transformer [#​3485 @​willmurphyscode]

(Full Changelog)

v0.113.0

Compare Source

Added Features

• Include Ubuntu 26.04 "resolute" in distro codenames [#​3397 @​anchore-oss-update-bot]
• source RPM filtering on Hummingbird [#​3410 @​willmurphyscode]

Bug Fixes

• use relatedVulnerabilities description as fallback in SARIF output [#​3271 @​axidex]
• improve platform CPE determination logic [#​3470 @​westonsteimel]
• normalize uppercase V in semantic version comparison [#​3461 @​immanuwell]
• purl handling in cgr maven libs [#​3420 @​willmurphyscode]
• Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#​3037 #​3089 @​wasup-yash]
• Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#​3101 #​3396 @​Dashtid]
• Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#​3442 #​3475 @​msnandhis]
• zsh completion fails [#​2933 #​3433 @​brandtkeller]

(Full Changelog)

anchore/syft (github.com/anchore/syft)

v1.46.0

Compare Source

Added Features

• Add purl types to cataloger info cmd [PR #​4984 @​wagoodman]
• Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #​4949] [PR #​4950 @​ktopcuoglu]
• Add bin classifier for Elastic agen [Issue #​4973] [PR #​4968 @​rezmoss]
• SPDX 3 Support [Issue #​4250] [PR #​4269 @​kzantow]
• Add Deno support [Issue #​4417] [PR #​4523 @​rezmoss]
• Catalog Elastic Beats binary [Issue #​4961] [PR #​4969 @​rezmoss]
• Add binary classifiers for Elastic Beats [Issue #​4972] [PR #​4969 @​rezmoss]
• Catalog elastic-agent binary [Issue #​4962]
• Add support for Bun lockfile (bun.lock) [Issue #​4617] [PR #​4625 @​hnnynh]
• Add .bpl file support to the PE / DLL cataloger [Issue #​4664] [PR #​4954 @​jfjrh2014]

Bug Fixes

• respect arch qualifier [PR #​4987 @​willmurphyscode]
• Preserve dependency edges when a compliance stub changes a package ID [PR #​4993 @​wagoodman]
• Support envoy binary various versions [Issue #​4590] [PR #​4605 @​rezmoss]
• .net deps.json cataloger shows phantom pkgs for reference assembly library entries [Issue #​4970] [PR #​4971 @​rezmoss]
• Syft does not extract package licenses from opkg manager [Issue #​4940] [PR #​4963 @​Dashtid]
• squashfs breaks with godisk-fs 1.8.0 [Issue #​4718]
• requirements.txt cataloger silently drops PEP 440 local version identifiers, producing incorrect PURL [Issue #​4958] [PR #​4959 @​kzantow]

Dependencies

34 dependency changes (31 updated, 3 added). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
• GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
• GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
• GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
• GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

• github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
• github.com/anchore/bubbly v0.2.0 → v0.2.1
• github.com/anchore/clio v0.1.0 → v0.1.1
• github.com/anchore/fangs v0.1.0 → v0.1.1
• github.com/anchore/go-collections v0.1.0 → v0.1.1
• github.com/anchore/go-homedir v0.1.0 → v0.1.1
• github.com/anchore/go-logger v0.1.0 → v0.1.1
• github.com/anchore/go-lzo v0.1.0 → v0.1.1
• github.com/anchore/go-macholibre v0.1.0 → v0.1.1
• github.com/anchore/go-make v0.5.0 → v0.8.0
• github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
• github.com/anchore/go-sync v0.1.0 → v0.1.1
• github.com/anchore/stereoscope v0.2.1 → v0.2.2
• github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
• github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
• github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
• github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
• github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
• github.com/google/go-containerregistry v0.21.6 → v0.21.7
• github.com/jedib0t/go-pretty/v6 v6.7.10 → v6.8.1
• github.com/mattn/go-runewidth v0.0.19 → v0.0.21
• github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
• github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
• golang.org/x/crypto v0.52.0 → v0.53.0
• golang.org/x/mod v0.36.0 → v0.37.0
• golang.org/x/net v0.55.0 → v0.56.0
• golang.org/x/sync v0.20.0 → v0.21.0
• golang.org/x/sys v0.45.0 → v0.46.0
• golang.org/x/term v0.43.0 → v0.44.0
• golang.org/x/text v0.37.0 → v0.38.0
• golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

• github.com/piprate/json-gold v0.7.0
• github.com/pquerna/cachecontrol v0.0.0-1555304
• github.com/tailscale/hujson v0.0.0-ecc657c

(Full Changelog)

v1.45.1

Compare Source

Bug Fixes

• bump stereoscope to pull in fix for registry client hanging [#​4934 @​anchore-oss-update-bot]

(Full Changelog)

v1.45.0

Compare Source

Added Features

• Add support for ZapAddOns as jar files [#​4654 #​4932 @​douglasclarke]
• MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#​3297 #​4907 @​witchcraze]
• Catalog ingress-nginx binary [#​4818 #​4857 @​witchcraze]

Bug Fixes

• Support helm binary various versions [#​4820 #​4922 @​witchcraze]
• Support julia binary various versions [#​4867 #​4945 @​witchcraze]
• Support deno binary old versions [#​4865 #​4939 @​witchcraze]
• Compressed kernel modules are not scanned by the linux-kernel-cataloger [#​4721 #​4740 @​will-bates11]
• Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#​4691 #​4838 @​calumleslie]
• Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#​4539 #​4882 @​witchcraze]
• Support elixir binary rc versions [#​4819 #​4851 @​ChrisJr404]
• Exclude path ending with a slash are discarded [#​4839 #​4892 @​ChrisJr404]
• Incorrect CPE for .NET Runtime [#​4738 #​4743 @​PGrayCS]
• fix parsing of debian/copyright files [#​4708 #​4754 @​Bahtya]
• Grype ignores python requirements in arbitrary equality (===) format [#​4834 #​4835 @​cyphercodes]
• valkey is detected as both of valkey and redis [#​4591 #​4619 @​witchcraze]
• TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#​4837 #​4848 @​ChrisJr404]

Additional Changes

• hoist name normalization regexp to package level [#​4926 @​matiasinsaurralde]
• bump the actions-minor-patch group across 1 directory with 6 updates [#​4946 @​dependabot]
• bump the actions-minor-patch group across 2 directories with 2 updates [#​4936 @​dependabot]
• bump the actions-minor-patch group across 1 directory with 4 updates [#​4927 @​dependabot]
• bump the actions-minor-patch group across 1 directory with 2 updates [#​4920 @​dependabot]
• bump the actions-minor-patch group across 1 directory with 2 updates [#​4897 @​dependabot]
• update CPE dictionary index [#​4831 @​anchore-oss-update-bot]

(Full Changelog)

google/go-c

✂ Note

PR body was truncated to here.

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • Between 12:00 AM and 03:59 AM, only on Monday (* 0-3 * * 1)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 110 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.26.3 -> 1.26.4
github.com/spdx/tools-golang	v0.5.7 -> v0.6.0-rc4
cloud.google.com/go/iam	v1.7.0 -> v1.11.0
cloud.google.com/go/monitoring	v1.24.3 -> v1.25.0
cloud.google.com/go/storage	v1.62.0 -> v1.62.2
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azcertificates	v1.4.0 -> v1.5.0
github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys	v1.4.0 -> v1.5.0
github.com/AzureAD/microsoft-authentication-library-for-go	v1.6.0 -> v1.7.2
github.com/CycloneDX/cyclonedx-go	v0.10.0 -> v0.11.0
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.31.0 -> v1.32.0
github.com/anchore/fangs	v0.1.0 -> v0.1.1
github.com/anchore/go-collections	v0.1.0 -> v0.1.1
github.com/anchore/go-homedir	v0.1.0 -> v0.1.1
github.com/anchore/go-logger	v0.1.0 -> v0.1.1
github.com/anchore/go-lzo	v0.1.0 -> v0.1.1
github.com/anchore/go-macholibre	v0.1.0 -> v0.1.1
github.com/anchore/go-struct-converter	v0.1.0 -> v0.2.0-rc2
github.com/anchore/go-sync	v0.1.0 -> v0.1.1
github.com/anchore/stereoscope	v0.1.23 -> v0.2.2
github.com/aws/aws-sdk-go-v2	v1.41.7 -> v1.41.9
github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream	v1.7.8 -> v1.7.10
github.com/aws/aws-sdk-go-v2/config	v1.32.17 -> v1.32.20
github.com/aws/aws-sdk-go-v2/credentials	v1.19.16 -> v1.19.19
github.com/aws/aws-sdk-go-v2/feature/ec2/imds	v1.18.23 -> v1.18.25
github.com/aws/aws-sdk-go-v2/internal/configsources	v1.4.23 -> v1.4.25
github.com/aws/aws-sdk-go-v2/internal/endpoints/v2	v2.7.23 -> v2.7.25
github.com/aws/aws-sdk-go-v2/internal/v4a	v1.4.24 -> v1.4.26
github.com/aws/aws-sdk-go-v2/service/acm	v1.38.3 -> v1.39.2
github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding	v1.13.9 -> v1.13.10
github.com/aws/aws-sdk-go-v2/service/internal/checksum	v1.9.13 -> v1.9.15
github.com/aws/aws-sdk-go-v2/service/internal/presigned-url	v1.13.23 -> v1.13.25
github.com/aws/aws-sdk-go-v2/service/internal/s3shared	v1.19.21 -> v1.19.23
github.com/aws/aws-sdk-go-v2/service/kms	v1.51.1 -> v1.53.0
github.com/aws/aws-sdk-go-v2/service/s3	v1.97.3 -> v1.101.0
github.com/aws/aws-sdk-go-v2/service/signin	v1.0.11 -> v1.1.1
github.com/aws/aws-sdk-go-v2/service/sso	v1.30.17 -> v1.30.19
github.com/aws/aws-sdk-go-v2/service/ssooidc	v1.35.21 -> v1.36.2
github.com/aws/aws-sdk-go-v2/service/sts	v1.42.1 -> v1.42.3
github.com/aws/smithy-go	v1.25.1 -> v1.26.0
github.com/containerd/containerd/v2	v2.3.1 -> v2.3.2
github.com/containerd/typeurl/v2	v2.2.3 -> v2.3.0
github.com/coreos/go-oidc/v3	v3.17.0 -> v3.18.0
github.com/diskfs/go-diskfs	v1.7.0 -> v1.9.3
github.com/docker/cli	v29.4.3+incompatible -> v29.5.3+incompatible
github.com/github/go-spdx/v2	v2.4.0 -> v2.7.0
github.com/go-chi/chi/v5	v5.2.5 -> v5.3.0
github.com/go-git/go-billy/v5	v5.8.0 -> v5.9.0
github.com/go-git/go-git/v5	v5.18.0 -> v5.19.1
github.com/go-openapi/analysis	v0.25.0 -> v0.25.2
github.com/go-openapi/errors	v0.22.7 -> v0.22.8
github.com/go-openapi/jsonpointer	v0.22.5 -> v0.23.1
github.com/go-openapi/jsonreference	v0.21.5 -> v0.21.6
github.com/go-openapi/loads	v0.23.3 -> v0.24.0
github.com/go-openapi/runtime	v0.29.4 -> v0.32.4
github.com/go-openapi/spec	v0.22.4 -> v0.22.6
github.com/go-openapi/strfmt	v0.26.2 -> v0.26.4
github.com/go-openapi/swag	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/cmdutils	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/conv	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/fileutils	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/jsonname	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/jsonutils	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/loading	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/mangling	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/netutils	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/stringutils	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/typeutils	v0.26.0 -> v0.26.1
github.com/go-openapi/swag/yamlutils	v0.26.0 -> v0.26.1
github.com/go-openapi/validate	v0.25.2 -> v0.26.0
github.com/golang-jwt/jwt/v5	v5.3.0 -> v5.3.1
github.com/google/cel-go	v0.28.0 -> v0.28.1
github.com/googleapis/enterprise-certificate-proxy	v0.3.14 -> v0.3.16
github.com/gookit/color	v1.6.0 -> v1.6.1
github.com/gpustack/gguf-parser-go	v0.24.0 -> v0.24.1
github.com/jsimonetti/rtnetlink/v2	v2.2.1-0.20260317095713-310581b9c6ac -> v2.2.1-0.20260614152944-ab8601692836
github.com/mdlayher/ethtool	v0.6.0 -> v0.6.1
github.com/mdlayher/netlink	v1.11.1 -> v1.11.2
github.com/mdlayher/socket	v0.6.0 -> v0.6.1
github.com/pierrec/lz4/v4	v4.1.22 -> v4.1.26
github.com/pjbgf/sha1cd	v0.4.0 -> v0.6.0
github.com/siderolabs/go-api-signature	v0.3.12 -> v0.3.13
github.com/sigstore/rekor-tiles/v2	v2.2.1 -> v2.2.2-0.20260601073857-5d098a2b6443
github.com/sigstore/timestamp-authority/v2	v2.0.6 -> v2.1.2
github.com/spiffe/go-spiffe/v2	v2.6.0 -> v2.7.0
github.com/sylabs/sif/v2	v2.24.0 -> v2.24.1
github.com/theupdateframework/go-tuf/v2	v2.4.1 -> v2.4.2
github.com/transparency-dev/formats	v0.0.0-20251017110053-404c0d5b696c -> v0.1.1
go.etcd.io/bbolt	v1.4.3 -> v1.5.0-rc.0
go.opentelemetry.io/contrib/detectors/gcp	v1.42.0 -> v1.43.0
go.opentelemetry.io/otel	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/sdk/metric	v1.43.0 -> v1.44.0
go.opentelemetry.io/otel/trace	v1.43.0 -> v1.44.0
go.yaml.in/yaml/v2	v2.4.3 -> v2.4.4
golang.org/x/exp	v0.0.0-20260218203240-3dfff04db8fa -> v0.0.0-20260410095643-746e56fc9e2f
golang.org/x/mod	v0.36.0 -> v0.37.0
golang.org/x/net	v0.55.0 -> v0.56.0
golang.org/x/term	v0.43.0 -> v0.44.0
golang.org/x/tools	v0.45.0 -> v0.46.0
google.golang.org/api	v0.274.0 -> v0.283.0
google.golang.org/genproto	v0.0.0-20260319201613-d00831a3d3e7 -> v0.0.0-20260406210006-6f92a3bedf2d
google.golang.org/genproto/googleapis/api	v0.0.0-20260504160031-60b97b32f348 -> v0.0.0-20260618152121-87f3d3e198d3
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260504160031-60b97b32f348 -> v0.0.0-20260615183401-62b3387ff324
google.golang.org/grpc	v1.81.0 -> v1.82.0
gopkg.in/ini.v1	v1.67.2 -> v1.67.3
k8s.io/api	v0.36.1 -> v0.36.2
k8s.io/apimachinery	v0.36.1 -> v0.36.2
k8s.io/client-go	v0.36.1 -> v0.36.2
modernc.org/libc	v1.70.0 -> v1.72.3
modernc.org/sqlite	v1.46.2 -> v1.51.0