chore: update dependencies

[renovate]

Update Request | Renovate Bot

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/stale	action	digest	5f858e3 → d6f8a33
dessant/lock-threads	action	digest	1bf7ec2 → 7266a7c
github.com/anchore/syft	require	minor	v1.37.0 → v1.41.0
github.com/dsseng/syft	replace	minor	v1.26.2-0.20250703101014-f39c35d156d9 → v1.38.0
github.com/emicklei/dot	require	minor	v1.9.2 → v1.10.0
github.com/moby/buildkit	require	minor	v0.26.2 → v0.27.0
github.com/spf13/cobra	require	patch	v1.10.1 → v1.10.2
go.yaml.in/yaml/v4	require	patch	v4.0.0-rc.3 → v4.0.0-rc.4
golang.org/x/sync	require	minor	v0.18.0 → v0.19.0

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.41.0

Compare Source

Added Features

• detect Debian version from /etc/debian_version [#​4569 @​kzantow]

Bug Fixes

• correctly report supporting evidence for binary packages [#​4558 @​kzantow]

(Full Changelog)

v1.40.1

Compare Source

[!Important]
This release bumps github.com/containerd/containerd to v2, which will cause compiler errors if used alongside other dependencies that use v1 of containerd. See anchore/stereoscope#495 for a detailed discussion.

Bug Fixes

• mongodb binary not detected manual/source install [#​4540 #​4541 @​rezmoss]

(Full Changelog)

v1.40.0

Compare Source

Added Features

• Exclude development or test dependencies for PNPM Package type [#​4430 #​4487 @​rezmoss]
• Catalog istio binary (pilot-discovery, pilot-agent) [#​4508 #​4521 @​witchcraze]
• Catalog envoy binary [#​4506 #​4530 @​witchcraze]
• Catalog grafana binary [#​4505 #​4516 @​witchcraze]
• Add a binary classifier for valkey [#​3400 #​4509 @​witchcraze]

Bug Fixes

• old bitnami images without spdx files arent getting picked up correctly in the catalog [#​4529 #​4532 @​rezmoss]
• wrong traefik rc versions at binary detection [#​3535 #​4499 @​rezmoss]
• FromPOSIX() in internals\windows\path.go assumes that all Windows root paths must have a colon terminator [#​4070 #​4075 @​luissantosHCIT]
• binary cataloger is picking up the go version instead of the actual binary version in traefik experimental images [#​4498 #​4499 @​rezmoss]

(Full Changelog)

v1.39.0

Compare Source

Added Features

• add support for Gemfile.next.lock [#​4457 @​HatiCode]
• Command output to give more information on what catalogers look for and what they can find [#​4155 #​4317 @​wagoodman]
• Support reading lzma compressed .go.buildinfo sections with upx [#​4411 #​4480 @​wagoodman]
• Specify specific snap revision to pull [#​4389 #​4439 @​VictorHuu]
• Cannot detect embedded deps.json metadata in single-file .NET binaries [#​4344 #​4375 @​rezmoss]
• ELF note cataloger does not pick up OS field, but should [#​4384 #​4438 @​VictorHuu]

Bug Fixes

• remove debug print statement in dependency parser [#​4412 @​cgreeno]
• dotnet-deps cataloger should skip project references with type "project" when building the sbom [#​4423 #​4436 @​rezmoss]
• File digests not computed when using --base-path [#​4410 #​4478 @​wagoodman]
• Syft should not define subpaths by default in PURLs [#​4394 #​4395 @​rezmoss]
• go: valid purl but incorrect name [#​1737 #​4395 @​rezmoss]
• Incorrect Go module PURL generation when module path contains /vN (e.g. /v5) [#​4316 #​4395 @​rezmoss]
• Failing to convert npm repository information correctly to SPDX [#​4362 #​4390 @​kendrickm]

(Full Changelog)

v1.38.2

Compare Source

Bug Fixes

• drop cpe from gguf [#​4383 @​spiffcs]
• emit lua rockspec dependencies in metadata [#​4376 @​willmurphyscode]
• Invalid SBOMs are created when GO replace directive is used [#​4415 #​4419 @​VictorHuu]
• Incorrect CPE for Vercel's Next js [#​4443 #​4450 @​willmurphyscode]
• v1.38.0 generates empty sbom for tgz sources [#​4416 #​4421 @​VictorHuu]
• Syft: The dependency graph does not include all Requires-Dist relationships defined in the package’s METADATA file [#​4401 #​4408 @​willmurphyscode]

(Full Changelog)

v1.38.1

Compare Source

v1.38.0

Compare Source

Added Features

• add support for cataloging GGUF models [#​4184 #​4279 @​spiffcs]
• Support scanning a list of CPEs [#​3890 #​4207 @​chovanecadam]
• Syft does not detect Elixir binary on system [#​4333 #​4334 @​rezmoss]

Bug Fixes

• Support extras statements in Python PDM cataloger [#​4352 @​wagoodman]
• Preserve --from argument order [#​4350 @​wagoodman]
• SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#​4363]
• empty PURL output in dependency snapshot format breaks sbom-action [#​4311]
• Interface includes constraint elements, can only be used in type parameters [#​4346]
• Upgrade github.com/nwaples/rardecode@​v1.1.3 to 2.2.1 [#​4338]
• Upgrade to Golang 1.25.4 [#​4341]

Additional Changes

• migrate syft to use mholt/archives instead of anchore fork [#​4029 @​Rupikz]
• Add license enrichment from pypi to python packages [#​4295 @​timols]
• license file search [#​4327 @​kzantow]

(Full Changelog)

dsseng/syft (github.com/dsseng/syft)

v1.38.0

Compare Source

v1.37.0

Compare Source

v1.36.0

Compare Source

v1.35.0

Compare Source

v1.34.2

Compare Source

v1.34.1

Compare Source

v1.34.0

Compare Source

v1.33.0

Compare Source

v1.32.0

Compare Source

v1.31.0

Compare Source

v1.30.0

Compare Source

v1.29.1

Compare Source

v1.29.0

Compare Source

v1.28.0

Compare Source

v1.27.1

Compare Source

emicklei/dot (github.com/emicklei/dot)

v1.10.0

Compare Source

• add Node.Apply
• add Edge.Apply
• handle Mermaid linkStyle for Edge
• handle Mermaid animate for Edge
• spaces around Mermaid edges

moby/buildkit (github.com/moby/buildkit)

v0.27.0

Compare Source

buildkit 0.27.0

Welcome to the v0.27.0 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Tõnis Tiigi
• CrazyMax
• Akihiro Suda
• Sebastiaan van Stijn
• Justin Chadwell
• Jonathan A. Sternberg
• David Karlsson
• Dawei Wei
• Natnael Gebremariam
• Aleksandr Karpinskii
• Amr Mahdi
• Brian Goff
• Joyal George K J
• Matt Coster
• Roberto Villarreal
• Rodolfo Carvalho
• Silvin Lubecki
• Tiger Kaovilai

Notable Changes

• Built-in Dockerfile frontend has been updated to v1.21.0
• This is a first version of BuildKit with signed release images and artifacts built using Docker Github Builder
• Allow convert decisions from Session Source Policy implementations #​6427
• Github Cache backend now support optional signed cache that is cryptographically verified on import #​6397
• Provide a gateway interface for reading container filesystems during builds #​6262
• Push registry remote cache blobs in parallel for faster uploads #​6455
• Cache attestation chain pull-through responses for better performance #​6435
• Allow custom AuthConfig providers in client #​6408
• Surface policy deny messages in build errors #​6458
• Fix Git 2.52 support for matching some error conditions #​6452
• Expose the build reference in exporter buildinfo #​6424
• Improve expired keys handling in Git signature verification #​6412
• Cache gateway forwarder mounts and deduplicate snapshot responses #​6387
• Remove development gateway frontend options in favor of build-contexts #​6350
• Prevent status stream from closing too early by using an inactivity timeout #​6396
• Recover from history.db corruption #​6371
• Fix xattr copy failures on SELinux systems #​6015
• Fix error return when requesting attestation from non-index image #​6473
• Fix possible "digest not found" error when fetching attestation chain due to missing lease #​6464
• Fix Windows copy operations around protected files #​6369
• Fix possible race condition in gateway bridge forwarder #​6355
• Fix concurrency in source policy evaluation to prevent parallel panics #​6448

Dependency Changes

• cyphar.com/go-pathrs v0.2.1 new
• github.com/Azure/azure-sdk-for-go/sdk/azcore v1.18.2 -> v1.20.0
• github.com/Azure/azure-sdk-for-go/sdk/azidentity v1.11.0 -> v1.13.1
• github.com/AzureAD/microsoft-authentication-library-for-go v1.4.2 -> v1.6.0
• github.com/asaskevich/govalidator a9d515a new
• github.com/aws/aws-sdk-go-v2 v1.38.1 -> v1.39.6
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.0 -> v1.7.2
• github.com/aws/aws-sdk-go-v2/config v1.31.3 -> v1.31.20
• github.com/aws/aws-sdk-go-v2/credentials v1.18.7 -> v1.18.24
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.4 -> v1.18.13
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.4 -> v1.4.13
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.4 -> v2.7.13
• github.com/aws/aws-sdk-go-v2/internal/ini v1.8.3 -> v1.8.4
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.4 -> v1.4.12
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.0 -> v1.13.3
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.8.4 -> v1.9.3
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.4 -> v1.13.13
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.4 -> v1.19.12
• github.com/aws/aws-sdk-go-v2/service/s3 v1.87.1 -> v1.89.1
• github.com/aws/aws-sdk-go-v2/service/sso v1.28.2 -> v1.30.3
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.34.0 -> v1.35.7
• github.com/aws/aws-sdk-go-v2/service/sts v1.38.0 -> v1.40.2
• github.com/aws/smithy-go v1.22.5 -> v1.23.2
• github.com/blang/semver v3.5.1 new
• github.com/cloudflare/circl v1.6.0 -> v1.6.1
• github.com/containerd/cgroups/v3 v3.1.0 -> v3.1.2
• github.com/containerd/containerd/v2 v2.2.0 -> v2.2.1
• github.com/containerd/fuse-overlayfs-snapshotter/v2 v2.1.6 -> v2.1.7
• github.com/containerd/nydus-snapshotter v0.15.4 -> v0.15.10
• github.com/cyberphone/json-canonicalization 19d51d7 new
• github.com/cyphar/filepath-securejoin v0.6.0 new
• github.com/digitorus/pkcs7 3a137a8 new
• github.com/digitorus/timestamp 220c5c2 new
• github.com/docker/cli v28.5.0 -> v29.1.4
• github.com/docker/docker-credential-helpers v0.9.3 -> v0.9.5
• github.com/go-openapi/analysis v0.24.1 new
• github.com/go-openapi/errors v0.22.4 new
• github.com/go-openapi/jsonpointer v0.22.1 new
• github.com/go-openapi/jsonreference v0.21.3 new
• github.com/go-openapi/loads v0.23.2 new
• github.com/go-openapi/runtime v0.29.2 new
• github.com/go-openapi/spec v0.22.1 new
• github.com/go-openapi/strfmt v0.25.0 new
• github.com/go-openapi/swag v0.25.3 new
• github.com/go-openapi/swag/cmdutils v0.25.3 new
• github.com/go-openapi/swag/conv v0.25.3 new
• github.com/go-openapi/swag/fileutils v0.25.3 new
• github.com/go-openapi/swag/jsonname v0.25.3 new
• github.com/go-openapi/swag/jsonutils v0.25.3 new
• github.com/go-openapi/swag/loading v0.25.3 new
• github.com/go-openapi/swag/mangling v0.25.3 new
• github.com/go-openapi/swag/netutils v0.25.3 new
• github.com/go-openapi/swag/stringutils v0.25.3 new
• github.com/go-openapi/swag/typeutils v0.25.3 new
• github.com/go-openapi/swag/yamlutils v0.25.3 new
• github.com/go-openapi/validate v0.25.1 new
• github.com/go-viper/mapstructure/v2 v2.4.0 new
• github.com/google/certificate-transparency-go v1.3.2 new
• github.com/google/go-containerregistry v0.20.6 new
• github.com/grafana/regexp a468a5b new
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 -> v2.27.3
• github.com/in-toto/attestation v1.1.2 new
• github.com/klauspost/compress v1.18.1 -> v1.18.2
• github.com/moby/go-archive v0.1.0 -> v0.2.0
• github.com/moby/policy-helpers bcaa71c -> 9fcc1a9
• github.com/oklog/ulid v1.3.1 new
• github.com/opencontainers/runtime-spec v1.2.1 -> v1.3.0
• github.com/opencontainers/runtime-tools 0ea5ed0 -> edf4cb3
• github.com/opencontainers/selinux v1.12.0 -> v1.13.1
• github.com/prometheus/otlptranslator v0.0.2 new
• github.com/prometheus/procfs v0.16.1 -> v0.17.0
• github.com/sigstore/protobuf-specs v0.5.0 new
• github.com/sigstore/rekor v1.4.3 new
• github.com/sigstore/rekor-tiles/v2 v2.0.1 new
• github.com/sigstore/sigstore v1.10.0 new
• github.com/sigstore/sigstore-go b5fe07a new
• github.com/sigstore/timestamp-authority/v2 v2.0.2 new
• github.com/sirupsen/logrus v1.9.3 -> v1.9.4
• github.com/spdx/tools-golang v0.5.5 -> v0.5.7
• github.com/theupdateframework/go-tuf/v2 v2.3.0 new
• github.com/tonistiigi/fsutil 586307a -> a2aa163
• github.com/tonistiigi/go-actions-cache 378c5ed -> 54bc28c
• github.com/transparency-dev/formats 404c0d5 new
• github.com/transparency-dev/merkle v0.0.2 new
• go.mongodb.org/mongo-driver v1.17.6 new
• go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.61.0 -> v0.63.0
• go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.61.0 -> v0.63.0
• go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.61.0 -> v0.63.0
• go.opentelemetry.io/otel/exporters/prometheus v0.42.0 -> v0.60.0
• go.yaml.in/yaml/v2 v2.4.2 -> v2.4.3
• go.yaml.in/yaml/v3 v3.0.4 new
• golang.org/x/term v0.38.0 new
• google.golang.org/genproto/googleapis/api c5933d9 -> f26f940
• google.golang.org/genproto/googleapis/rpc c5933d9 -> f26f940
• kernel.org/pub/linux/libs/security/libcap/cap v1.2.76 -> v1.2.77
• kernel.org/pub/linux/libs/security/libcap/psx v1.2.76 -> v1.2.77
• tags.cncf.io/container-device-interface v1.0.1 -> v1.1.0
• tags.cncf.io/container-device-interface/specs-go v1.0.0 -> v1.1.0

Previous release can be found at v0.26.3

v0.26.3

Compare Source

Welcome to the v0.26.3 release of buildkit!

Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.

Contributors

• Sebastiaan van Stijn
• Jonathan A. Sternberg
• Tõnis Tiigi

Notable Changes

• Fix session policy metadata resolution for git attributes and image attestations #​6383

Dependency Changes

• github.com/containernetworking/plugins v1.8.0 -> v1.9.0

Previous release can be found at v0.26.2

spf13/cobra (github.com/spf13/cobra)

v1.10.2

Compare Source

🔧 Dependencies

• chore: Migrate from gopkg.in/yaml.v3 to go.yaml.in/yaml/v3 by @​dims in #​2336 - the gopkg.in/yaml.v3 package has been deprecated for some time: this should significantly cleanup dependency/supply-chains for consumers of spf13/cobra

📈 CI/CD

• Fix linter and allow CI to pass by @​marckhouzam in #​2327
• fix: actions/setup-go v6 by @​jpmcb in #​2337

🔥✍🏼 Docs

• Add documentation for repeated flags functionality by @​rvergis in #​2316

🍂 Refactors

• refactor: replace several vars with consts by @​htoyoda18 in #​2328
• refactor: change minUsagePadding from var to const by @​ssam18 in #​2325

🤗 New Contributors

• @​rvergis made their first contribution in #​2316
• @​htoyoda18 made their first contribution in #​2328
• @​ssam18 made their first contribution in #​2325
• @​dims made their first contribution in #​2336

Full Changelog: spf13/cobra@v1.10.1...v1.10.2

Thank you to our amazing contributors!!!!! 🐍 🚀

yaml/go-yaml (go.yaml.in/yaml/v4)

v4.0.0-rc.4

Compare Source

---

Configuration

📅 Schedule: Branch creation - Between 12:00 AM and 03:59 AM, only on Monday ( * 0-3 * * 1 ) (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 24 additional dependencies were updated

Details:

Package	Change
github.com/CycloneDX/cyclonedx-go	v0.9.2 -> v0.9.3
github.com/anchore/go-collections	v0.0.0-20241211140901-567f400e9a46 -> v0.0.0-20251016125210-a3c352120e8c
github.com/anchore/stereoscope	v0.1.6 -> v0.1.13
github.com/bmatcuk/doublestar/v4	v4.8.1 -> v4.9.1
github.com/charmbracelet/x/ansi	v0.9.3 -> v0.10.1
github.com/diskfs/go-diskfs	v1.6.1-0.20250601133945-2af1c7ece24c -> v1.7.0
github.com/docker/cli	v28.5.0+incompatible -> v28.5.2+incompatible
github.com/docker/docker-credential-helpers	v0.9.3 -> v0.9.4
github.com/docker/go-connections	v0.5.0 -> v0.6.0
github.com/gabriel-vasile/mimetype	v1.4.9 -> v1.4.11
github.com/github/go-spdx/v2	v2.3.3 -> v2.3.4
github.com/go-viper/mapstructure/v2	v2.3.0 -> v2.4.0
github.com/gohugoio/hashstructure	v0.5.0 -> v0.6.0
github.com/gookit/color	v1.5.4 -> v1.6.0
github.com/hashicorp/go-getter	v1.7.8 -> v1.8.3
github.com/mattn/go-runewidth	v0.0.16 -> v0.0.19
github.com/olekukonko/ll	v0.0.9 -> v0.1.2
github.com/olekukonko/tablewriter	v1.0.8 -> v1.1.1
github.com/spf13/afero	v1.14.0 -> v1.15.0
golang.org/x/crypto	v0.42.0 -> v0.44.0
golang.org/x/net	v0.44.0 -> v0.47.0
golang.org/x/sys	v0.37.0 -> v0.38.0
golang.org/x/term	v0.35.0 -> v0.37.0
golang.org/x/text	v0.29.0 -> v0.31.0

[renovate]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 36 additional dependencies were updated

Details:

Package	Change
github.com/CycloneDX/cyclonedx-go	v0.9.2 -> v0.9.3
github.com/anchore/go-collections	v0.0.0-20241211140901-567f400e9a46 -> v0.0.0-20251016125210-a3c352120e8c
github.com/anchore/go-struct-converter	v0.0.0-20250211213226-cce56d595160 -> v0.1.0
github.com/anchore/stereoscope	v0.1.6 -> v0.1.13
github.com/bmatcuk/doublestar/v4	v4.8.1 -> v4.9.1
github.com/charmbracelet/x/ansi	v0.9.3 -> v0.10.1
github.com/containerd/containerd/v2	v2.2.0 -> v2.2.1
github.com/diskfs/go-diskfs	v1.6.1-0.20250601133945-2af1c7ece24c -> v1.7.0
github.com/docker/cli	v28.5.0+incompatible -> v29.1.4+incompatible
github.com/docker/docker-credential-helpers	v0.9.3 -> v0.9.5
github.com/docker/go-connections	v0.5.0 -> v0.6.0
github.com/gabriel-vasile/mimetype	v1.4.9 -> v1.4.11
github.com/github/go-spdx/v2	v2.3.3 -> v2.3.4
github.com/go-viper/mapstructure/v2	v2.3.0 -> v2.4.0
github.com/gohugoio/hashstructure	v0.5.0 -> v0.6.0
github.com/gookit/color	v1.5.4 -> v1.6.0
github.com/hashicorp/go-getter	v1.7.8 -> v1.8.3
github.com/klauspost/compress	v1.18.1 -> v1.18.2
github.com/mattn/go-runewidth	v0.0.16 -> v0.0.19
github.com/olekukonko/ll	v0.0.9 -> v0.1.2
github.com/olekukonko/tablewriter	v1.0.8 -> v1.1.1
github.com/sirupsen/logrus	v1.9.4-0.20230606125235-dd1b4c2e81af -> v1.9.4
github.com/spdx/tools-golang	v0.5.5 -> v0.5.7
github.com/spf13/afero	v1.14.0 -> v1.15.0
github.com/tonistiigi/fsutil	v0.0.0-20250605211040-586307ad452f -> v0.0.0-20251211185533-a2aa163d723f
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc	v0.62.0 -> v0.63.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace	v0.62.0 -> v0.63.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp	v0.62.0 -> v0.63.0
golang.org/x/crypto	v0.42.0 -> v0.46.0
golang.org/x/net	v0.44.0 -> v0.48.0
golang.org/x/sys	v0.37.0 -> v0.39.0
golang.org/x/term	v0.35.0 -> v0.38.0
golang.org/x/text	v0.29.0 -> v0.32.0
google.golang.org/genproto/googleapis/api	v0.0.0-20250825161204-c5933d9347a5 -> v0.0.0-20251103181224-f26f9409b101
google.golang.org/genproto/googleapis/rpc	v0.0.0-20250825161204-c5933d9347a5 -> v0.0.0-20251103181224-f26f9409b101
google.golang.org/protobuf	v1.36.10 -> v1.36.11