deps: update module github.com/anchore/syft to v1.28.0

[renovate]

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/anchore/syft	v1.22.0 -> v1.28.0

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.28.0

Compare Source

Added Features

• add native support for snap packages [#​1088 #​3929 @​wagoodman]

Additional Changes

• upgrade tablewriter dependency to use new API [#​3990 @​cpanato]

(Full Changelog)

v1.27.1

Compare Source

Bug Fixes

• Allow decoding of enterprise-modified anchorectl json files [#​3997 @​wagoodman]
• Allow decoding of anchorectl json files [#​3973 @​wagoodman]

Additional Changes

• provide separate nonroot image [#​3998 @​kzantow]

(Full Changelog)

v1.27.0

Compare Source

Added Features

• add syft schema version to version command [#​3949 @​spiffcs]

Bug Fixes

• Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#​3967 @​jayvdb]
• Remove CPE product candidates for opentelemetry and redis Rust crates [#​3962 @​jayvdb]
• Harden Container Runtime with Non-Root User [#​3941 @​MikeTheCyberGuy]
• terraform provider lock entries should not require constraints [#​3934 @​ghouscht]
• sbom cataloger returning upstream package [#​3662 #​3981 @​kzantow]
• Syft missing md5 sums and list data for dpkg packages under status.d/ [#​3912]
• Failure to detect dependency relationships between Python packages [#​3958 #​3965 @​christoph-blessing]
• Heavy memory consumption when directory scanning deb source [#​3928 #​3953 @​kzantow]
• In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#​3942 #​3944 @​kzantow]
• Syft incorrectly reports multiple APKs as parents of symlinked files [#​3847 #​3923 @​luhring]

(Full Changelog)

A HUGE thank you to @​rezmoss for his help identifying and solving an issue causing excessive time and memory consumption with large numbers of symlinks! ❤️

v1.26.1

Compare Source

Bug Fixes

• Dotnet deps binary cataloger hangs [#​3919 #​3930 @​kzantow]

(Full Changelog)

v1.26.0

Compare Source

Added Features

• Read version resources from non-.NET DLLs and executables [#​3842 #​3911 @​wagoodman]

Bug Fixes

• pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#​3922 @​wagoodman]
• syft 1.24.0 debug container - wget fails TLS [#​3891 #​3915 @​spiffcs]

(Full Changelog)

v1.25.1

Compare Source

Additional Changes

• remove go-rpmdb replace directive [#​3908 @​wagoodman]

(Full Changelog)

v1.25.0

Compare Source

Added Features

• Add PHP interpreter + extensions cataloger [#​2585 @​LaurentGoderre]

Bug Fixes

• update license content filtering default case to be 'none' for no content [#​3903 @​spiffcs]
• Distinguish openjdk vs jdk when using file source [#​3895 @​adammcclenaghan]
• Make it discoverable if Native Image contains no embedded SBOM [#​3731 #​3805 @​sathiya06]

(Full Changelog)

v1.24.0

Compare Source

Added Features

• Add cataloger for Dart pubspec [#​3292 @​LaurentGoderre]
• Translate Portage license strings to SPDX expressions [#​1763 @​wagoodman]
• Use package ID from decoded SBOMs when provided [#​1872 @​jneate]
• Annotate visible/hidden paths when all-layers scope [#​3855 @​wagoodman]
• Add support for PHP Pear [#​2775 @​LaurentGoderre]
• Detect whether full license text or a license name has been provided [#​3088 #​3876 @​spiffcs #​3450 @​spiffcs]
• Add Cataloger for Homebrew on macOS [#​3632 #​3724 @​rezmoss]
• Provide a way to get the LayerID the package was first found in [#​435 #​3858 @​wagoodman #​3138 @​tomersein]
• Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#​3324 #​3873 @​wagoodman]
• Upgrade base Docker image to gcr.io/distroless/static-debian12 [#​3840 #​3862 @​bgoareguer]
• Return full license string instead of SHA256 hash when license string exceeds 64 characters [#​3780 #​3844 @​spiffcs]
• Detect nix dependencies [#​3814 #​3837 @​wagoodman]

Bug Fixes

• update license sort to be stable with contents field [#​3860 @​spiffcs]
• Improve detection of erlang binary in alpine Linux [#​3839 @​avodotiiets]
• Do not search for main module versions within binary contents by default [#​3874 @​wagoodman]
• dpkg license improvement for non SPDX licenses [#​3090 #​3888 @​spiffcs]
• CycloneDX group field not symmetrically handled by encoder/decoders [#​2981 #​3853 @​kzantow]
• Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#​3872 #​3875 @​wagoodman]
• Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#​3864]
• .NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#​3866 #​3869 @​wagoodman]
• Propagate error in FileSourceProvider instead of warn log [#​3831 #​3845 @​Rupikz]
• Update github.com/Masterminds/semver package [#​3829 #​3836 @​popey]
• go-module-file-cataloger fails if symlinks in path [#​3614 #​3783 @​VictorHuu]
• Support fluent-bit some versions of arm/s390x images [#​3793 #​3817 @​VictorHuu]

Additional Changes

• update rust test fixtures to latest [#​3852 @​spiffcs]

(Full Changelog)

v1.23.1

Compare Source

Additional Changes

• Resolve owned file paths when searching for overlaps [#​3828 @​wagoodman]

(Full Changelog)

v1.23.0

Compare Source

Added Features

• Support skipping archive extraction with file source [#​3795 @​adammcclenaghan]
• Use the R cataloger in directory scans [#​3774 @​spiffcs]
• Add support for detecting javascript assets in .NET projects using libman [#​3825 @​wagoodman]
• Parse GitHub actions comments [#​3776 @​wagoodman]
• Support chrome binary detection [#​3174 #​3136 @​lem-onade]
• Add support for detecting undeclared license files scanning from python installations [#​2624 #​3779 @​wagoodman]

Bug Fixes

• .NET cataloger should consider compile target paths from deps.json [#​3821 @​wagoodman]
• Skip license scanner injection [#​3796 @​adammcclenaghan]
• Delete collection name/type key entries when empty [#​3797 @​adammcclenaghan]
• Use module name over relative paths in go.mod replace directives [#​3812 @​VictorHuu]
• Correct variable names for Conan lock parsing version handling [#​3802 @​musangk]
• Consider DLL claims for dependencies of .NET packages from deps.json [#​3822 @​wagoodman]
• Empty source during decoding an SBOM document should not be fatal [#​3791 @​wagoodman]
• Dpkg are not detected when scanning a directory [#​3726 #​3820 @​VictorHuu]
• Support golang tip image [#​3681 #​3757 @​VictorHuu]
• syft cataloger list should flatten options [#​3801 #​3804 @​kzantow]
• Unable to generate a correct SBOM for C++ project [#​3755]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 8 additional dependencies were updated

Details:

Package	Change
github.com/sirupsen/logrus	v1.9.3 -> v1.9.4-0.20230606125235-dd1b4c2e81af
github.com/Masterminds/semver/v3	v3.3.1 -> v3.4.0
github.com/ProtonMail/go-crypto	v1.1.6 -> v1.2.0
github.com/andybalholm/brotli	v1.1.1 -> v1.1.2-0.20250424173009-453214e765f3
github.com/cloudflare/circl	v1.6.0 -> v1.6.1
github.com/github/go-spdx/v2	v2.3.2 -> v2.3.3
github.com/mholt/archives	v0.1.1 -> v0.1.3
github.com/go-git/go-git/v5	v5.14.0 -> v5.16.2