chore(deps): updated module github.com/anchore/syft from v1.49.0 to v1.51.0

[paketo-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/anchore/syft	require	minor	v1.49.0 → v1.51.0

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.51.0

Compare Source

Added Features

• detect native Go FIPS 140 mode in binaries [PR #​5155 @​gunnypatel]
• add extended-stdlib scope and module patterns for symbol capture [PR #​5154 @​wagoodman]

Bug Fixes

• Cleanup snap temporary directories [PR #​5117 @​spiffcs]
• add correct CPE vendor/product candidates for Git for Windows PE binary [PR #​5156 @​westonsteimel]
• javascript-package-cataloger creates phantom <name>@unknown packages for subpath or export-map stub package.json files [Issue #​5118]
• Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #​4598] [PR #​5146 @​ankit090701]
• When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #​5019] [PR #​5029 @​wagoodman]
• Support deno binary latest and some old versions [Issue #​5057] [PR #​5084 @​ychampion]
• Update install methods in README.md [Issue #​3198]

Dependencies

9 dependency changes (9 updated). 2 vulnerabilities remediated.

🟢 Remediated (2)

• GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
• GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5

Updated (9 packages)

• github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
• github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
• github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)
• github.com/jedib0t/go-pretty/v6 v6.8.1 → v6.8.3
• github.com/klauspost/compress v1.19.0 → v1.19.1
• github.com/magiconair/properties v1.8.10 → v1.18.11
• github.com/ulikunitz/xz v0.5.15 → v0.5.16
• go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
• modernc.org/sqlite v1.54.0 → v1.55.0

(Full Changelog)

v1.50.0

Compare Source

Added Features

• Add bun binary classifier [PR #​5103 @​rezmoss]

Bug Fixes

• Fix Cargo PURLs for local workspace packages [PR #​5105 @​3nesdeniz]
• Decode golang symbols [PR #​5089 @​wagoodman]
• CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #​5073] [PR #​5081 @​Eljees]
• apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #​5094] [PR #​5100 @​cyphercodes]

Additional Changes

• package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #​5101] [PR #​5108 @​Eljees]
• consider vendored golang packages in module attribution [PR #​5093 @​kzantow]
• Fix inverted bounds check dropping every Erlang string with a backslash [PR #​5110 @​arpitjain099]

Dependencies

14 dependency changes (14 updated). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (14 packages)

• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
• github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
• github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
• github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
• github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
• go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
• google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
• google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
• google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
• modernc.org/cc/v4 v4.28.4 → v4.29.0
• modernc.org/ccgo/v4 v4.34.4 → v4.34.6
• modernc.org/gc/v3 v3.1.3 → v3.1.4
• modernc.org/libc v1.73.4 → v1.74.1
• modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate CLI.

[paketo-bot]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 17 additional dependencies were updated

Details:

Package	Change
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp	v1.31.0 -> v1.32.0
github.com/cncf/xds/go	v0.0.0-20251210132809-ee656c7534f5 -> v0.0.0-20260202195803-dba9d589def2
github.com/diskfs/go-diskfs	v1.9.3 -> v1.9.4
github.com/envoyproxy/go-control-plane/envoy	v1.36.0 -> v1.37.0
github.com/envoyproxy/protoc-gen-validate	v1.3.0 -> v1.3.3
github.com/go-git/go-billy/v5	v5.9.0 -> v5.9.1
github.com/go-git/go-git/v5	v5.19.1 -> v5.19.2
github.com/gpustack/gguf-parser-go	v0.24.1 -> v0.25.0
github.com/magiconair/properties	v1.8.10 -> v1.18.11
github.com/ulikunitz/xz	v0.5.15 -> v0.5.16
go.opentelemetry.io/contrib/detectors/gcp	v1.39.0 -> v1.43.0
go.yaml.in/yaml/v3	v3.0.4 -> v3.0.5
google.golang.org/genproto/googleapis/api	v0.0.0-20260401024825-9d38bb4040a9 -> v0.0.0-20260414002931-afd174a4e478
google.golang.org/genproto/googleapis/rpc	v0.0.0-20260406210006-6f92a3bedf2d -> v0.0.0-20260414002931-afd174a4e478
google.golang.org/grpc	v1.80.0 -> v1.82.1
modernc.org/libc	v1.73.4 -> v1.74.1
modernc.org/sqlite	v1.53.0 -> v1.55.0