deps: update module github.com/anchore/grype to v0.117.0 by renovate[bot] · Pull Request #653 · ckotzbauer/vulnerability-operator

renovate · 2026-07-04T02:08:59Z

This PR contains the following updates:

Package	Change	Age	Confidence
github.com/anchore/grype	`v0.114.0` → `v0.117.0`

Release Notes

anchore/grype (github.com/anchore/grype)

`v0.117.0`

Compare Source

Added Features

Include vulnerable ranges in CycloneDX output format [Issue #3512] [PR #3519 @somaz94]

Bug Fixes

honor match.rust.using-cpes configuration [PR #3611 @Dashtid]

Dependencies

11 dependency changes (11 updated). 2 vulnerabilities remediated.

🟢 Remediated (2)

GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5

Updated (11 packages)

github.com/anchore/syft v1.50.0 → v1.51.0
github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15
github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)
github.com/klauspost/compress v1.19.0 → v1.19.1
github.com/magiconair/properties v1.8.10 → v1.18.11
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3
github.com/ulikunitz/xz v0.5.15 → v0.5.16
go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
modernc.org/sqlite v1.54.0 → v1.55.0

(Full Changelog)

`v0.116.1`

Compare Source

Bug Fixes

Ensure channel parsing is consistent [PR #3603 @wagoodman]
Scope Go GHSA twins by shared CVE [PR #3592 @wagoodman]
do not cache a comparator that failed to build [PR #3567 @arpitjain099]
Add fix date to rhel minor records created from rhsa [PR #3585 @wagoodman]
grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #3591]
panic: index out of range in distro.parseVersion for VERSION_ID=v [Issue #3588] [PR #3589 @matiasinsaurralde]
False Positive: GO-2026-5932 [Issue #3573]

Dependencies

30 dependency changes (30 updated). 1 vulnerability remediated.

🟢 Remediated (1)

GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (30 packages)

github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
github.com/anchore/stereoscope v0.2.2 → v0.3.0
github.com/anchore/syft v1.48.0 → v1.50.0
github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
github.com/moby/moby/api v1.54.2 → v1.55.0
github.com/moby/moby/client v0.4.1 → v0.5.0
github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
golang.org/x/crypto v0.53.0 → v0.54.0
golang.org/x/mod v0.37.0 → v0.38.0
golang.org/x/net v0.56.0 → v0.57.0
golang.org/x/sync v0.21.0 → v0.22.0
golang.org/x/sys v0.46.0 → v0.47.0
golang.org/x/term v0.44.0 → v0.45.0
golang.org/x/text v0.39.0 → v0.40.0
golang.org/x/tools v0.47.0 → v0.48.0
google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
modernc.org/cc/v4 v4.28.4 → v4.29.0
modernc.org/ccgo/v4 v4.34.4 → v4.34.6
modernc.org/gc/v3 v3.1.3 → v3.1.4
modernc.org/libc v1.73.4 → v1.74.1
modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)

`v0.116.0`

Compare Source

Added Features

duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode]
add chainguard osv transformer [PR #3474 @crosleyzack]
populate package architecture for matching [PR #3504 @willmurphyscode]
lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs]
Deduplicate Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA) [Issue #3511] [PR #3509 @spiffcs]
Support Ubuntu ESM [Issue #3544] [PR #3546 @wagoodman]

Bug Fixes

regenerate v6.1.8 blob and sql schemas [PR #3574 @spiffcs]
rhel version streams [PR #3572 @kzantow]
Grype doesn't match u-boot in SBOM if type is set to firmware [Issue #2537]
Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go [Issue #1782]
Zarf scans emit warnings for consistently unreadable files (i.e., included non-SBOMs) [Issue #3516] [PR #3545 @brandtkeller]
Fail parsing github actions [Issue #3220]
Go vulnerability returned when installed version is greater than fixed version [Issue #3520]

Dependencies

14 dependency changes (11 updated, 3 added).

Updated (11 packages)

github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
github.com/anchore/syft v1.46.0 → v1.48.0
github.com/klauspost/compress v1.18.6 → v1.19.0
golang.org/x/text v0.38.0 → v0.39.0
golang.org/x/tools v0.46.0 → v0.47.0
gorm.io/gorm v1.31.1 → v1.31.2
modernc.org/cc/v4 v4.28.2 → v4.28.4
modernc.org/ccgo/v4 v4.34.0 → v4.34.4
modernc.org/gc/v3 v3.1.2 → v3.1.3
modernc.org/libc v1.72.3 → v1.73.4
modernc.org/sqlite v1.51.0 → v1.53.0

Added (3 packages)

github.com/mattn/go-sqlite3 v1.14.23
gorm.io/driver/sqlite v1.6.0
howett.net/plist v1.0.1

(Full Changelog)

`v0.115.0`

Compare Source

Added Features

emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode]
Merge Go vuln matches with GHSA matches [Issue #3515]

Bug Fixes

only emit records for stdlib [PR #3527 @willmurphyscode]
mark hummingbird distro as rolling [PR #3521 @willmurphyscode]
disable go stdlib CPE matching by default [PR #3517 @willmurphyscode]
merge in custom ranges when applicable [PR #3514 @willmurphyscode]
exclude linux-kbuild deb indirect matches by default [PR #3506 @westonsteimel]
avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
Support reading CycloneDX 1.7 SBOMs [Issue #3373]
Grype cannot read mariadb version correctly [Issue #3452]
grype hangs when downloading certain images using registry client [Issue #3492]
Can we get a fix for these Critical findings reported for grype [Issue #3484]

Additional Changes

Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #3493]
Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #3494]

Dependencies

35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
github.com/anchore/bubbly v0.2.0 → v0.2.1
github.com/anchore/clio v0.1.0 → v0.1.1
github.com/anchore/fangs v0.1.0 → v0.1.1
github.com/anchore/go-collections v0.1.0 → v0.1.1
github.com/anchore/go-homedir v0.1.0 → v0.1.1
github.com/anchore/go-logger v0.1.0 → v0.1.1
github.com/anchore/go-lzo v0.1.0 → v0.1.1
github.com/anchore/go-macholibre v0.1.0 → v0.1.1
github.com/anchore/go-make v0.5.0 → v0.8.0
github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
github.com/anchore/go-sync v0.1.0 → v0.1.1
github.com/anchore/stereoscope v0.2.1 → v0.2.2
github.com/anchore/syft v1.45.1 → v1.46.0
github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
github.com/google/go-containerregistry v0.21.6 → v0.21.7
github.com/mattn/go-runewidth v0.0.19 → v0.0.21
github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
golang.org/x/crypto v0.52.0 → v0.53.0
golang.org/x/mod v0.36.0 → v0.37.0
golang.org/x/net v0.55.0 → v0.56.0
golang.org/x/sync v0.20.0 → v0.21.0
golang.org/x/sys v0.45.0 → v0.46.0
golang.org/x/term v0.43.0 → v0.44.0
golang.org/x/text v0.37.0 → v0.38.0
golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

github.com/piprate/json-gold v0.7.0
github.com/pquerna/cachecontrol v0.0.0-1555304
github.com/tailscale/hujson v0.0.0-ecc657c

Removed (1 package)

github.com/google/osv-scanner v1.9.2

(Full Changelog)

Configuration

📅 Schedule: (in timezone Europe/Berlin)

Branch creation
- "every weekend"
Automerge
- At any time (no schedule defined)

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

renovate · 2026-07-04T02:09:01Z

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

47 additional dependencies were updated

Details:

Package	Change
`github.com/anchore/stereoscope`	`v0.2.2` -> `v0.3.0`
`github.com/anchore/syft`	`v1.45.1` -> `v1.51.0`
`github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp`	`v1.31.0` -> `v1.32.0`
`github.com/anchore/clio`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/fangs`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-lzo`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-rpmdb`	`v0.1.0` -> `v0.2.0`
`github.com/anchore/go-sync`	`v0.1.0` -> `v0.1.1`
`github.com/charmbracelet/colorprofile`	`v0.4.1` -> `v0.4.3`
`github.com/clipperhouse/displaywidth`	`v0.10.0` -> `v0.11.0`
`github.com/clipperhouse/uax29/v2`	`v2.6.0` -> `v2.7.0`
`github.com/cncf/xds/go`	`v0.0.0-20251210132809-ee656c7534f5` -> `v0.0.0-20260202195803-dba9d589def2`
`github.com/containerd/containerd/v2`	`v2.3.2` -> `v2.3.3`
`github.com/diskfs/go-diskfs`	`v1.9.3` -> `v1.9.4`
`github.com/envoyproxy/go-control-plane/envoy`	`v1.36.0` -> `v1.37.0`
`github.com/envoyproxy/protoc-gen-validate`	`v1.3.0` -> `v1.3.3`
`github.com/gpustack/gguf-parser-go`	`v0.24.1` -> `v0.25.0`
`github.com/mattn/go-runewidth`	`v0.0.19` -> `v0.0.21`
`github.com/moby/moby/api`	`v1.54.2` -> `v1.55.0`
`github.com/moby/moby/client`	`v0.4.1` -> `v0.5.0`
`github.com/pelletier/go-toml/v2`	`v2.3.1` -> `v2.4.3`
`github.com/santhosh-tekuri/jsonschema/v6`	`v6.0.2` -> `v6.0.3`
`go.opentelemetry.io/contrib/detectors/gcp`	`v1.39.0` -> `v1.43.0`
`go.yaml.in/yaml/v3`	`v3.0.4` -> `v3.0.5`
`golang.org/x/tools`	`v0.46.0` -> `v0.48.0`
`google.golang.org/genproto/googleapis/api`	`v0.0.0-20260401024825-9d38bb4040a9` -> `v0.0.0-20260414002931-afd174a4e478`
`google.golang.org/genproto/googleapis/rpc`	`v0.0.0-20260406210006-6f92a3bedf2d` -> `v0.0.0-20260414002931-afd174a4e478`
`github.com/anchore/go-macholibre`	`v0.1.0` -> `v0.1.1`
`github.com/anchore/go-struct-converter`	`v0.1.0` -> `v0.2.0-rc2`
`github.com/docker/cli`	`v29.5.3+incompatible` -> `v29.6.1+incompatible`
`github.com/gabriel-vasile/mimetype`	`v1.4.13` -> `v1.4.15`
`github.com/go-git/go-billy/v5`	`v5.9.0` -> `v5.9.1`
`github.com/klauspost/compress`	`v1.18.6` -> `v1.19.1`
`github.com/spdx/tools-golang`	`v0.5.7` -> `v0.6.0-rc4`
`github.com/ulikunitz/xz`	`v0.5.15` -> `v0.5.16`
`golang.org/x/crypto`	`v0.53.0` -> `v0.54.0`
`golang.org/x/mod`	`v0.37.0` -> `v0.38.0`
`golang.org/x/net`	`v0.56.0` -> `v0.57.0`
`golang.org/x/sync`	`v0.21.0` -> `v0.22.0`
`golang.org/x/term`	`v0.44.0` -> `v0.45.0`
`google.golang.org/grpc`	`v1.80.0` -> `v1.82.1`
`gorm.io/gorm`	`v1.31.1` -> `v1.31.2`
`modernc.org/libc`	`v1.72.3` -> `v1.74.1`
`modernc.org/sqlite`	`v1.51.0` -> `v1.55.0`
`github.com/go-git/go-git/v5`	`v5.19.1` -> `v5.19.2`
`golang.org/x/sys`	`v0.46.0` -> `v0.47.0`
`golang.org/x/text`	`v0.38.0` -> `v0.40.0`

renovate Bot added the kind/dependencies Pull requests that update a dependency file label Jul 4, 2026

renovate Bot force-pushed the renovate/github.com-anchore-grype-0.x branch from 6f2d1c5 to 2e84ef2 Compare July 19, 2026 19:05

renovate Bot changed the title ~~deps: update module github.com/anchore/grype to v0.115.0~~ deps: update module github.com/anchore/grype to v0.116.0 Jul 19, 2026

renovate Bot changed the title ~~deps: update module github.com/anchore/grype to v0.116.0~~ deps: update module github.com/anchore/grype to v0.116.0 - autoclosed Jul 29, 2026

renovate Bot closed this Jul 29, 2026

renovate Bot deleted the renovate/github.com-anchore-grype-0.x branch July 29, 2026 09:03

renovate Bot changed the title ~~deps: update module github.com/anchore/grype to v0.116.0 - autoclosed~~ deps: update module github.com/anchore/grype to v0.116.1 Jul 31, 2026

renovate Bot reopened this Jul 31, 2026

renovate Bot force-pushed the renovate/github.com-anchore-grype-0.x branch 2 times, most recently from 2e84ef2 to bfda821 Compare July 31, 2026 22:51

deps: update module github.com/anchore/grype to v0.117.0

efee925

renovate Bot force-pushed the renovate/github.com-anchore-grype-0.x branch from bfda821 to efee925 Compare August 15, 2026 02:32

renovate Bot changed the title ~~deps: update module github.com/anchore/grype to v0.116.1~~ deps: update module github.com/anchore/grype to v0.117.0 Aug 15, 2026

Navigation Menu

deps: update module github.com/anchore/grype to v0.117.0 - #653

deps: update module github.com/anchore/grype to v0.117.0#653
renovate[bot] wants to merge 1 commit into
mainfrom
renovate/github.com-anchore-grype-0.x

renovate Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

renovate Bot commented Jul 4, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

renovate Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Release Notes

v0.117.0

Added Features

Bug Fixes

Dependencies

v0.116.1

Bug Fixes

Dependencies

v0.116.0

Added Features

Bug Fixes

Dependencies

v0.115.0

Added Features

Bug Fixes

Additional Changes

Dependencies

Configuration

Uh oh!

renovate Bot commented Jul 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

ℹ️ Artifact update notice

File name: go.mod

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

renovate Bot commented Jul 4, 2026 •

edited

Loading

`v0.117.0`

`v0.116.1`

`v0.116.0`

`v0.115.0`

renovate Bot commented Jul 4, 2026 •

edited

Loading