deps: update module github.com/anchore/grype to v0.86.1

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/grype	v0.80.0 -> v0.86.1

---

Release Notes

anchore/grype (github.com/anchore/grype)

v0.86.1

Compare Source

Security Fixes

• archiver has been archived - replace with archives fork [#​2304 #​2313 @​spiffcs]

Bug Fixes

• archiver has been archived - replace with archives fork [#​2304 #​2313 @​spiffcs]
• Grype panics on certain output formats for PURL inputs [#​2324 #​2328 @​willmurphyscode]
• FP of upstream linux [#​2326]

Additional Changes

• move v5-specific interfaces and implementations to the v5 package [#​2322 @​kzantow]
• Fix broken link to cosign documentation [#​2321 @​uaqben]

(Full Changelog)

v0.86.0

Compare Source

Added Features

• Add missing package information for Sarif report [#​2267 #​2254 @​GeorgeLS]

Bug Fixes

• ignore linux-aws-headers-.* as well like linux-headers-.* [#​2295 @​barnuri]

Breaking Changes

• Remove DB v1 & v2 schemas [#​2278 @​wagoodman]

Additional Changes

• refactor v5-specific code out of core packages [#​2299 @​kzantow]

(Full Changelog)

v0.85.0

Compare Source

Added Features

• Add support for gradle in Java [#​2236]
• Prefer direct match information over indirect matches [#​1931 #​2241 @​wagoodman]

Bug Fixes

• Restore log on UI teardown [#​2248 @​wagoodman]
• Display warnings even when -v is not passed and no tty is present [#​2180 #​2268 @​willmurphyscode]

Additional Changes

• core dependencies: latest syft v1.17.0 and latest stereoscope v0.0.9 [#​2275 @​willmurphyscode]

(Full Changelog)

v0.84.0

Compare Source

Added Features

• Add support for scanning single purl from the CLI [#​2225 #​2223 @​wagoodman]

Bug Fixes

• Flaky checks on STDIN for purl provider [#​2192 #​2223 @​wagoodman]
• Missing alpine patch version yields inaccurate results [#​2222 #​2226 @​wagoodman]

Additional Changes

• update Syft to v1.16.0 [#​2237 @​anchore-actions-token-generator]

(Full Changelog)

v0.83.0

Compare Source

Added Features

• Merge config files hierarchically and add support for config profiles [#​2009 #​2194 @​kzantow]
• Add DB providers command [#​2131 #​2174 @​ADorigi]

(Full Changelog)

v0.82.2

Compare Source

Bug Fixes

• azurelinux considered as comprehensive distro [#​2197 @​westonsteimel]
• Java archive cataloger performance in 0.82.x much slower than 0.81.0 [#​2200]

Additional Changes

• Update to Syft v1.14.2 [#​2203 @​wagoodman]

(Full Changelog)

v0.82.1

Compare Source

Bug Fixes

• Skip matching on packages with missing version info [#​2182 @​wagoodman]
• correctly identify version of traefik binaries [#​2178 #​2179 @​westonsteimel]
• RPM version comparison oddity with release field [#​398 #​2188 @​wagoodman]
• purl with epoch should be used even if version is missing epoch [#​2170 #​2186 @​wagoodman]

Additional Changes

• bump syft in quality gate to v1.14.0 [#​2187 @​westonsteimel]

(Full Changelog)

v0.82.0

Compare Source

Added Features

• performance: only check for a new DB once every 2 hours (configurable) [#​2148 @​wagoodman]
• wordpress-plugin support [#​1553 @​disc]

Bug Fixes

• use fix info from secDB in APK matcher even if NVD fix info present [#​2162 @​willmurphyscode]

Breaking Changes

• Split v1-5 DB distribution concerns to a new legacy package [#​2124 #​2144 @​wagoodman]

Additional Changes

• Add a space following the "Name:" label in html.tmpl [#​2155 @​deftdawg]

(Full Changelog)

v0.81.0

Compare Source

Added Features

• add distro mapping for azure linux 3 [#​1848 @​willmurphyscode]
• Support for Azure Linux 3.0 [#​1829]

(Full Changelog)

v0.80.2

Compare Source

Bug Fixes

• find secdb entries for origin packages [#​1602 @​luhring]
• Matching java binary packages with NVD records is problematic [#​1718 #​2114 @​wagoodman]
• LoadVulnerabilityDB could be faster with ValidateByHashOnGet [#​1502 #​2054 @​lucasrod16]

Additional Changes

• update Syft to v1.13.0 [#​2140 @​anchore-actions-token-generator]
• include file specifier in help [#​2121 @​willmurphyscode]

(Full Changelog)

v0.80.1

Compare Source

Bug Fixes

• CVE-2024-3154 found with latest version [#​1834 #​2091 @​spiffcs]

Additional Changes

• Update Syft to 1.12.2 [#​2108]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - "every weekend" in timezone Europe/Berlin, Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 40 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.22.5 -> 1.23.3
github.com/anchore/stereoscope	v0.0.3 -> v0.0.9
github.com/anchore/syft	v1.11.1 -> v1.17.0
dario.cat/mergo	v1.0.0 -> v1.0.1
github.com/Masterminds/semver/v3	v3.2.1 -> v3.3.0
github.com/Masterminds/sprig/v3	v3.2.3 -> v3.3.0
github.com/adrg/xdg	v0.5.0 -> v0.5.3
github.com/anchore/clio	v0.0.0-20240522144804-d81e109008aa -> v0.0.0-20241115144204-29e89f9fa837
github.com/anchore/fangs	v0.0.0-20240508143433-f016b099950f -> v0.0.0-20241014225144-4e1713cafd77
github.com/charmbracelet/lipgloss	v0.12.1 -> v1.0.0
github.com/charmbracelet/x/ansi	v0.1.4 -> v0.4.5
github.com/containerd/errdefs	v0.1.0 -> v0.3.0
github.com/cyphar/filepath-securejoin	v0.2.4 -> v0.2.5
github.com/github/go-spdx/v2	v2.3.1 -> v2.3.2
github.com/huandu/xstrings	v1.4.0 -> v1.5.0
github.com/mattn/go-runewidth	v0.0.15 -> v0.0.16
github.com/pelletier/go-toml/v2	v2.2.0 -> v2.2.2
github.com/saferwall/pe	v1.5.4 -> v1.5.5
github.com/shopspring/decimal	v1.3.1 -> v1.4.0
github.com/spf13/viper	v1.18.2 -> v1.19.0
golang.org/x/exp	v0.0.0-20240325151524-a685a6edb6d8 -> v0.0.0-20240719175910-8a7402abbf56
github.com/CycloneDX/cyclonedx-go	v0.9.0 -> v0.9.1
github.com/ProtonMail/go-crypto	v1.0.0 -> v1.1.2
github.com/anchore/packageurl-go	v0.1.1-0.20240507183024-848e011fc24f -> v0.1.1-0.20241018175412-5c22e6360c4f
github.com/bmatcuk/doublestar/v4	v4.6.1 -> v4.7.1
github.com/containerd/containerd	v1.7.14 -> v1.7.23
github.com/docker/cli	v27.1.1+incompatible -> v27.3.1+incompatible
github.com/docker/docker	v27.1.2+incompatible -> v27.3.1+incompatible
github.com/gabriel-vasile/mimetype	v1.4.5 -> v1.4.7
github.com/go-git/go-billy/v5	v5.5.0 -> v5.6.0
github.com/sylabs/sif/v2	v2.17.1 -> v2.20.0
golang.org/x/crypto	v0.27.0 -> v0.29.0
golang.org/x/mod	v0.21.0 -> v0.22.0
golang.org/x/net	v0.28.0 -> v0.31.0
golang.org/x/sync	v0.8.0 -> v0.9.0
golang.org/x/term	v0.24.0 -> v0.26.0
gorm.io/gorm	v1.25.11 -> v1.25.12
modernc.org/sqlite	v1.32.0 -> v1.34.1
github.com/spf13/cast	v1.6.0 -> v1.7.0
golang.org/x/sys	v0.25.0 -> v0.27.0
golang.org/x/text	v0.18.0 -> v0.20.0

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
go: downloading github.com/anchore/grype v0.86.1
go: downloading github.com/anchore/syft v1.18.1
go: downloading golang.org/x/mod v0.22.0
go: downloading github.com/andybalholm/brotli v1.1.1
go: downloading github.com/klauspost/compress v1.17.11
go: downloading github.com/anchore/packageurl-go v0.1.1-0.20241018175412-5c22e6360c4f
go: downloading github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
go: downloading github.com/anchore/clio v0.0.0-20241115144204-29e89f9fa837
go: downloading dario.cat/mergo v1.0.1
go: downloading github.com/ProtonMail/go-crypto v1.1.3
go: downloading github.com/go-git/go-billy/v5 v5.6.0
go: downloading github.com/anchore/fangs v0.0.0-20241014225144-4e1713cafd77
go: downloading gorm.io/gorm v1.25.12
go: downloading github.com/OneOfOne/xxhash v1.2.8
go: downloading github.com/github/go-spdx/v2 v2.3.2
go: downloading github.com/CycloneDX/cyclonedx-go v0.9.2
go: downloading github.com/charmbracelet/lipgloss v1.0.0
go: downloading github.com/Masterminds/sprig/v3 v3.3.0
go: downloading github.com/saferwall/pe v1.5.6
go: downloading golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
go: downloading github.com/cyphar/filepath-securejoin v0.2.5
go: downloading github.com/spf13/viper v1.19.0
go: downloading modernc.org/sqlite v1.34.2
go: downloading github.com/charmbracelet/x/ansi v0.4.5
go: downloading github.com/mattn/go-runewidth v0.0.16
go: downloading github.com/Masterminds/semver/v3 v3.3.0
go: downloading github.com/huandu/xstrings v1.5.0
go: downloading github.com/shopspring/decimal v1.4.0
go: downloading github.com/spf13/cast v1.7.0
go: downloading github.com/magiconair/properties v1.8.9
go: downloading github.com/pelletier/go-toml/v2 v2.2.2
go: github.com/ckotzbauer/vulnerability-operator/internal/vuln/grype imports
	github.com/anchore/grype/grype/matcher: cannot find module providing package github.com/anchore/grype/grype/matcher
go: github.com/ckotzbauer/vulnerability-operator/internal/vuln/grype imports
	github.com/anchore/grype/grype/store: cannot find module providing package github.com/anchore/grype/grype/store