Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package syft for openSUSE:Factory checked in at 2026-09-18 22:07:27 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/syft (Old) and /work/SRC/openSUSE:Factory/.syft.new.383539 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "syft" Fri Sep 18 22:07:27 2026 rev:133 rq:1378755 version:1.52.0 Changes: -------- --- /work/SRC/openSUSE:Factory/syft/syft.changes 2026-08-28 19:52:20.120364058 +0200 +++ /work/SRC/openSUSE:Factory/.syft.new.383539/syft.changes 2026-09-18 22:08:24.121279343 +0200 @@ -1,0 +2,98 @@ +Fri Sep 18 05:06:42 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.52.0: + * Added Features + - passthrough-exact-format copies matching syft-json input unchanged [PR #5279] + * Bug Fixes + - bound what a compressed kernel module expands to [PR #5294] + - bound the decompressed members of a .deb archive [PR #5293] + - alpm mtree gzip unbounded processing [PR #5292] + - graalvm unbounded allocation [PR #5291] + - harden .NET PE/ELF parsing against malformed binaries [PR #5267] + - bound allocations from UPX-packed binary headers [PR #5195] + - Syft rpm-db-cataloger reports stale libssh version from a single-layer Rocky Linux 10 image [Issue #5247] + - java-archive-cataloger returns unknown ver for uber-jars [Issue #5163] [PR #5164] + * Dependencies + 52 dependency changes (52 updated). 6 vulnerabilities + remediated. + - Remediated (6) + - GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc + - GHSA-7jxh-36q5-gcqv (Medium) — + github.com/containerd/containerd/v2 + - GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc + - GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc + - GO-2026-6354 (High) — golang.org/x/crypto + - GO-2026-6355 (High) — golang.org/x/crypto + - Updated (52 packages) + - cloud.google.com/go/auth v0.22.0 → v0.23.2 + - cloud.google.com/go/iam v1.11.0 → v1.12.0 + - cloud.google.com/go/logging v1.18.0 → v1.19.0 + - cloud.google.com/go/monitoring v1.29.0 → v1.30.0 + - cloud.google.com/go/storage v1.64.0 → v1.65.1 + - github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0 + - github.com/anchore/go-sync v0.1.1 → v0.1.2 + - github.com/anchore/stereoscope v0.3.1 → v0.3.2 + - github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0 + - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream + v1.7.16 → v1.7.20 + - github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40 + - github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → + v1.19.39 + - github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → + v1.18.40 + - github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 + → v1.4.40 + - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 + → v2.7.40 + - github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41 + - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding + v1.13.15 → v1.13.19 + - github.com/aws/aws-sdk-go-v2/service/internal/checksum + v1.9.28 → v1.10.0 + - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url + v1.13.35 → v1.13.40 + - github.com/aws/aws-sdk-go-v2/service/internal/s3shared + v1.19.36 → v1.19.41 + - github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0 + - github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0 + - github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0 + - github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → + v1.39.0 + - github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0 + - github.com/aws/smithy-go v1.27.6 → v1.28.1 + - github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 + (remediated GHSA-7jxh-36q5-gcqv) + - github.com/docker/cli v29.7.2+incompatible → + v29.8.0+incompatible + - github.com/google/go-containerregistry v0.21.9 → v0.22.1 + - github.com/googleapis/enterprise-certificate-proxy v0.3.19 + → v0.3.20 + - github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0 + - github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3 + - github.com/hashicorp/go-getter v1.8.8 → v1.8.9 + - github.com/klauspost/compress v1.19.2 → v1.20.0 + - github.com/moby/moby/api v1.55.0 → v1.56.0 + - github.com/moby/moby/client v0.5.1 → v0.6.0 + - github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8 + - golang.org/x/crypto v0.55.0 → v0.56.0 (remediated + GO-2026-6354, GO-2026-6355) + - golang.org/x/mod v0.40.0 → v0.41.0 + - golang.org/x/time v0.15.0 → v0.16.0 + - google.golang.org/api v0.292.0 → v0.294.0 + - google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1 + - google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → + v0.0.0-e75dac1 + - google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → + v0.0.0-08b0e42 + - google.golang.org/grpc v1.83.0 → v1.83.2 (remediated + GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, + GHSA-vp52-pcj8-j9qc) + - google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12 + - modernc.org/cc/v4 v4.29.1 → v4.29.2 + - modernc.org/ccgo/v4 v4.34.6 → v4.35.0 + - modernc.org/gc/v3 v3.1.4 → v3.1.5 + - modernc.org/libc v1.74.4 → v1.75.6 + - modernc.org/memory v1.11.0 → v1.12.1 + - modernc.org/sqlite v1.56.0 → v1.58.0 + +------------------------------------------------------------------- Old: ---- syft-1.51.1.obscpio New: ---- syft-1.52.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ syft.spec ++++++ --- /var/tmp/diff_new_pack.YonHJO/_old 2026-09-18 22:08:26.482378296 +0200 +++ /var/tmp/diff_new_pack.YonHJO/_new 2026-09-18 22:08:26.486378464 +0200 @@ -17,7 +17,7 @@ Name: syft -Version: 1.51.1 +Version: 1.52.0 Release: 0 Summary: CLI tool and library for generating a Software Bill of Materials License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.YonHJO/_old 2026-09-18 22:08:26.539380685 +0200 +++ /var/tmp/diff_new_pack.YonHJO/_new 2026-09-18 22:08:26.542380811 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/syft.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.51.1</param> + <param name="revision">refs/tags/v1.52.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.YonHJO/_old 2026-09-18 22:08:26.579382362 +0200 +++ /var/tmp/diff_new_pack.YonHJO/_new 2026-09-18 22:08:26.588382739 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/syft</param> <param name="changesrevision">b15c5dbfe2bb21c9d73002c1056a829c8c411c75</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/syft.git</param> - <param name="changesrevision">91a0032987d91b7411b52f6f5c185c5e7f775495</param></service></servicedata> + <param name="changesrevision">02ba369d13b4248395b20a504eca94b0cab564d8</param></service></servicedata> (No newline at EOF) ++++++ syft-1.51.1.obscpio -> syft-1.52.0.obscpio ++++++ ++++ 16259 lines of diff (skipped) ++++++ syft.obsinfo ++++++ --- /var/tmp/diff_new_pack.YonHJO/_old 2026-09-18 22:08:29.353498625 +0200 +++ /var/tmp/diff_new_pack.YonHJO/_new 2026-09-18 22:08:29.359498876 +0200 @@ -1,5 +1,5 @@ name: syft -version: 1.51.1 -mtime: 1787847909 -commit: 91a0032987d91b7411b52f6f5c185c5e7f775495 +version: 1.52.0 +mtime: 1789654186 +commit: 02ba369d13b4248395b20a504eca94b0cab564d8 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/syft/vendor.tar.gz /work/SRC/openSUSE:Factory/.syft.new.383539/vendor.tar.gz differ: char 88, line 1
