Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grype for openSUSE:Factory checked in at 2026-11-10 14:41:21 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grype (Old) and /work/SRC/openSUSE:Factory/.grype.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grype" Tue Nov 10 14:41:21 2026 rev:135 rq:1396438 version:0.121.3 Changes: -------- --- /work/SRC/openSUSE:Factory/grype/grype.changes 2026-11-06 20:03:07.385187160 +0100 +++ /work/SRC/openSUSE:Factory/.grype.new.3759290/grype.changes 2026-11-10 14:42:20.557397331 +0100 @@ -1,0 +2,45 @@ +Tue Nov 10 05:47:26 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.121.3: + * Additional Changes + - further CPE to more precise package identifier mappings [PR + #3886] + * Dependencies + 18 dependency changes (8 updated, 10 removed). 8 + vulnerabilities remediated. + - Remediated (8) + - GHSA-pxq6-2prw-chj9 (Medium) — github.com/docker/docker + - GHSA-rg2x-37c3-w2rh (High) — github.com/docker/docker + - GHSA-vp62-88p7-qqf5 (Medium) — github.com/docker/docker + - GHSA-x86f-5xw2-fm2r (High) — github.com/docker/docker + - GO-2026-4887 (High) — github.com/docker/docker + - GO-2026-6860 (High) — golang.org/x/net + - GO-2026-6866 (Medium) — golang.org/x/net + - GO-2026-6888 (Critical) — github.com/andybalholm/brotli + - Updated (8 packages) + - github.com/anchore/syft v1.57.0 → v1.57.1 + - github.com/andybalholm/brotli v1.2.0 → v1.2.8 + (remediated GO-2026-6888) + - github.com/bmatcuk/doublestar/v4 v4.10.3 → v4.10.4 + - github.com/gkampitakis/go-snaps v0.5.24 → v0.5.25 + - github.com/gpustack/gguf-parser-go v0.27.0 → v0.28.1 + - github.com/moby/sys/mountinfo v0.7.2 → v0.7.3 + - go.yaml.in/yaml/v3 v3.0.5 → v3.0.6 + - golang.org/x/net v0.61.0 → v0.62.0 + (remediated GO-2026-6860, GO-2026-6866) + - Removed (10 packages) + - github.com/cenkalti/backoff/v5 v5.0.3 + - github.com/docker/docker v28.5.2+incompatible + (remediated GHSA-pxq6-2prw-chj9, GHSA-rg2x-37c3-w2rh, + GHSA-vp62-88p7-qqf5, GHSA-x86f-5xw2-fm2r, GO-2026-4887) + - github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 + - github.com/moby/sys/atomicwriter v0.1.0 + - github.com/moby/sys/sequential v0.6.0 + - github.com/moby/term v0.5.2 + - github.com/morikuni/aec v1.1.0 + - go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 + - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp + v1.46.0 + - go.opentelemetry.io/proto/otlp v1.11.0 + +------------------------------------------------------------------- Old: ---- grype-0.121.2.obscpio New: ---- grype-0.121.3.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grype.spec ++++++ --- /var/tmp/diff_new_pack.Ju2wQu/_old 2026-11-10 14:42:26.033626741 +0100 +++ /var/tmp/diff_new_pack.Ju2wQu/_new 2026-11-10 14:42:26.037626909 +0100 @@ -17,7 +17,7 @@ Name: grype -Version: 0.121.2 +Version: 0.121.3 Release: 0 Summary: A vulnerability scanner for container images and filesystems License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.Ju2wQu/_old 2026-11-10 14:42:26.118630302 +0100 +++ /var/tmp/diff_new_pack.Ju2wQu/_new 2026-11-10 14:42:26.128630721 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/grype.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.121.2</param> + <param name="revision">refs/tags/v0.121.3</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.Ju2wQu/_old 2026-11-10 14:42:26.178632816 +0100 +++ /var/tmp/diff_new_pack.Ju2wQu/_new 2026-11-10 14:42:26.187633193 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/grype</param> <param name="changesrevision">fa8b7e2a528cf1f8b098123f256c61db9e5df69c</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/grype.git</param> - <param name="changesrevision">82d7a0ea911946b99343c672056867d372f9b319</param></service></servicedata> + <param name="changesrevision">cd1f23eb50dfb52647090158f453c7359172591f</param></service></servicedata> (No newline at EOF) ++++++ grype-0.121.2.obscpio -> grype-0.121.3.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.2/cmd/grype/cli/commands/completion.go new/grype-0.121.3/cmd/grype/cli/commands/completion.go --- old/grype-0.121.2/cmd/grype/cli/commands/completion.go 2026-11-05 22:02:48.000000000 +0100 +++ new/grype-0.121.3/cmd/grype/cli/commands/completion.go 2026-11-09 15:55:26.000000000 +0100 @@ -5,9 +5,7 @@ "os" "strings" - "github.com/docker/docker/api/types/filters" - "github.com/docker/docker/api/types/image" - "github.com/docker/docker/client" + "github.com/moby/moby/client" "github.com/spf13/cobra" "github.com/anchore/clio" @@ -71,20 +69,21 @@ func listLocalDockerImages(prefix string) ([]string, error) { var repoTags = make([]string, 0) ctx := context.Background() - cli, err := client.NewClientWithOpts(client.FromEnv, client.WithAPIVersionNegotiation()) + // API version negotiation is enabled by default in the moby client + cli, err := client.New(client.FromEnv) if err != nil { return repoTags, err } + defer cli.Close() // Only want to return tagged images - imageListArgs := filters.NewArgs() - imageListArgs.Add("dangling", "false") - images, err := cli.ImageList(ctx, image.ListOptions{All: false, Filters: imageListArgs}) + imageListArgs := make(client.Filters).Add("dangling", "false") + images, err := cli.ImageList(ctx, client.ImageListOptions{All: false, Filters: imageListArgs}) if err != nil { return repoTags, err } - for _, image := range images { + for _, image := range images.Items { // image may have multiple tags for _, tag := range image.RepoTags { if strings.HasPrefix(tag, prefix) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.2/go.mod new/grype-0.121.3/go.mod --- old/grype-0.121.2/go.mod 2026-11-05 22:02:48.000000000 +0100 +++ new/grype-0.121.3/go.mod 2026-11-09 15:55:26.000000000 +0100 @@ -25,11 +25,10 @@ github.com/charmbracelet/bubbletea v1.3.10 github.com/charmbracelet/lipgloss v1.1.0 github.com/dave/jennifer v1.7.1 - github.com/docker/docker v28.5.2+incompatible github.com/dustin/go-humanize v1.1.0 github.com/facebookincubator/nvdtools v0.1.5 github.com/gabriel-vasile/mimetype v1.4.16 - github.com/gkampitakis/go-snaps v0.5.24 + github.com/gkampitakis/go-snaps v0.5.25 github.com/glebarez/sqlite v1.11.0 github.com/go-test/deep v1.1.2 github.com/go-viper/mapstructure/v2 v2.5.0 @@ -78,8 +77,9 @@ ) require ( - github.com/anchore/syft v1.57.0 - github.com/bmatcuk/doublestar/v4 v4.10.3 + github.com/anchore/syft v1.57.1 + github.com/bmatcuk/doublestar/v4 v4.10.4 + github.com/moby/moby/client v0.6.2 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 ) @@ -114,7 +114,7 @@ github.com/anchore/go-rpmdb v0.2.2 // indirect github.com/anchore/go-struct-converter v0.2.0-rc2 // indirect github.com/anchore/go-sync v0.1.2 // indirect - github.com/andybalholm/brotli v1.2.0 // indirect + github.com/andybalholm/brotli v1.2.8 // indirect github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect github.com/apparentlymart/go-textseg/v17 v17.0.1 // indirect github.com/aquasecurity/go-version v0.0.1 // indirect @@ -208,7 +208,7 @@ github.com/google/s2a-go v0.1.10 // indirect github.com/googleapis/enterprise-certificate-proxy v0.3.22 // indirect github.com/googleapis/gax-go/v2 v2.24.1 // indirect - github.com/gpustack/gguf-parser-go v0.27.0 // indirect + github.com/gpustack/gguf-parser-go v0.28.1 // indirect github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-version v1.9.0 // indirect @@ -246,16 +246,13 @@ github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/locker v1.0.1 // indirect github.com/moby/moby/api v1.56.1 // indirect - github.com/moby/moby/client v0.6.2 // indirect - github.com/moby/sys/atomicwriter v0.1.0 // indirect github.com/moby/sys/capability v0.4.0 // indirect - github.com/moby/sys/mountinfo v0.7.2 // indirect + github.com/moby/sys/mountinfo v0.7.3 // indirect github.com/moby/sys/signal v0.7.1 // indirect github.com/moby/sys/user v0.4.1 // indirect github.com/moby/sys/userns v0.2.1 // indirect github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect - github.com/morikuni/aec v1.1.0 // indirect github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 // indirect github.com/muesli/cancelreader v0.2.2 // indirect github.com/ncruces/go-strftime v1.1.0 // indirect @@ -342,11 +339,11 @@ go.opentelemetry.io/otel/trace v1.46.0 // indirect go.podman.io/image/v5 v5.42.0 // indirect go.podman.io/storage v1.65.0 // indirect - go.yaml.in/yaml/v3 v3.0.5 // indirect + go.yaml.in/yaml/v3 v3.0.6 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/crypto v0.58.0 // indirect golang.org/x/mod v0.42.0 // indirect - golang.org/x/net v0.61.0 // indirect + golang.org/x/net v0.62.0 // indirect golang.org/x/oauth2 v0.37.0 // indirect golang.org/x/sync v0.24.0 // indirect golang.org/x/sys v0.49.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.2/go.sum new/grype-0.121.3/go.sum --- old/grype-0.121.2/go.sum 2026-11-05 22:02:48.000000000 +0100 +++ new/grype-0.121.3/go.sum 2026-11-09 15:55:26.000000000 +0100 @@ -74,8 +74,6 @@ dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 h1:He8afgbRMd7mFxO99hRNu+6tazq8nFF9lIwo9JFroBk= github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6/go.mod h1:8o94RPi1/7XTJvwPpRSzSUedZrtlirdB3r9Z20bi2f8= -github.com/Azure/go-ansiterm v0.0.0-20261006220739-8c912ac31dd4 h1:m2xcjRABtG288vnlV3U/PKh/HnPURxZp50RKNUwBxM8= -github.com/Azure/go-ansiterm v0.0.0-20261006220739-8c912ac31dd4/go.mod h1:MTUE7ZuZO89FAtAwozGg6AWD83pcdefnEq5gF82MB8s= github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= github.com/BurntSushi/toml v0.4.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ= github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk= @@ -158,11 +156,11 @@ github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE= github.com/anchore/stereoscope v0.4.1 h1:7mxw24JCabbJIAcyvQDjBd2pbzo+0HSFVgjYlE8Zm+k= github.com/anchore/stereoscope v0.4.1/go.mod h1:hYJsi3M8a8N1O66u+rMQSgv5TREGM7QIjKBjPPnwiD8= -github.com/anchore/syft v1.57.0 h1:H/UHtf0KbIlD12dXsfklFMjZ2+erj2an3h/jBHoX/zE= -github.com/anchore/syft v1.57.0/go.mod h1:rxIyiyV5/ng1PxfmJBGMKcCcpfnCI/j9laRBTBxv+K0= +github.com/anchore/syft v1.57.1 h1:lrbWhc8hbZJSKekMdB3PKetO0upE+lv9ihUfv9CXgfU= +github.com/anchore/syft v1.57.1/go.mod h1:PHj+bXUGr1sxpMLsuogjX86P5wZ+A+XZRY6WgfsIgnE= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= -github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= -github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= +github.com/andybalholm/brotli v1.2.8 h1:H9F6r7RNwzSRsx/lytpIYkbjNFMt2yNBwsJ2+0gpx78= +github.com/andybalholm/brotli v1.2.8/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8= github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4= github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY= @@ -237,8 +235,8 @@ github.com/blakesmith/ar v0.0.0-20190502131153-809d4375e1fb/go.mod h1:PkYb9DJNAwrSvRx5DYA+gUcOIgTGVMNkfSCbZM8cWpI= github.com/bmatcuk/doublestar/v2 v2.0.4 h1:6I6oUiT/sU27eE2OFcWqBhL1SwjyvQuOssxT4a1yidI= github.com/bmatcuk/doublestar/v2 v2.0.4/go.mod h1:QMmcs3H2AUQICWhfzLXz+IYln8lRQmTZRptLie8RgRw= -github.com/bmatcuk/doublestar/v4 v4.10.3 h1:1UIv1+fqH3++ViVkpnaPTB+Pi1UHycnPFAq14zgK+gI= -github.com/bmatcuk/doublestar/v4 v4.10.3/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= +github.com/bmatcuk/doublestar/v4 v4.10.4 h1:oTKkRmRuOsKMqFe1AQazd9gGBFNEpOmgKp/xzB97dnA= +github.com/bmatcuk/doublestar/v4 v4.10.4/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc= github.com/bodgit/plumbing v1.3.0 h1:pf9Itz1JOQgn7vEOE7v7nlEfBykYqvUYioC61TwWCFU= github.com/bodgit/plumbing v1.3.0/go.mod h1:JOTb4XiRu5xfnmdnDJo6GmSbSbtSyufrsyZFByMtKEs= github.com/bodgit/sevenzip v1.6.1 h1:kikg2pUMYC9ljU7W9SaqHXhym5HyKm8/M/jd31fYan4= @@ -249,8 +247,6 @@ github.com/bradleyjkemp/cupaloy/v2 v2.8.0/go.mod h1:bm7JXdkRd4BHJk9HpwqAI8BoAY1lps46Enkdqw6aRX0= github.com/buger/jsonparser v1.1.2 h1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk= github.com/buger/jsonparser v1.1.2/go.mod h1:6RYKKt7H4d4+iWqouImQ9R2FZql3VbhNgx27UK13J/0= -github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM= -github.com/cenkalti/backoff/v5 v5.0.3/go.mod h1:rkhZdG3JZukswDf7f0cwqPNk4K0sa+F97BxZthm/crw= github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/census-instrumentation/opencensus-proto v0.3.0/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU= github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc= @@ -366,8 +362,6 @@ github.com/docker/cli v29.9.2+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk= github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w= -github.com/docker/docker v28.5.2+incompatible h1:DBX0Y0zAjZbSrm1uzOkdr1onVghKaftjlSWt4AFexzM= -github.com/docker/docker v28.5.2+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk= github.com/docker/docker-credential-helpers v0.9.10 h1:LCWwv7UmS7fQVmdKDWeMuureOeY5kkbC5kZfkzxkS6k= github.com/docker/docker-credential-helpers v0.9.10/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= github.com/docker/go-connections v0.8.2 h1:9d9DEokx5W7qlr0shkFXIxEA7+TTD+llwzcykSlxMNc= @@ -437,8 +431,8 @@ github.com/github/go-spdx/v2 v2.8.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY= github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo= -github.com/gkampitakis/go-snaps v0.5.24 h1:oyQ/CQA4s0nkVm6CLlM2GJSU8e4p6KGPZbrSCnTNBzE= -github.com/gkampitakis/go-snaps v0.5.24/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM= +github.com/gkampitakis/go-snaps v0.5.25 h1:ZE3iiQcS2WDV08JdUc+wVpHb6JEnLC+hlo9v8/YqZoQ= +github.com/gkampitakis/go-snaps v0.5.25/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM= github.com/glebarez/go-sqlite v1.23.0 h1:FyhIq4jqmgphQAUlY79zPldYGwISEZikaDfhiGWkkaI= github.com/glebarez/go-sqlite v1.23.0/go.mod h1:IIYrOH3L0rHY3jb4IXOHoWdklNajSGUN2eJcvK8WrnI= github.com/glebarez/sqlite v1.11.0 h1:wSG0irqzP6VurnMEpFGer5Li19RpIRi2qvQz++w0GMw= @@ -597,12 +591,9 @@ github.com/gookit/color v1.6.3/go.mod h1:9ACFc7/1IpHGBW8RwuDm/0YEnhg3dwwXpoMsmtyHfjs= github.com/gorilla/mux v1.8.1 h1:TuBL49tXwgrFYWhqrNgrUNEY92u81SPhu7sTdzQEiWY= github.com/gorilla/mux v1.8.1/go.mod h1:AKf9I4AEqPTmMytcMc0KkNouC66V3BtZ4qD5fmWSiMQ= -github.com/gpustack/gguf-parser-go v0.27.0 h1:eXFU9pmJEMQHOTL9qI742lXHWSa1CtlMWUU3gFce7nM= -github.com/gpustack/gguf-parser-go v0.27.0/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0= -github.com/grpc-ecosystem/grpc-gateway v1.16.0 h1:gmcG1KaJ57LophUzW0Hy8NmPhnMZb4M0+kPpLofRdBo= +github.com/gpustack/gguf-parser-go v0.28.1 h1:El6BAuJnpKI43nElOMc2erMtHQCv0ttu40WFJFf1Moo= +github.com/gpustack/gguf-parser-go v0.28.1/go.mod h1:y4TwTtDqFWTK+xvprOjRUh+dowgU2TKCX37vRKvGiZ0= github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw= -github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0/go.mod h1:zOBXOsUaBSjKgmH4OGzV1esUpR3oUSCPYVd2cUBjKYY= github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b h1:wDUNC2eKiL35DbLvsDhiblTUXHxcOPwQSCzi7xpQUN4= github.com/hako/durafmt v0.0.0-20210608085754-5c1018a4e16b/go.mod h1:VzxiSdG6j1pi7rwGm/xYI5RbtpBgM8sARDXlvEvxlu0= github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.74 h1:mymLUKThnV9wFvogOK8NnsMP9/vlhnjXY98gr2QIGW8= @@ -784,22 +775,16 @@ github.com/moby/moby/api v1.56.1/go.mod h1:sZ+THbVWkjOmBPPfbnzdD/G1LuIexWhqlSHHPTDQ1Uk= github.com/moby/moby/client v0.6.2 h1:ekSPlMccrZGcw6Scb8T9D39qE0mB+XupU/yS0zNw9N4= github.com/moby/moby/client v0.6.2/go.mod h1:DGcnO7qmPJrqobx/ggQgQ/AUk+2wgVdQv7uxB0/mEsc= -github.com/moby/sys/atomicwriter v0.1.0 h1:kw5D/EqkBwsBFi0ss9v1VG3wIkVhzGvLklJ+w3A14Sw= -github.com/moby/sys/atomicwriter v0.1.0/go.mod h1:Ul8oqv2ZMNHOceF643P6FKPXeCmYtlQMvpizfsSoaWs= github.com/moby/sys/capability v0.4.0 h1:4D4mI6KlNtWMCM1Z/K0i7RV1FkX+DBDHKVJpCndZoHk= github.com/moby/sys/capability v0.4.0/go.mod h1:4g9IK291rVkms3LKCDOoYlnV8xKwoDTpIrNEE35Wq0I= -github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg= -github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4= -github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= -github.com/moby/sys/sequential v0.6.0/go.mod h1:uyv8EUTrca5PnDsdMGXhZe6CCe8U/UiTWd+lL+7b/Ko= +github.com/moby/sys/mountinfo v0.7.3 h1:e0lin8d05kLgtUES/4cS/F70KlbZX/G3aZjLsV7WAgA= +github.com/moby/sys/mountinfo v0.7.3/go.mod h1:dEJRr+H+hx0lNG0BE+Smz95u/FDzjJv4/RjA2I456Iw= github.com/moby/sys/signal v0.7.1 h1:PrQxdvxcGijdo6UXXo/lU/TvHUWyPhj7UOpSo8tuvk0= github.com/moby/sys/signal v0.7.1/go.mod h1:Se1VGehYokAkrSQwL4tDzHvETwUZlnY7S5XtQ50mQp8= github.com/moby/sys/user v0.4.1 h1:RgjRlaDKi/Xmyrz4t8lyzXT6v2ooFeO/7xtchmhVWE0= github.com/moby/sys/user v0.4.1/go.mod h1:E9QsW5WRe1kUAf7kW8hXKwu1uhsZEAdPLYHYSDudF4Y= github.com/moby/sys/userns v0.2.1 h1:4OvdM7BcPkASbuouHsbW3aeMJSFlYDldBRnXVZhaRk8= github.com/moby/sys/userns v0.2.1/go.mod h1:IHUYgu/kao6N8YZlp9Cf444ySSvCmDlmzUcYfDHOl28= -github.com/moby/term v0.5.2 h1:6qk3FJAFDs6i/q3W/pQ97SX192qKfZgGjCQqfCJkgzQ= -github.com/moby/term v0.5.2/go.mod h1:d3djjFCrjnB+fl8NJux+EJzu0msscUP+f8it8hPkFLc= github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg= github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q= @@ -808,8 +793,6 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8= github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk= -github.com/morikuni/aec v1.1.0 h1:vBBl0pUnvi/Je71dsRrhMBtreIqNMYErSAbEeb8jrXQ= -github.com/morikuni/aec v1.1.0/go.mod h1:xDRgiq/iw5l+zkao76YTKzKttOp2cwPEne25HDkJnBw= github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6 h1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI= github.com/muesli/ansi v0.0.0-20230316100256-276c6243b2f6/go.mod h1:CJlz5H+gyd6CUWT45Oy4q24RdLyn7Md9Vj2/ldJBSIo= github.com/muesli/cancelreader v0.2.2 h1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA= @@ -1117,10 +1100,6 @@ go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.71.0/go.mod h1:Ef8SuTh59BT7+ofpDxN9z+yOlc4t2GjLmKDgYNJL/NU= go.opentelemetry.io/otel v1.46.0 h1:FHt5/CDyVxi/8IM1CH7VE/rRgq3kLHa2mSTVMO8AWyc= go.opentelemetry.io/otel v1.46.0/go.mod h1:Gj3SEScelsNC45tp4nSxRYlS+f5iez7W8XPMCt905kE= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0 h1:OFnwLJr+pF3iHrlGSzbxyuo6/6HyBlnlN1CWEJmBVcw= -go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0/go.mod h1:716wFneO0ov19A2beH5hjfh9AK5z/VWNAtDijp1Y0/g= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0 h1:KrC1YrQeSt46ITMWAbgQx1M1eV1/1TKzttrBzymPmss= -go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0/go.mod h1:zDSEzoEqsOrgBeGvH66KRgxh90VonFyJqBHA0Pk3+rM= go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0 h1:hqxVTu/GtBF+vJ8d1fzW7fRxZFvgoDjWcxwwCaFDYpU= go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.44.0/go.mod h1:z5fVEF4X5v0ESvlJqBrrFlBVoj5EQuefZpzsu7R+x5Q= go.opentelemetry.io/otel/metric v1.46.0 h1:yBnkXvgV7AXFILZc5K6IZe/CBFF3OS7BJ8ov6/lj0K8= @@ -1134,8 +1113,6 @@ go.opentelemetry.io/otel/trace v1.46.0 h1:OULy7ccdJnZtJ0UDYFOIGaCmiWzJ8Vi2G/Rsu60qs1c= go.opentelemetry.io/otel/trace v1.46.0/go.mod h1:J7GAXweO77XSFkB/rmAqk9D6ihszhFjLU+d9WuUxDLI= go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI= -go.opentelemetry.io/proto/otlp v1.11.0 h1:5rrYs0Ykyj50sdU/JU0x8etU+LubXWb+gED6TbEdMIk= -go.opentelemetry.io/proto/otlp v1.11.0/go.mod h1:SmVizdCOAm3XBtG1g1NnOdhW6jtddT72hLMhv8VwA8E= go.podman.io/image/v5 v5.42.0 h1:C//Ix0Thj2LYOQO6++NjU3McLFLQbf4czgUyH98R9gc= go.podman.io/image/v5 v5.42.0/go.mod h1:mmIgf9EdpF68j8vdX1/OxhOSIknU1PO3G6/ClRkrwm4= go.podman.io/storage v1.65.0 h1:GgY5VibEw6coVhOGYWuxZ4F7H2AaTfPiwL7E1CJ2dnM= @@ -1146,8 +1123,8 @@ go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= -go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= -go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= +go.yaml.in/yaml/v3 v3.0.6 h1:zcDfvjXEqTQmpjniUBLc91xYJMB2c4QOFxEF/LCEckM= +go.yaml.in/yaml/v3 v3.0.6/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc= go4.org v0.0.0-20230225012048-214862532bf5/go.mod h1:F57wTi5Lrj6WLyswp5EYV1ncrEbFGHD4hhz6S1ZYeaU= golang.org/x/crypto v0.0.0-20180904163835-0709b304e793/go.mod h1:6SG95UA2DQfeDnfUPMdvaQW0Q7yPrPDi9nlGo2tz2b4= @@ -1262,8 +1239,8 @@ golang.org/x/net v0.15.0/go.mod h1:idbUs1IY1+zTqbi8yxTbhexhEEk5ur9LInksu6HrEpk= golang.org/x/net v0.21.0/go.mod h1:bIjVDfnllIU7BJ2DNgfnXvpSvtn8VRwhlsaeUTyUS44= golang.org/x/net v0.25.0/go.mod h1:JkAGAh7GEvH74S6FOH42FLoXpXbE/aqXSrIQjXgsiwM= -golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= -golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.2/grype/db/v6/cpe_lookups.go new/grype-0.121.3/grype/db/v6/cpe_lookups.go --- old/grype-0.121.2/grype/db/v6/cpe_lookups.go 2026-11-05 22:02:48.000000000 +0100 +++ new/grype-0.121.3/grype/db/v6/cpe_lookups.go 2026-11-09 15:55:26.000000000 +0100 @@ -13,6 +13,7 @@ // which allows us to upgrade some CPE-only provider results to more accurate package // ecosystem matches. In future this will be another input data source to the grype db // build process, but this is good enough for now +// nolint:goconst var CPEPackageSpecifierLookup = buildCPEPackageSpecifierLookup( []packageSpecifierLookup{ // Anchore Products @@ -186,6 +187,276 @@ "cpe:2.3:a:com.atlassian.jira.plugins:insight-discovery:*:*:*:*:*:maven:*:*", }, }, + { + Package: PackageSpecifier{Name: "github.com/hashicorp/consul-k8s/control-plane", Ecosystem: string(pkg.GoModulePkg)}, + CPEs: []string{ + "cpe:2.3:a:hashicorp:consul_k8s_control_plane:*:*:*:*:*:go:*:*", + "cpe:2.3:a:hashicorp:consul-k8s-control-plane:*:*:*:*:*:go:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "github.com/hashicorp/consul-template", Ecosystem: string(pkg.GoModulePkg)}, + CPEs: []string{ + "cpe:2.3:a:hashicorp:consul_template:*:*:*:*:*:go:*:*", + "cpe:2.3:a:hashicorp:consul_template:*:*:*:*:*:*:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "github.com/hashicorp/go-getter", Ecosystem: string(pkg.GoModulePkg)}, + CPEs: []string{ + "cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:go:*:*", + "cpe:2.3:a:hashicorp:go-getter:*:*:*:*:*:*:*:*", + "cpe:2.3:a:hashicorp:go_getter:*:*:*:*:*:go:*:*", + "cpe:2.3:a:hashicorp:go_getter:*:*:*:*:*:*:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.thrift:libthrift", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.thrift:libthrift:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:thrift:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "github.com/apache/thrift", Ecosystem: string(pkg.GoModulePkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:go:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "ApacheThrift", Ecosystem: string(pkg.DotnetPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:nuget:*:*", + "cpe:2.3:a:apache:thrift:*:*:*:*:*:.net:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "thrift", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "thrift", Ecosystem: string(pkg.ConanPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:c\\+\\+:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "apache/thrift", Ecosystem: string(pkg.PhpComposerPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:php:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "thrift", Ecosystem: string(pkg.GemPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:ruby:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "Thrift", Ecosystem: string(pkg.CpanPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:perl:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "thrift", Ecosystem: string(pkg.NpmPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:node.js:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "thrift", Ecosystem: string(pkg.RustPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:thrift:*:*:*:*:*:rust:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:tomcat-catalina", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-catalina:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-catalina:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:catalina", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-catalina:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-catalina:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat.embed:tomcat-embed-core", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat.embed:tomcat-embed-core:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-embed-core:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:tomcat-coyote", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-coyote:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-coyote:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:coyote", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-coyote:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-coyote:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:tomcat-coyote-ffm", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-coyote-ffm:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-coyote-ffm:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:coyote-ffm", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-coyote-ffm:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-coyote-ffm:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:tomcat-util", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-util:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-util:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:tomcat-jasper", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-jasper:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-jasper:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:jasper", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-jasper:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-jasper:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat.embed:tomcat-embed-websocket", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat.embed:tomcat-embed-websocket:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-embed-websocket:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "org.apache.tomcat:tomcat-websocket", Ecosystem: string(pkg.JavaPkg)}, + CPEs: []string{ + "cpe:2.3:a:org.apache.tomcat:tomcat-websocket:*:*:*:*:*:maven:*:*", + "cpe:2.3:a:apache:tomcat-websocket:*:*:*:*:*:maven:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "pyload-ng", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:pyload-ng_project:pyload-ng:*:*:*:*:*:python:*:*", + "cpe:2.3:a:pyload:pyload:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "cryptography", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:cryptography.io:cryptography:*:*:*:*:*:python:*:*", + "cpe:2.3:a:cryptography_project:cryptography:*:*:*:*:*:python:*:*", + "cpe:2.3:a:python-cryptography_project:python-cryptography:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "picklescan", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:mmaitre314:picklescan:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "tensorflow", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:google:tensorflow:*:*:*:*:*:python:*:*", + "cpe:2.3:a:tensorflow:tensorflow:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "tensorflow-gpu", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:google:tensorflow-gpu:*:*:*:*:*:python:*:*", + "cpe:2.3:a:tensorflow:tensorflow-gpu:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "tensorflow-cpu", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:google:tensorflow-cpu:*:*:*:*:*:python:*:*", + "cpe:2.3:a:tensorflow:tensorflow-cpu:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "django", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:djangoproject:django:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "pillow", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:python:pillow:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "lightning", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:apache:airflow:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "pytorch-lightning", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:lightning_ai:lightning_ai\\/pytorch_lightning:*:*:*:*:*:*:*:*", + "cpe:2.3:a:lightning_ai:lightning_ai\\/pytorch_lightning:*:*:*:*:*:python:*:*", + "cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:python:*:*", + "cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:*:*:*", + "cpe:2.3:a:pytorchlightning:pytorch_lightning:*:*:*:*:*:python:*:*", + "cpe:2.3:a:pytorchlightning:pytorch_lightning:*:*:*:*:*:*:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "lightning", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:lightning_ai:lightning_ai\\/pytorch_lightning:*:*:*:*:*:*:*:*", + "cpe:2.3:a:lightning_ai:lightning_ai\\/pytorch_lightning:*:*:*:*:*:python:*:*", + "cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:python:*:*", + "cpe:2.3:a:lightningai:pytorch_lightning:*:*:*:*:*:*:*:*", + "cpe:2.3:a:pytorchlightning:pytorch_lightning:*:*:*:*:*:python:*:*", + "cpe:2.3:a:pytorchlightning:pytorch_lightning:*:*:*:*:*:*:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "praisonai", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:praison:praisonai:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "praisonai-platform", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:praison:praisonai-platform:*:*:*:*:*:python:*:*", + }, + }, + { + Package: PackageSpecifier{Name: "vllm", Ecosystem: string(pkg.PythonPkg)}, + CPEs: []string{ + "cpe:2.3:a:vllm-project:vllm:*:*:*:*:*:python:*:*", + "cpe:2.3:a:vllm:vllm:*:*:*:*:*:python:*:*", + }, + }, }, ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.2/internal/format/writer_test.go new/grype-0.121.3/internal/format/writer_test.go --- old/grype-0.121.2/internal/format/writer_test.go 2026-11-05 22:02:48.000000000 +0100 +++ new/grype-0.121.3/internal/format/writer_test.go 2026-11-09 15:55:26.000000000 +0100 @@ -2,12 +2,13 @@ import ( "io" + "os" "path/filepath" "strings" "testing" - "github.com/docker/docker/pkg/homedir" "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" ) func Test_MakeScanResultWriter(t *testing.T) { @@ -197,6 +198,9 @@ } func Test_newSBOMWriterDescription(t *testing.T) { + home, err := os.UserHomeDir() + require.NoError(t, err) + tests := []struct { name string path string @@ -205,7 +209,7 @@ { name: "expand home dir", path: "~/place.txt", - expected: filepath.Join(homedir.Get(), "place.txt"), + expected: filepath.Join(home, "place.txt"), }, { name: "passthrough other paths", ++++++ grype.obsinfo ++++++ --- /var/tmp/diff_new_pack.Ju2wQu/_old 2026-11-10 14:42:27.098671358 +0100 +++ /var/tmp/diff_new_pack.Ju2wQu/_new 2026-11-10 14:42:27.103671567 +0100 @@ -1,5 +1,5 @@ name: grype -version: 0.121.2 -mtime: 1793912568 -commit: 82d7a0ea911946b99343c672056867d372f9b319 +version: 0.121.3 +mtime: 1794236126 +commit: cd1f23eb50dfb52647090158f453c7359172591f ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/grype/vendor.tar.gz /work/SRC/openSUSE:Factory/.grype.new.3759290/vendor.tar.gz differ: char 15, line 1
