[github-actions]

This PR contains the following updates:

Package	Type	Update	Change	Pending
anchore/grype	security_tools	patch	v0.121.0 → v0.121.1	v0.121.3 (+1)
anchore/syft	security_tools	minor	v1.56.0 → v1.57.0	v1.57.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

anchore/grype (anchore/grype)

v0.121.1

Compare Source

Bug Fixes

• extract the quality gate debug artifact outside the checkout [PR #​3875 @​wagoodman]
• incorrect constraint for versionless purls in openvex [PR #​3874 @​kzantow]
• report additional version-range records for a package [PR #​3782 @​jspilman]
• report a package's vulnerability as added or removed only when its affected record set changes [PR #​3784 @​jspilman]
• report the lowest overlapping AlmaLinux fix [PR #​3783 @​jspilman]
• report fix date and kind changes under the package [PR #​3781 @​jspilman]
• label db diff databases in the order they were provided [PR #​3816 @​bot190]
• time out stalled db diff downloads [PR #​3858 @​wagoodman]
• only remove db diff directories that grype created [PR #​3828 @​wagoodman]
• make db diff --packages and --vulns include only what was requested [PR #​3815 @​bot190]

Performance

• index ignore rules by vulnerability ID [PR #​3817 @​juanjsebgarcia]
• speed up db diff and reduce its memory and temp disk use [PR #​3813 @​bot190]

Additional Changes

• grype 0.119.0 allocates without bound on a CycloneDX machine-learning-model component with no purl and no CPE [Issue #​3767]
• add a directory for grype-specific match labels [PR #​3849 @​wagoodman]
• let go-make own the go version and move images to debian13 [PR #​3840 @​wagoodman]

Dependencies

41 dependency changes (39 updated, 1 added, 1 removed). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-mgcc-cww5-fp2q (High) — github.com/go-jose/go-jose/v4

Updated (39 packages)

• github.com/Microsoft/go-winio v0.6.3-0.ad3df93 → v0.6.3-0.f19d971
• github.com/ProtonMail/go-crypto v1.4.1 → v1.5.2
• github.com/anchore/clio v0.1.1 → v0.1.2
• github.com/anchore/stereoscope v0.3.4 → v0.4.0
• github.com/anchore/syft v1.55.0 → v1.56.0
• github.com/bmatcuk/doublestar/v4 v4.10.2 → v4.10.3
• github.com/containerd/containerd/v2 v2.4.1 → v2.4.2
• github.com/containerd/stargz-snapshotter/estargz v0.18.2 → v0.19.0
• github.com/deitch/magic v0.0.0-c67ab88 → v1.0.0
• github.com/docker/cli v29.8.2+incompatible → v29.9.2+incompatible
• github.com/docker/docker-credential-helpers v0.9.8 → v0.9.10
• github.com/docker/go-connections v0.8.1 → v0.8.2
• github.com/gabriel-vasile/mimetype v1.4.15 → v1.4.16
• github.com/github/go-spdx/v2 v2.7.1 → v2.8.0
• github.com/gkampitakis/go-snaps v0.5.23 → v0.5.24
• github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 (🟢 remediated GHSA-mgcc-cww5-fp2q)
• github.com/go-test/deep v1.1.1 → v1.1.2
• github.com/google/pprof v0.0.0-ef3492d → v0.0.0-1facf8f
• github.com/gookit/color v1.6.2 → v1.6.3
• github.com/gpustack/gguf-parser-go v0.26.4 → v0.27.0
• github.com/klauspost/compress v1.20.1 → v1.20.3
• github.com/klauspost/pgzip v1.2.6 → v1.2.7
• github.com/mattn/go-runewidth v0.0.27 → v0.0.31
• github.com/mattn/go-sqlite3 v1.14.48 → v1.14.52
• github.com/moby/moby/api v1.56.0 → v1.56.1
• github.com/moby/moby/client v0.6.0 → v0.6.2
• github.com/ncruces/go-strftime v1.0.0 → v1.1.0
• github.com/sigstore/fulcio v1.8.7 → v1.8.8
• github.com/vbauerster/cupwriter v0.0.4 → v0.0.5
• github.com/vbauerster/mpb/v8 v8.14.0 → v8.16.2
• go.podman.io/image/v5 v5.41.2 → v5.42.0
• go.podman.io/storage v1.64.1 → v1.65.0
• golang.org/x/mod v0.41.0 → v0.42.0
• golang.org/x/tools v0.51.0 → v0.52.0
• modernc.org/cc/v4 v4.29.7 → v4.30.3
• modernc.org/ccgo/v4 v4.36.1 → v4.37.0
• modernc.org/gc/v3 v3.1.5 → v3.2.0
• modernc.org/libc v1.77.1 → v1.79.0
• modernc.org/sqlite v1.60.1 → v1.61.0

Added (1 package)

• github.com/varlink/go v0.4.1-0.c935be0

Removed (1 package)

• github.com/becheran/wildmatch-go v1.0.0

(Full Changelog)

anchore/syft (anchore/syft)

v1.57.0

Compare Source

Added Features

• capture GNU ELF build IDs [PR #​5426 @​adityasaky]
• build lower layer squashes only when a scan reads them [PR #​5492 @​wagoodman]

Bug Fixes

• do not generate CPEs for msrc-kb packages [PR #​5510 @​juanjsebgarcia]
• Fix truncated pre-release versions in Go binaries' ldflags [PR #​5422 @​LemonCondor]
• generate NVD-style terraform_provider CPEs for terraform lock packages [PR #​5261 @​timols]
• OpenSSL-only SHA-256 fallback aborts installation [Issue #​5520] [PR #​5521 @​pujitha24]

Dependencies

1 dependency change (1 updated).

Updated (1 package)

• github.com/anchore/stereoscope v0.4.0 → v0.4.1

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[njhensley]

Review — PR #3742 chore(deps): Update supply-chain

Method: quick; 1 persona pass (correctness/API/supply-chain), reduced independence, adjudicated by the parent in a separate pass against head 0b9ec3f.
Tier legend: 🔴 Blocker · 🟠 Major · 🟡 Minor · 🔵 Nitpick · ✅ Confirmed non-issue

Other reviews: none. The only other comment is copy-pr-bot's vetting notice.

Overall assessment — Approve

The PR bumps two local-tool pins in .settings.yaml: grype v0.121.0 → v0.121.1 and syft v1.56.0 → v1.57.0. The one version-tied hash in the repo, grype's install.sh pin, still matches the new tag. CI and release SBOMs use the binaries bundled in the anchore actions, not these pins. No findings survived.

Inline comments

None.

✅ Confirmed non-issues

• The grype install.sh hash still matches. tools/setup-tools:765-768 pins GRYPE_INSTALL_SHA256 and says to re-pin it on every grype bump. install.sh at v0.121.1 hashes to the committed 4bc8e844…cbfd, and the compare v0.121.0...v0.121.1 doesn't touch install.sh. Checked through the read-only GitHub API.
• No syft checksum should have moved. tools/setup-tools:1025-1029 checks against upstream's syft_<ver>_checksums.txt at install time. No committed syft or grype checksum or tools/update-*-checksums script exists, so check-settings-checksums is unaffected.
• CI and release output don't read these pins. .github/actions/security-scan/action.yml:45 uses anchore/scan-action with its own grype. .github/actions/setup-build-tools/action.yml:216-218 installs syft through anchore/sbom-action/download-syft, which also feeds the goreleaser sboms: step. load-versions only logs the grype value.
• No stale copies. Neither v0.121.0 nor v1.56.0 appears anywhere at the head. The Renovate annotations at .settings.yaml:86,90 still sit directly above their values.
• Local consumers. Makefile:508 uses long-stable grype flags. tools/check-tools:112 compares syft at major.minor, so developers still on syft 1.56 get the usual version-mismatch warning from make tools-check until they reinstall.

Coverage and limitations

• Source-inspected: the diff, all grype/syft pin consumers (CI actions, tools/setup-tools, tools/check-tools, Makefile, .goreleaser.yaml).
• Executed: hashed install.sh at the v0.121.1 tag through the GitHub contents API. This rules out the grype bump breaking make tools-setup on a stale install.sh pin.
• Unverified: behavior changes inside grype 0.121.1 and syft 1.57.0. They affect only local developer runs.
• CI: only 5 checks have run because copy-pr-bot is waiting for a vetter's /ok.

Summary

Tier	Count	Items
🔴 Blocker	0
🟠 Major	0
🟡 Minor	0
🔵 Nitpick	0

Recommendation: approve once /ok lets the full gate run green on this head.

[njhensley]

/ok

[github-actions]

Coverage Report ✅

Metric	Value
Coverage	86.3%
Threshold	83%
Status	Pass

Coverage Badge

![Coverage](https://img.shields.io/badge/coverage-86.3%25-brightgreen)

No Go source files changed in this PR.