chore(deps): update anchore/scan-action action to v6 (feature/beta-release)

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anchore/scan-action	action	major	v4.1.2 → v6.5.1

---

Release Notes

anchore/scan-action (anchore/scan-action)

v6.5.1

Compare Source

New in scan-action v6.5.1

• Update Grype to v0.97.1 (#​495)

v6.5.0

Compare Source

New in scan-action v6.5.0

• Update Grype to v0.96.1 (#​493) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• fix: output stderr for nonzero exit code (#​491) [kzantow]

v6.4.0

Compare Source

New in scan-action v6.4.0

• Update Grype to v0.95.0 (#​486)
• chore(deps-dev): bump eslint from 9.30.0 to 9.30.1 (#​485)
• chore(deps-dev): bump lint-staged from 16.1.0 to 16.1.2 (#​476)
• chore(deps-dev): bump jest from 30.0.0 to 30.0.3 (#​481)
• chore(deps-dev): bump prettier from 3.5.3 to 3.6.2 (#​483)
• chore(deps-dev): bump eslint from 9.28.0 to 9.30.0 (#​484)

v6.3.0

Compare Source

New in scan-action v6.3.0

• Update Grype to v0.94.0 (#​470)

v6.2.0

Compare Source

New in scan-action v6.2.0

• feat: update Scan action to use grype db v6 (#​462) [spiffcs]

v6.1.0

Compare Source

New in scan-action v6.1.0

• Feature (deps): update Grype to v0.87.0 (#​430)
  • See Grype changes for new updates

v6.0.0

Compare Source

New in scan-action v6.0.0

Breaking Change

• feat: add output-file option, default to random directory output in temp (#​346) [kzantow]

The action no longer generates files in your working directory by default, instead you should use the action outputs: ${{ steps.<id>.outputs.sarif }} where the <id> needs to match the id you configured to reference the scan-action, e.g.:

      - uses: anchore/scan-action@v6
        id: scan
        ...
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

Other Changes

• chore(deps): update Grype to v0.86.1 (#​416) [anchore-actions-token-generator]
• feat: add support for cyclonedx and cyclonedx-json output-formats (#​396) [ps-e]
• chore(deps): bump @​actions/cache from 3.3.0 to 4.0.0 (#​412) [dependabot]
• chore(deps): update Grype to v0.86.0 (#​413) [anchore-actions-token-generator]

v5.3.0

Compare Source

New in scan-action v5.3.0

• chore(deps): update Grype to v0.85.0 (#​408) [anchore-actions-token-generator]
• chore(deps-dev): bump @​vercel/ncc from 0.38.2 to 0.38.3 (#​406) [dependabot]
• chore(deps-dev): bump eslint from 9.14.0 to 9.15.0 (#​405) [dependabot]
• chore(deps-dev): bump husky from 9.1.6 to 9.1.7 (#​407) [dependabot]

v5.2.1

Compare Source

New in scan-action v5.2.1

• update Grype to v0.84.0 (#​404) [anchore-actions-token-generator]
• bump @​actions/cache from 3.2.4 to 3.3.0 (#​402) [dependabot]

v5.2.0

Compare Source

New in scan-action v5.2.0

• chore(deps): update Grype to v0.83.0 (#​398) [anchore-actions-token-generator]
• chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#​394) [dependabot]
• chore(deps): bump actions/setup-node from 4.0.4 to 4.1.0 (#​395) [dependabot]

v5.1.0

Compare Source

New in scan-action v5.1.0

• chore(deps): update Grype to v0.82.2 (#​393) [anchore-actions-token-generator]
• chore(deps-dev): bump eslint from 9.12.0 to 9.13.0 (#​392) [dependabot]
• chore(deps-dev): bump tslib from 2.7.0 to 2.8.0 (#​391) [dependabot]

v5.0.1

Compare Source

New in scan-action v5.0.1

• chore(deps): update Grype to v0.82.1 (#​389) [anchore-actions-token-generator]

v5.0.0

Compare Source

New in scan-action v5.0.0

• chore(deps): update Grype to v0.82.0 (#​383) [anchore-actions-token-generator]

🚀 Features

• feat: short-lived grype-db cache (#​348) [kzantow]
  Note: with this release grype is no longer installed on $PATH. We suspect the changes here could break a number of users of the action who have learned to expect Grype be installed on $PATH.

---

Configuration

📅 Schedule: Branch creation - "before 8am on monday" in timezone America/New_York, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.