fix(deps): update module github.com/anchore/grype to v0.79.3

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/grype	v0.78.0 -> v0.79.3

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anchore/grype (github.com/anchore/grype)

v0.79.3

Compare Source

Bug Fixes

• correct logic checking cpe target software component against package type [#​1658 @​westonsteimel]

Additional Changes

• update Syft to v1.9.0 [#​1986 @​anchore-actions-token-generator]

(Full Changelog)

v0.79.2

Compare Source

Bug Fixes

• use location RealPath not String() for match sorting [#​1950 @​luhring]

(Full Changelog)

v0.79.1

Compare Source

Updates

• update CI to install golang at the latest version [#​1949 @​spiffcs]
• Grype is now built with the latest version of Golang at v1.22.x. This resolves a few security findings that would have been flagged against the v0.79.0 binary for using an older version of the Golang standard library.

(Full Changelog)

v0.79.0

Compare Source

Added Features

• Installation script: Support checksum signature verification [#​1627 #​1670 @​hibare]

Bug Fixes

• fix match sort ordering for different locations [#​1944 @​luhring]
• Sort order for matches should consider fix info [#​1933 @​wagoodman]
• Go main module pseudo version matching: turn off by default [#​1894 @​luhring]
• Inconsistent naming of matchDetails.searchedBy.package field [#​1877 #​1900 @​kzantow]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - "after 8am on Monday" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.

[renovate]

ℹ Artifact update notice

File name: scanner/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 22 additional dependencies were updated

Details:

Package	Change
github.com/CycloneDX/cyclonedx-go	v0.8.0 -> v0.9.0
github.com/anchore/stereoscope	v0.0.3-0.20240624202600-753b5576fe42 -> v0.0.3-0.20240705165118-e46739e21796
github.com/anchore/syft	v1.5.0 -> v1.9.0
github.com/google/go-containerregistry	v0.19.2 -> v0.20.0
golang.org/x/crypto	v0.24.0 -> v0.25.0
github.com/BurntSushi/toml	v1.3.2 -> v1.4.0
github.com/adrg/xdg	v0.4.0 -> v0.5.0
github.com/charmbracelet/lipgloss	v0.11.0 -> v0.11.1
github.com/charmbracelet/x/ansi	v0.1.1 -> v0.1.3
github.com/docker/cli	v26.1.4+incompatible -> v27.0.3+incompatible
github.com/docker/docker	v26.1.4+incompatible -> v27.0.3+incompatible
github.com/github/go-spdx/v2	v2.2.0 -> v2.3.1
github.com/go-test/deep	v1.1.0 -> v1.1.1
github.com/saferwall/pe	v1.5.3 -> v1.5.4
github.com/spdx/tools-golang	v0.5.4 -> v0.5.5
github.com/sylabs/sif/v2	v2.16.0 -> v2.17.1
github.com/vbatts/go-mtree	v0.5.3 -> v0.5.4
golang.org/x/mod	v0.17.0 -> v0.19.0
golang.org/x/net	v0.26.0 -> v0.27.0
gorm.io/gorm	v1.25.10 -> v1.25.11
modernc.org/libc	v1.49.3 -> v1.52.1
modernc.org/sqlite	v1.29.10 -> v1.30.1

[renovate]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.