Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package syft for openSUSE:Factory checked in at 2026-07-17 18:48:44 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/syft (Old) and /work/SRC/openSUSE:Factory/.syft.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "syft" Fri Jul 17 18:48:44 2026 rev:128 rq:1366296 version:1.48.0 Changes: -------- --- /work/SRC/openSUSE:Factory/syft/syft.changes 2026-06-28 21:10:49.290756807 +0200 +++ /work/SRC/openSUSE:Factory/.syft.new.24530/syft.changes 2026-07-17 18:49:54.006106473 +0200 @@ -1,0 +2,64 @@ +Fri Jul 17 05:15:12 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.48.0 (1.47.0 was not released): + * Added Features + - emit dependency relationships from mix.lock [PR #4985 + @cgreeno] + - add safe tensor model type to SBOM output [PR #4844 @spiffcs] + - Capture golang binary symbols [PR #4988 @spiffcs] + - Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman] + - Add scan duration timer to Syft [Issue #4587] [PR #4858 + @ChrisJr404] + - Support for vcpkg [Issue #2110] [PR #4081 @gabetrau] + - Add macOS .app cataloger [Issue #4010] [PR #4490 @rezmoss] + - Add support for Kerberos 5 library cataloging [Issue #4780] + [PR #4781 @nadimz] + - Include date of scan in results [Issue #3910] + * Bug Fixes + - use printf instead of echo to fix ANSI color output [PR #4978 + @Jouini-Mohamed-Chaker] + - Strip peer-dep suffix from deno.lock npm keys [PR #5055 + @Synvoya] + - Allow more PEP440-compliant characters in python versions [PR + #4964 @kzantow] + - PE case-insensitive extensions (Win32/ISO 9660 compatibility) + [PR #4996 @activeobd] + - Fix panic parsing a rockspec comment that ends at EOF [PR + #5053 @arpitjain099] + - Fix Debian point release detection [PR #4997 @OsamaSE] + - Fix mix.lock git/path deps mislabeled as hex.pm packages with + bogus PURLs [PR #5041 @Synvoya] + - npm redis client generates no CPE [Issue #5011] [PR #5012 + @rezmoss] + - Debug Docker images are running as nonroot user [Issue #4113] + [PR #4608 @spiffcs] + - libxml2 gets the wrong cpe vendor [Issue #5015] [PR #5016 + @rezmoss] + - wrong purl for spring-ldap-core dependency [Issue #4030] [PR + #4908 @jonasboos] + - Swift: CVEs missed by Grype when using Syft-generated SBOMs – + missing group field breaks PURL matching [Issue #3961] [PR + #4785 @SAY-5] + - conanfile.txt: dependencies after a comment line in + [requires] are not detected [Issue #5017] [PR #5020 + @jfjrh2014] + - dotnet cataloger can't find packages from deps.json in linux + elf single-file bundles [Issue #4514] [PR #4517 @rezmoss] + - Go template sprig date functions not defined [Issue #2372] + [PR #4644 @sputnik-mac] + - CycloneDX BOM contains invalid externalReferences URL from + unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue + #4720] [PR #4782 @SAY-5] + * Dependencies updated (8 packages) + - github.com/bmatcuk/doublestar v1.3.1 → v8.8.8 + - github.com/klauspost/compress v1.18.6 → v1.19.0 + - golang.org/x/tools v0.46.0 → v0.47.0 + - modernc.org/cc/v4 v4.28.2 → v4.28.4 + - modernc.org/ccgo/v4 v4.34.0 → v4.34.4 + - modernc.org/gc/v3 v3.1.2 → v3.1.3 + - modernc.org/libc v1.72.3 → v1.73.4 + - modernc.org/sqlite v1.51.0 → v1.53.0 + * Dependencies Added (1 package) + - howett.net/plist v1.0.1 + +------------------------------------------------------------------- Old: ---- syft-1.46.0.obscpio New: ---- syft-1.48.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ syft.spec ++++++ --- /var/tmp/diff_new_pack.gBm7KW/_old 2026-07-17 18:49:55.934171711 +0200 +++ /var/tmp/diff_new_pack.gBm7KW/_new 2026-07-17 18:49:55.934171711 +0200 @@ -17,7 +17,7 @@ Name: syft -Version: 1.46.0 +Version: 1.48.0 Release: 0 Summary: CLI tool and library for generating a Software Bill of Materials License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.gBm7KW/_old 2026-07-17 18:49:55.994173742 +0200 +++ /var/tmp/diff_new_pack.gBm7KW/_new 2026-07-17 18:49:56.002174013 +0200 @@ -1,9 +1,9 @@ <services> <service name="obs_scm" mode="manual"> - <param name="url">https://github.com/anchore/syft</param> + <param name="url">https://github.com/anchore/syft.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">v1.46.0</param> + <param name="revision">refs/tags/v1.48.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.gBm7KW/_old 2026-07-17 18:49:56.046175501 +0200 +++ /var/tmp/diff_new_pack.gBm7KW/_new 2026-07-17 18:49:56.058175908 +0200 @@ -1,6 +1,8 @@ <servicedata> <service name="tar_scm"> <param name="url">https://github.com/anchore/syft</param> - <param name="changesrevision">b15c5dbfe2bb21c9d73002c1056a829c8c411c75</param></service></servicedata> + <param name="changesrevision">b15c5dbfe2bb21c9d73002c1056a829c8c411c75</param></service><service name="tar_scm"> + <param name="url">https://github.com/anchore/syft.git</param> + <param name="changesrevision">3e2bc6ed095f7ec1a415fb38cfe1c319e95dfed6</param></service></servicedata> (No newline at EOF) ++++++ syft-1.46.0.obscpio -> syft-1.48.0.obscpio ++++++ ++++ 42364 lines of diff (skipped) ++++++ syft.obsinfo ++++++ --- /var/tmp/diff_new_pack.gBm7KW/_old 2026-07-17 18:50:04.346456353 +0200 +++ /var/tmp/diff_new_pack.gBm7KW/_new 2026-07-17 18:50:04.402458248 +0200 @@ -1,5 +1,5 @@ name: syft -version: 1.46.0 -mtime: 1782415574 -commit: b15c5dbfe2bb21c9d73002c1056a829c8c411c75 +version: 1.48.0 +mtime: 1784211682 +commit: 3e2bc6ed095f7ec1a415fb38cfe1c319e95dfed6 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/syft/vendor.tar.gz /work/SRC/openSUSE:Factory/.syft.new.24530/vendor.tar.gz differ: char 13, line 1
