Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package syft for openSUSE:Factory checked in at 2026-07-22 19:05:28 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/syft (Old) and /work/SRC/openSUSE:Factory/.syft.new.24530 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "syft" Wed Jul 22 19:05:28 2026 rev:129 rq:1367084 version:1.49.0 Changes: -------- --- /work/SRC/openSUSE:Factory/syft/syft.changes 2026-07-17 18:49:54.006106473 +0200 +++ /work/SRC/openSUSE:Factory/.syft.new.24530/syft.changes 2026-07-22 19:07:53.586786913 +0200 @@ -1,0 +2,28 @@ +Wed Jul 22 06:31:01 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.49.0: + * Added Features + - Support for application/vnd.oci.image.index.v1+json manifests + in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos] + * Bug Fixes + - Misinterpretation of Multiple replace Directives in Golang + [Issue #2721] [PR #5069 @ychampion] + * Dependencies updated + - github.com/anchore/go-rpmdb v0.1.0 → v0.2.0 + - github.com/anchore/stereoscope v0.2.2 → v0.3.0 + - github.com/containerd/containerd/v2 v2.3.2 → v2.3.3 + - github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible + - github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23 + - github.com/moby/moby/api v1.54.2 → v1.55.0 + - github.com/moby/moby/client v0.4.1 → v0.5.0 + - github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3 + - golang.org/x/crypto v0.53.0 → v0.54.0 + - golang.org/x/mod v0.37.0 → v0.38.0 + - golang.org/x/net v0.56.0 → v0.57.0 + - golang.org/x/sync v0.21.0 → v0.22.0 + - golang.org/x/sys v0.46.0 → v0.47.0 + - golang.org/x/term v0.44.0 → v0.45.0 + - golang.org/x/text v0.38.0 → v0.40.0 + - golang.org/x/tools v0.47.0 → v0.48.0 + +------------------------------------------------------------------- Old: ---- syft-1.48.0.obscpio New: ---- syft-1.49.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ syft.spec ++++++ --- /var/tmp/diff_new_pack.odguv9/_old 2026-07-22 19:07:54.990834993 +0200 +++ /var/tmp/diff_new_pack.odguv9/_new 2026-07-22 19:07:54.994835129 +0200 @@ -17,7 +17,7 @@ Name: syft -Version: 1.48.0 +Version: 1.49.0 Release: 0 Summary: CLI tool and library for generating a Software Bill of Materials License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.odguv9/_old 2026-07-22 19:07:55.030836362 +0200 +++ /var/tmp/diff_new_pack.odguv9/_new 2026-07-22 19:07:55.034836499 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/syft.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.48.0</param> + <param name="revision">refs/tags/v1.49.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.odguv9/_old 2026-07-22 19:07:55.062837458 +0200 +++ /var/tmp/diff_new_pack.odguv9/_new 2026-07-22 19:07:55.066837595 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/syft</param> <param name="changesrevision">b15c5dbfe2bb21c9d73002c1056a829c8c411c75</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/syft.git</param> - <param name="changesrevision">3e2bc6ed095f7ec1a415fb38cfe1c319e95dfed6</param></service></servicedata> + <param name="changesrevision">29fd7d0dec81cf03e0a1194a1985c7c893bb2396</param></service></servicedata> (No newline at EOF) ++++++ syft-1.48.0.obscpio -> syft-1.49.0.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/cmd/syft/internal/test/integration/multiplatform_oci_test.go new/syft-1.49.0/cmd/syft/internal/test/integration/multiplatform_oci_test.go --- old/syft-1.48.0/cmd/syft/internal/test/integration/multiplatform_oci_test.go 1970-01-01 01:00:00.000000000 +0100 +++ new/syft-1.49.0/cmd/syft/internal/test/integration/multiplatform_oci_test.go 2026-07-20 20:04:57.000000000 +0200 @@ -0,0 +1,145 @@ +package integration + +import ( + "context" + "encoding/json" + "fmt" + "runtime" + "testing" + + "github.com/stretchr/testify/assert" + "github.com/stretchr/testify/require" + + "github.com/anchore/stereoscope/pkg/image" + "github.com/anchore/stereoscope/pkg/imagetest" + "github.com/anchore/syft/syft" + "github.com/anchore/syft/syft/source" +) + +// TestMultiPlatformOCIImageSelection verifies that syft can load a single platform out of a +// multi-platform OCI image on disk (both --from oci-dir and --from oci-archive) by selecting the +// image that matches the requested platform. +func TestMultiPlatformOCIImageSelection(t *testing.T) { + remoteImage := "docker.io/library/busybox:1.38.0" + + // Per-platform image config digests within the multi-platform index, obtained from the OCI layout + // (see anchore/stereoscope integration tests: TestPlatformSelectionWithOciLocalSources). + expectedDigest := map[string]string{ + "arm64": "sha256:e0e8b3cbfed68a90084781e2962f9c0deead51c5a3f11a488eef0283a4284bc2", + "s390x": "sha256:0cf160e720a8e4f20883b72276a6eaded83b79539f3f1d39e35a3336154b9960", + "amd64": "sha256:c6348fa86ba0fb2108c9334f5fe913ddc6d853313e655891f133a0127c30099f", + "ppc64le": "sha256:b144fc0e06537d07956cde340b878a81a717e394edb736d3110858a12a6635cb", + } + + // syft --from source tag -> stereoscope OCI source used to prepare the local fixture + sources := map[string]image.Source{ + "oci-dir": image.OciDirectorySource, + "oci-archive": image.OciTarballSource, + } + + for from, imageSource := range sources { + t.Run(from, func(t *testing.T) { + localPath := imagetest.PrepareMultiplatformFixtureImage(t, imageSource, remoteImage) + for _, arch := range []string{"amd64", "arm64", "s390x", "ppc64le"} { + t.Run(fmt.Sprintf("linux/%s", arch), func(t *testing.T) { + platform, err := image.NewPlatform("linux/" + arch) + require.NoError(t, err) + + src, err := syft.GetSource( + context.Background(), + localPath, + syft.DefaultGetSourceConfig().WithSources(from).WithPlatform(platform), + ) + require.NoError(t, err) + t.Cleanup(func() { + require.NoError(t, src.Close()) + }) + + meta, ok := src.Describe().Metadata.(source.ImageMetadata) + require.True(t, ok, "expected image metadata, got %T", src.Describe().Metadata) + + // The raw config of the selected image must match the requested platform... + assertConfigPlatform(t, meta.RawConfig, "linux", arch) + // ...and it must be the exact per-platform image from the multi-platform index. + assert.Equal(t, expectedDigest[arch], meta.ID) + }) + } + }) + } +} + +// TestMultiPlatformOCIImageSelection_UnavailablePlatform verifies that requesting a platform not present +// in the multi-platform OCI image results in an error rather than silently selecting the wrong image. +func TestMultiPlatformOCIImageSelection_UnavailablePlatform(t *testing.T) { + remoteImage := "docker.io/library/busybox:1.38.0" + + // windows/amd64 is not present in this linux-only multi-platform image + platform, err := image.NewPlatform("windows/amd64") + require.NoError(t, err) + + sources := map[string]image.Source{ + "oci-dir": image.OciDirectorySource, + "oci-archive": image.OciTarballSource, + } + + for from, imageSource := range sources { + t.Run(from, func(t *testing.T) { + localPath := imagetest.PrepareMultiplatformFixtureImage(t, imageSource, remoteImage) + + _, err := syft.GetSource( + context.Background(), + localPath, + syft.DefaultGetSourceConfig().WithSources(from).WithPlatform(platform), + ) + require.ErrorContains(t, err, "windows/amd64") + }) + } +} + +// TestMultiPlatformOCIImageSelection_DefaultPlatform verifies that not specifying a platform results +// in the current platform being selected. +func TestMultiPlatformOCIImageSelection_DefaultPlatform(t *testing.T) { + remoteImage := "docker.io/library/busybox:1.38.0" + + sources := map[string]image.Source{ + "oci-dir": image.OciDirectorySource, + "oci-archive": image.OciTarballSource, + } + + for from, imageSource := range sources { + t.Run(from, func(t *testing.T) { + localPath := imagetest.PrepareMultiplatformFixtureImage(t, imageSource, remoteImage) + + src, err := syft.GetSource( + context.Background(), + localPath, + syft.DefaultGetSourceConfig().WithSources(from), + ) + require.NoError(t, err) + t.Cleanup(func() { + require.NoError(t, src.Close()) + }) + + meta, ok := src.Describe().Metadata.(source.ImageMetadata) + require.True(t, ok, "expected image metadata, got %T", src.Describe().Metadata) + + // The raw config of the selected image must match the current platform + assertConfigPlatform(t, meta.RawConfig, "linux", runtime.GOARCH) + }) + } +} + +// assertConfigPlatform asserts the os/architecture recorded in a raw OCI image config document. +func assertConfigPlatform(t *testing.T, rawConfig []byte, os, architecture string) { + t.Helper() + require.NotEmpty(t, rawConfig) + + var cfg struct { + OS string `json:"os"` + Architecture string `json:"architecture"` + } + require.NoError(t, json.Unmarshal(rawConfig, &cfg)) + + assert.Equal(t, os, cfg.OS) + assert.Equal(t, architecture, cfg.Architecture) +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/cmd/syft/internal/test/integration/testdata/.gitignore new/syft-1.49.0/cmd/syft/internal/test/integration/testdata/.gitignore --- old/syft-1.48.0/cmd/syft/internal/test/integration/testdata/.gitignore 2026-07-16 16:21:22.000000000 +0200 +++ new/syft-1.49.0/cmd/syft/internal/test/integration/testdata/.gitignore 2026-07-20 20:04:57.000000000 +0200 @@ -7,4 +7,6 @@ !image-pkg-coverage/pkgs/java/*.hpi **/go.sum -!image-go-bin-arch-coverage/go.sum \ No newline at end of file +!image-go-bin-arch-coverage/go.sum + +cache/ \ No newline at end of file diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/go.mod new/syft-1.49.0/go.mod --- old/syft-1.48.0/go.mod 2026-07-16 16:21:22.000000000 +0200 +++ new/syft-1.49.0/go.mod 2026-07-20 20:04:57.000000000 +0200 @@ -18,11 +18,11 @@ github.com/anchore/go-homedir v0.1.1 github.com/anchore/go-logger v0.1.1 github.com/anchore/go-macholibre v0.1.1 - github.com/anchore/go-rpmdb v0.1.0 + github.com/anchore/go-rpmdb v0.2.0 github.com/anchore/go-sync v0.1.1 github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b github.com/anchore/packageurl-go v0.2.0 - github.com/anchore/stereoscope v0.2.2 + github.com/anchore/stereoscope v0.3.0 github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be github.com/aquasecurity/go-pep440-version v0.0.1 github.com/bitnami/go-version v0.0.0-20250131085805-b1f57a8634ef @@ -40,7 +40,7 @@ github.com/elliotchance/phpserialize v1.4.0 github.com/facebookincubator/nvdtools v0.1.5 github.com/github/go-spdx/v2 v2.7.0 - github.com/gkampitakis/go-snaps v0.5.22 + github.com/gkampitakis/go-snaps v0.5.23 github.com/go-git/go-billy/v5 v5.9.0 github.com/go-git/go-git/v5 v5.19.1 github.com/go-test/deep v1.1.1 @@ -93,10 +93,10 @@ go.uber.org/goleak v1.3.0 go.yaml.in/yaml/v3 v3.0.4 golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f - golang.org/x/mod v0.37.0 - golang.org/x/net v0.56.0 + golang.org/x/mod v0.38.0 + golang.org/x/net v0.57.0 golang.org/x/time v0.15.0 - golang.org/x/tools v0.47.0 + golang.org/x/tools v0.48.0 gopkg.in/yaml.v3 v3.0.1 modernc.org/sqlite v1.53.0 ) @@ -171,7 +171,7 @@ github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect github.com/containerd/cgroups/v3 v3.1.3 // indirect github.com/containerd/containerd/api v1.11.1 // indirect - github.com/containerd/containerd/v2 v2.3.2 // indirect + github.com/containerd/containerd/v2 v2.3.3 // indirect github.com/containerd/continuity v0.5.0 // indirect github.com/containerd/errdefs v1.0.0 // indirect github.com/containerd/errdefs/pkg v0.3.0 // indirect @@ -183,7 +183,7 @@ github.com/containerd/typeurl/v2 v2.2.3 // indirect github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect - github.com/docker/cli v29.5.3+incompatible // indirect + github.com/docker/cli v29.6.1+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.5 // indirect github.com/docker/go-connections v0.7.0 // indirect github.com/docker/go-units v0.5.0 // indirect @@ -238,8 +238,8 @@ github.com/mitchellh/reflectwalk v1.0.2 // indirect github.com/moby/docker-image-spec v1.3.1 // indirect github.com/moby/locker v1.0.1 // indirect - github.com/moby/moby/api v1.54.2 // indirect - github.com/moby/moby/client v0.4.1 // indirect + github.com/moby/moby/api v1.55.0 // indirect + github.com/moby/moby/client v0.5.0 // indirect github.com/moby/sys/sequential v0.6.0 // indirect github.com/moby/sys/signal v0.7.1 // indirect github.com/moby/sys/user v0.4.0 // indirect @@ -257,7 +257,7 @@ github.com/opencontainers/image-spec v1.1.1 // indirect github.com/opencontainers/runtime-spec v1.3.0 // indirect github.com/pborman/indent v1.2.1 // indirect - github.com/pelletier/go-toml/v2 v2.3.1 // indirect + github.com/pelletier/go-toml/v2 v2.4.3 // indirect github.com/pierrec/lz4/v4 v4.1.26 // indirect github.com/piprate/json-gold v0.7.0 // indirect github.com/pjbgf/sha1cd v0.6.0 // indirect @@ -309,12 +309,12 @@ go.opentelemetry.io/otel/trace v1.43.0 // indirect go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect - golang.org/x/crypto v0.53.0 // indirect + golang.org/x/crypto v0.54.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect - golang.org/x/sync v0.21.0 // indirect - golang.org/x/sys v0.46.0 // indirect - golang.org/x/term v0.44.0 // indirect - golang.org/x/text v0.38.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/term v0.45.0 // indirect + golang.org/x/text v0.40.0 // indirect golang.org/x/xerrors v0.0.0-20231012003039-104605ab7028 // indirect gonum.org/v1/gonum v0.17.0 // indirect google.golang.org/api v0.271.0 // indirect diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/go.sum new/syft-1.49.0/go.sum --- old/syft-1.48.0/go.sum 2026-07-16 16:21:22.000000000 +0200 +++ new/syft-1.49.0/go.sum 2026-07-20 20:04:57.000000000 +0200 @@ -136,8 +136,8 @@ github.com/anchore/go-lzo v0.1.1/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk= github.com/anchore/go-macholibre v0.1.1 h1:sTBHi3S1WVIOCamc6NyT8Sn9mBmD30DCTfjfVm4k6/M= github.com/anchore/go-macholibre v0.1.1/go.mod h1:YNq2610RlvGCK0Za+Klz/OCMtUaEnwwAGA/VfUAQaro= -github.com/anchore/go-rpmdb v0.1.0 h1:Q8dc208/HYzCqhx0L1zurfm1UPil24hlo9NjkdFmLdE= -github.com/anchore/go-rpmdb v0.1.0/go.mod h1:eQVa6QFGzKy0qMcnW2pez0XBczvgwSjw9vA23qifEyU= +github.com/anchore/go-rpmdb v0.2.0 h1:ixcyMg/guhBL9XjBVwhTv9CG48xO07Qkg2uDX2+zx/c= +github.com/anchore/go-rpmdb v0.2.0/go.mod h1:ATsRlpCXstnoYfzqBfhwGw0U2dolx1BBQ9rAU8jWBAw= github.com/anchore/go-struct-converter v0.2.0-rc2 h1:q+859fW2/jbHJHB2etbNfRlFwYpknyvbqqk1hUdamQ4= github.com/anchore/go-struct-converter v0.2.0-rc2/go.mod h1:cDBA5vhcR62nXWo8QH9/Kk2807o65ISaHPNPX66L+Uw= github.com/anchore/go-sync v0.1.1 h1:91SZ+YqUIIHmf2jPAYZPuHqM/ZqnK1pVJDWtET6+AJE= @@ -146,8 +146,8 @@ github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E= github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk= github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE= -github.com/anchore/stereoscope v0.2.2 h1:SGTLGoF6GHmKEn9Bb6LYpzzgz9nhvMZgN/c4fTSQjYY= -github.com/anchore/stereoscope v0.2.2/go.mod h1:ylJXJKebLctP7u9ewguB1d0zUETJxvAA7r2DiuljDTM= +github.com/anchore/stereoscope v0.3.0 h1:6mGGRxm4zRKj/jNiSM7g6XGwWihrnkQRJj11hcULDqY= +github.com/anchore/stereoscope v0.3.0/go.mod h1:QIBWxa5WCrjtBqXH0+RIuECATrffcbaNdMWquZ83+OI= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= @@ -296,8 +296,8 @@ github.com/containerd/cgroups/v3 v3.1.3/go.mod h1:PKZ2AcWmSBsY/tJUVhtS/rluX0b1uq1GmPO1ElCmbOw= github.com/containerd/containerd/api v1.11.1 h1:h8nfoDW9+fNsC/9TwiAHj8B1GzXKtR4eFtkhi/X5RLU= github.com/containerd/containerd/api v1.11.1/go.mod h1:CaQFRu+N1MtbgL6JDOJLUB1hCKESU1lD6MuTJhgtdlw= -github.com/containerd/containerd/v2 v2.3.2 h1:eLven1YxRMkeiKu7IcMrPKE+gn8sGR1DqHbbshMEvWM= -github.com/containerd/containerd/v2 v2.3.2/go.mod h1:rHKGm3VW6wNrINb3x8mNT+w7qYXFVElTt/8HTuxVhD4= +github.com/containerd/containerd/v2 v2.3.3 h1:MUNBVVBTBpPll7KPh5GTvkC3cfG03PQLAHVdsUoue9k= +github.com/containerd/containerd/v2 v2.3.3/go.mod h1:rHKGm3VW6wNrINb3x8mNT+w7qYXFVElTt/8HTuxVhD4= github.com/containerd/continuity v0.5.0 h1:7a85HZpCSs+1Zps0Ee3DPSuAWY+0SJM1JNM51nlEVDg= github.com/containerd/continuity v0.5.0/go.mod h1:/lNJvtJKUQStBzpVQ1+rasXO1LAWtUQssk28EZvJ3nE= github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI= @@ -339,8 +339,8 @@ github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c= github.com/djherbis/times v1.6.0/go.mod h1:gOHeRAz2h+VJNZ5Gmc/o7iD9k4wW7NMVqieYCY99oc0= -github.com/docker/cli v29.5.3+incompatible h1:nbEFfz774vBwQ5KRYv7c/AghjReqnGISvrRhzjV0evs= -github.com/docker/cli v29.5.3+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= +github.com/docker/cli v29.6.1+incompatible h1:oO7F4nn3Ovr/5TlfTUWFbMwBSS/B7Xs6Epv26gBrUP8= +github.com/docker/cli v29.6.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8= github.com/docker/docker-credential-helpers v0.9.5 h1:EFNN8DHvaiK8zVqFA2DT6BjXE0GzfLOZ38ggPTKePkY= github.com/docker/docker-credential-helpers v0.9.5/go.mod h1:v1S+hepowrQXITkEfw6o4+BMbGot02wiKpzWhGUZK6c= github.com/docker/go-connections v0.7.0 h1:6SsRfJddP22WMrCkj19x9WKjEDTB+ahsdiGYf0mN39c= @@ -410,8 +410,8 @@ github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= github.com/gkampitakis/ciinfo v0.3.4 h1:5eBSibVuSMbb/H6Elc0IIEFbkzCJi3lm94n0+U7Z0KY= github.com/gkampitakis/ciinfo v0.3.4/go.mod h1:1NIwaOcFChN4fa/B0hEBdAb6npDlFL8Bwx4dfRLRqAo= -github.com/gkampitakis/go-snaps v0.5.22 h1:xg9omphRnbDnimMCl1KqznC4krlxOGpkB0vDSfX2P7M= -github.com/gkampitakis/go-snaps v0.5.22/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM= +github.com/gkampitakis/go-snaps v0.5.23 h1:okh5QR48zpUjpWtu65AtqxdCY8huJq+dEDuUzd1PuKg= +github.com/gkampitakis/go-snaps v0.5.23/go.mod h1:uy3lVzCCRRsAwYqSocyw5fY8xRLCYEfqoOJNxr8HonM= github.com/glebarez/go-sqlite v1.20.3 h1:89BkqGOXR9oRmG58ZrzgoY/Fhy5x0M+/WV48U5zVrZ4= github.com/glebarez/go-sqlite v1.20.3/go.mod h1:u3N6D/wftiAzIOJtZl6BmedqxmmkDfH3q+ihjqxC9u0= github.com/gliderlabs/ssh v0.3.8 h1:a4YXD1V7xMF9g5nTkdfnja3Sxy1PVDCj1Zg4Wb8vY6c= @@ -723,10 +723,10 @@ github.com/moby/docker-image-spec v1.3.1/go.mod h1:eKmb5VW8vQEh/BAr2yvVNvuiJuY6UIocYsFu/DxxRpo= github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg= github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc= -github.com/moby/moby/api v1.54.2 h1:wiat9QAhnDQjA7wk1kh/TqHz2I1uUA7M7t9SAl/JNXg= -github.com/moby/moby/api v1.54.2/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= -github.com/moby/moby/client v0.4.1 h1:DMQgisVoMkmMs7fp3ROSdiBnoAu8+vo3GggFl06M/wY= -github.com/moby/moby/client v0.4.1/go.mod h1:z52C9O2POPOsnxZAy//WtKcQ32P+jT/NGeXu/7nfjGQ= +github.com/moby/moby/api v1.55.0 h1:2/sexvQyqIWS8pRSCFddBfpW2qE7vR7FCL+vN8pxwMc= +github.com/moby/moby/api v1.55.0/go.mod h1:+RQ6wluLwtYaTd1WnPLykIDPekkuyD/ROWQClE83pzs= +github.com/moby/moby/client v0.5.0 h1:5XhyPk2fuOWf6RlSFa3MkIIgDZkF25xToXW8Q/BH7cc= +github.com/moby/moby/client v0.5.0/go.mod h1:rcVpF8ncl9vo5gaIBdol6CnbEtSj1uxMvEV/UrykF/s= github.com/moby/sys/mountinfo v0.7.2 h1:1shs6aH5s4o5H2zQLn796ADW1wMrIwHsyJ2v9KouLrg= github.com/moby/sys/mountinfo v0.7.2/go.mod h1:1YOa8w8Ih7uW0wALDUgT1dTTSBrZ+HiBLGws92L2RU4= github.com/moby/sys/sequential v0.6.0 h1:qrx7XFUd/5DxtqcoH1h438hF5TmOvzC/lspjy7zgvCU= @@ -786,8 +786,8 @@ github.com/pelletier/go-toml v1.9.4/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c= github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8= github.com/pelletier/go-toml v1.9.5/go.mod h1:u1nR/EPcESfeI/szUZKdtJ0xRNbUoANCkoOuaOx1Y+c= -github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc= -github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= +github.com/pelletier/go-toml/v2 v2.4.3 h1:GTRvJQutkOSftxIFD5xw9aepkYNuPWmVJpffdDPYVpY= +github.com/pelletier/go-toml/v2 v2.4.3/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY= github.com/pierrec/lz4/v4 v4.1.26 h1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY= github.com/pierrec/lz4/v4 v4.1.26/go.mod h1:EoQMVJgeeEOMsCqCzqFm2O0cJvljX2nGZjcRIPL34O4= github.com/piprate/json-gold v0.7.0 h1:bEMirgA5y8Z2loTQfxyIFfY+EflxH1CTP6r/KIlcJNw= @@ -1040,8 +1040,8 @@ golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.53.0 h1:QZ4Muo8THX6CizN2vPPd5fBGHyogrdK9fG4wLPFUsto= -golang.org/x/crypto v0.53.0/go.mod h1:DNLU434OwVakk9PzuwV8w62mAJpRJL3vsgcfp4Qnsio= +golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= +golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190306152737-a1d7652674e8/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190510132918-efd6b22b2522/go.mod h1:ZjyILWgesfNpC6sMxTJOJm9Kp84zZh5NQWvqDGG3Qr8= @@ -1081,8 +1081,8 @@ golang.org/x/mod v0.4.2/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= golang.org/x/mod v0.5.0/go.mod h1:5OXOZSfqPIIbmVBIIKWRFfZjPR0E5r58TLhUjH0a2Ro= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= -golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ= -golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0= +golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= +golang.org/x/mod v0.38.0/go.mod h1:V6Xz0pq8TQ3dGqVQ1FVHuelZpAL0uNhSkk9ogYP3c40= golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= golang.org/x/net v0.0.0-20181023162649-9b4f9f5ad519/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4= @@ -1127,8 +1127,8 @@ golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.56.0 h1:Rw8j/hFzGvJUZwNBXnAtf5sVDVt+65SK2C7IxCxZt5o= -golang.org/x/net v0.56.0/go.mod h1:D3Ku6r+V6JROoZK144D2XfMHFcMq/0zSfLelVTCFKec= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/oauth2 v0.0.0-20190226205417-e64efc72b421/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= golang.org/x/oauth2 v0.0.0-20190604053449-0f29369cfe45/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw= @@ -1160,8 +1160,8 @@ golang.org/x/sync v0.0.0-20201207232520-09787c993a3a/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= -golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM= -golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20180823144017-11551d06cbcc/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= golang.org/x/sys v0.0.0-20180905080454-ebe1bf3edb33/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= @@ -1236,13 +1236,13 @@ golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.46.0 h1:noSf2Fq6F8DBgS+LysIkx7rIExoNHJsxOAtPp4rthXw= -golang.org/x/sys v0.46.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8= golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k= -golang.org/x/term v0.44.0 h1:0rLvDRCtNj0gZkyIXhCyOb2OAzEhLVqc4B+hrsBhrmc= -golang.org/x/term v0.44.0/go.mod h1:7ze4MdzUzLXpSAoFP1H0bOI9aXDqveSvatT5vKcFh2Y= +golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.1-0.20180807135948-17ff2d5776d2/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= @@ -1253,8 +1253,8 @@ golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= golang.org/x/text v0.7.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8= -golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE= -golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4= +golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs= +golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY= golang.org/x/time v0.0.0-20181108054448-85acf8d2951c/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20190308202827-9d24e82272b4/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= golang.org/x/time v0.0.0-20191024005414-555d28b269f0/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= @@ -1315,8 +1315,8 @@ golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.5/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= -golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q= -golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA= +golang.org/x/tools v0.48.0 h1:3+hClM1aLL5mjMKm5ovokw9epgRXPuu2tILgismM6RE= +golang.org/x/tools v0.48.0/go.mod h1:08xX0orndb/F7jJxGDicx061tyd5pcMto75YMAXr6lk= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/syft/pkg/cataloger/golang/parse_go_mod.go new/syft-1.49.0/syft/pkg/cataloger/golang/parse_go_mod.go --- old/syft-1.48.0/syft/pkg/cataloger/golang/parse_go_mod.go 2026-07-16 16:21:22.000000000 +0200 +++ new/syft-1.49.0/syft/pkg/cataloger/golang/parse_go_mod.go 2026-07-20 20:04:57.000000000 +0200 @@ -72,7 +72,7 @@ // only use go.mod packages NOT found in source analysis goModPackages := c.createGoModPackages(ctx, resolver, modFile, sourceModules, reader, digests) - c.applyReplaceDirectives(ctx, resolver, modFile, goModPackages, reader, digests) + c.applyReplaceDirectives(ctx, resolver, modFile, sourceModules, goModPackages, reader, digests) c.applyExcludeDirectives(modFile, goModPackages) pkgs = c.assembleResults(catalogedModules, goModPackages) @@ -365,8 +365,11 @@ } // applyReplaceDirectives processes replace directives from go.mod -func (c *goModCataloger) applyReplaceDirectives(ctx context.Context, resolver file.Resolver, modFile *modfile.File, goModPackages map[string]pkg.Package, reader file.LocationReadCloser, digests map[string]string) { +func (c *goModCataloger) applyReplaceDirectives(ctx context.Context, resolver file.Resolver, modFile *modfile.File, sourceModules map[string]*packages.Module, goModPackages map[string]pkg.Package, reader file.LocationReadCloser, digests map[string]string) { for _, m := range modFile.Replace { + if sourceModules != nil && sourceModules[m.Old.Path] != nil { + continue + } lics := c.licenseResolver.getLicenses(ctx, resolver, m.New.Path, m.New.Version) var finalPath string if !strings.HasPrefix(m.New.Path, ".") && !strings.HasPrefix(m.New.Path, "/") { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/syft/pkg/cataloger/golang/parse_go_mod_replace_test.go new/syft-1.49.0/syft/pkg/cataloger/golang/parse_go_mod_replace_test.go --- old/syft-1.48.0/syft/pkg/cataloger/golang/parse_go_mod_replace_test.go 1970-01-01 01:00:00.000000000 +0100 +++ new/syft-1.49.0/syft/pkg/cataloger/golang/parse_go_mod_replace_test.go 2026-07-20 20:04:57.000000000 +0200 @@ -0,0 +1,44 @@ +package golang + +import ( + "os" + "path/filepath" + "testing" + + "github.com/stretchr/testify/require" + + stereofile "github.com/anchore/stereoscope/pkg/file" + "github.com/anchore/syft/syft/file" + "github.com/anchore/syft/syft/pkg/cataloger/internal/pkgtest" + "github.com/anchore/syft/syft/source" + "github.com/anchore/syft/syft/source/directorysource" +) + +func Test_parseGoSource_replacedModulesAreNotDuplicated(t *testing.T) { + fixture := filepath.Join("testdata", "go-source-replacements") + s, err := directorysource.NewFromPath(fixture) + require.NoError(t, err) + resolver, err := s.FileResolver(source.AllLayersScope) + require.NoError(t, err) + + modPath, err := filepath.Abs(filepath.Join(fixture, "go.mod")) + require.NoError(t, err) + contents, err := os.Open(modPath) + require.NoError(t, err) + t.Cleanup(func() { require.NoError(t, contents.Close()) }) + + reader := file.LocationReadCloser{ + Location: file.NewVirtualLocationFromDirectory("go.mod", "go.mod", *stereofile.NewFileReference(stereofile.Path(modPath))), + ReadCloser: contents, + } + config := DefaultCatalogerConfig().WithUsePackagesLib(true).WithSearchRemoteLicenses(false) + pkgs, _, err := newGoModCataloger(config).parseGoModFile(pkgtest.Context(t), resolver, nil, reader) + require.NoError(t, err) + + versions := make(map[string][]string) + for _, p := range pkgs { + versions[p.Name] = append(versions[p.Name], p.Version) + } + require.Equal(t, []string{"v1.5.2"}, versions["rsc.io/quote"]) + require.Equal(t, []string{"v1.3.1"}, versions["rsc.io/sampler"]) +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.mod new/syft-1.49.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.mod --- old/syft-1.48.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.mod 1970-01-01 01:00:00.000000000 +0100 +++ new/syft-1.49.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.mod 2026-07-20 20:04:57.000000000 +0200 @@ -0,0 +1,15 @@ +module example.com/repro + +go 1.23 + +require rsc.io/quote v1.5.1 + +require ( + golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c // indirect + rsc.io/sampler v1.3.0 // indirect +) + +replace ( + rsc.io/quote => rsc.io/quote v1.5.2 + rsc.io/sampler => rsc.io/sampler v1.3.1 +) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.sum new/syft-1.49.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.sum --- old/syft-1.48.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.sum 1970-01-01 01:00:00.000000000 +0100 +++ new/syft-1.49.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/go.sum 2026-07-20 20:04:57.000000000 +0200 @@ -0,0 +1,6 @@ +golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c h1:qgOY6WgZOaTkIIMiVjBQcw93ERBE4m30iBm00nkL0i8= +golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= +rsc.io/quote v1.5.2 h1:w5fcysjrx7yqtD/aO+QwRjYZOKnaM9Uh2b40tElTs3Y= +rsc.io/quote v1.5.2/go.mod h1:LzX7hefJvL54yjefDEDHNONDjII0t9xZLPXsUe+TKr0= +rsc.io/sampler v1.3.1 h1:F0c3J2nQCdk9ODsNhU3sElnvPIxM/xV1c/qZuAeZmac= +rsc.io/sampler v1.3.1/go.mod h1:T1hPZKmBbMNahiBKFy5HrXp6adAjACjK9JXDnKaTXpA= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/main.go new/syft-1.49.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/main.go --- old/syft-1.48.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/main.go 1970-01-01 01:00:00.000000000 +0100 +++ new/syft-1.49.0/syft/pkg/cataloger/golang/testdata/go-source-replacements/main.go 2026-07-20 20:04:57.000000000 +0200 @@ -0,0 +1,11 @@ +package main + +import ( + "fmt" + + "rsc.io/quote" +) + +func main() { + fmt.Println(quote.Hello()) +} diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/syft-1.48.0/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json new/syft-1.49.0/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json --- old/syft-1.48.0/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json 2026-07-16 16:21:22.000000000 +0200 +++ new/syft-1.49.0/syft/pkg/cataloger/internal/cpegenerate/dictionary/data/cpe-index.json 2026-07-20 20:04:57.000000000 +0200 @@ -7,6 +7,9 @@ "chainguard.dev/apko": [ "cpe:2.3:a:chainguard:apko:*:*:*:*:*:go:*:*" ], + "github.com/Azure/go-ntlmssp": [ + "cpe:2.3:a:microsoft:go-ntlmssp:*:*:*:*:*:go:*:*" + ], "github.com/ClickHouse/ch-go": [ "cpe:2.3:a:clickhouse:ch:*:*:*:*:*:go:*:*" ], @@ -223,6 +226,9 @@ "github.com/xddxdd/bird-lg-go": [ "cpe:2.3:a:xddxdd:bird-lg-go:*:*:*:*:*:go:*:*" ], + "github.com/xuri/excelize/v2": [ + "cpe:2.3:a:excelize:excelize:*:*:*:*:*:go:*:*" + ], "github.com/yuin/goldmark": [ "cpe:2.3:a:yuin:goldmark:*:*:*:*:*:go:*:*" ], @@ -2349,6 +2355,9 @@ "@apollosproject/data-connector-rock": [ "cpe:2.3:a:apollosapp:data-connector-rock:*:*:*:*:*:node.js:*:*" ], + "@appium/base-driver": [ + "cpe:2.3:a:appium:appium\\/base-driver:*:*:*:*:*:node.js:*:*" + ], "@appium/support": [ "cpe:2.3:a:appium:appium\\/support:*:*:*:*:*:node.js:*:*" ], @@ -2616,6 +2625,9 @@ "@octokit/webhooks": [ "cpe:2.3:a:octokit:webhooks:*:*:*:*:*:node.js:*:*" ], + "@openclaw/feishu": [ + "cpe:2.3:a:openclaw:openclaw\\/feishu:*:*:*:*:*:node.js:*:*" + ], "@openclaw/voice-call": [ "cpe:2.3:a:openclaw:openclaw\\/voice-call:*:*:*:*:*:node.js:*:*" ], @@ -3086,6 +3098,9 @@ "cli": [ "cpe:2.3:a:cli_project:cli:*:*:*:*:*:node.js:*:*" ], + "client-certificate-auth": [ + "cpe:2.3:a:tgies:client-certificate-auth:*:*:*:*:*:node.js:*:*" + ], "closure-compiler-stream": [ "cpe:2.3:a:closure-compiler-stream_project:closure-compiler-stream:*:*:*:*:*:node.js:*:*" ], @@ -5752,6 +5767,9 @@ "ssrf-agent": [ "cpe:2.3:a:ssrf-agent_project:ssrf-agent:*:*:*:*:*:node.js:*:*" ], + "ssrfcheck": [ + "cpe:2.3:a:felippe-regazio:ssrf_check:*:*:*:*:*:node.js:*:*" + ], "ssri": [ "cpe:2.3:a:ssri_project:ssri:*:*:*:*:*:node.js:*:*" ], @@ -6978,6 +6996,9 @@ "sqlparse": [ "cpe:2.3:a:sqlparse_project:sqlparse:*:*:*:*:*:python:*:*" ], + "stanza": [ + "cpe:2.3:a:stanford:stanza:*:*:*:*:*:python:*:*" + ], "starlette": [ "cpe:2.3:a:encode:starlette:*:*:*:*:*:python:*:*" ], @@ -7690,6 +7711,12 @@ "bzip2": [ "cpe:2.3:a:bzip2_project:bzip2:*:*:*:*:*:rust:*:*" ], + "c2pa": [ + "cpe:2.3:a:adobe:c2pa:*:*:*:*:*:rust:*:*" + ], + "c2patool": [ + "cpe:2.3:a:adobe:c2patool:*:*:*:*:*:*:*:*" + ], "cache": [ "cpe:2.3:a:cache_project:cache:*:*:*:*:*:rust:*:*" ], @@ -9175,7 +9202,8 @@ "cpe:2.3:a:article_directory_project:article_directory:*:*:*:*:*:wordpress:*:*" ], "article-directory-redux": [ - "cpe:2.3:a:icontrolwp:article_directory_redux:*:*:*:*:*:wordpress:*:*" + "cpe:2.3:a:icontrolwp:article_directory_redux:*:*:*:*:*:wordpress:*:*", + "cpe:2.3:a:icontrolwp:icontrolwp:*:*:*:*:*:wordpress:*:*" ], "article2pdf": [ "cpe:2.3:a:article2pdf_project:article2pdf:*:*:*:*:*:wordpress:*:*" @@ -13831,6 +13859,9 @@ "ibtana-visual-editor": [ "cpe:2.3:a:vowelweb:ibtana:*:*:*:*:*:wordpress:*:*" ], + "ibuildapp": [ + "cpe:2.3:a:ibuildapp:ibuildapp:*:*:*:*:*:wordpress:*:*" + ], "icegram": [ "cpe:2.3:a:icegram:icegram_engage:*:*:*:*:*:wordpress:*:*" ], @@ -15508,7 +15539,7 @@ "cpe:2.3:a:motor_racing_league_project:motor_racing_league:*:*:*:*:*:wordpress:*:*" ], "motors-car-dealership-classified-listings": [ - "cpe:2.3:a:stylemixthemes:motors_-_car_dealer\\,_classifieds_\\\u0026_listing:*:*:*:*:*:wordpress:*:*" + "cpe:2.3:a:stylemixthemes:motors_-_car_dealer\\,_classifieds_\\\u0026_listing:*:*:*:*:starter:wordpress:*:*" ], "mousewheel-smooth-scroll": [ "cpe:2.3:a:mousewheel_smooth_scroll_project:mousewheel_smooth_scroll:*:*:*:*:*:wordpress:*:*" ++++++ syft.obsinfo ++++++ --- /var/tmp/diff_new_pack.odguv9/_old 2026-07-22 19:08:01.447056076 +0200 +++ /var/tmp/diff_new_pack.odguv9/_new 2026-07-22 19:08:01.455056350 +0200 @@ -1,5 +1,5 @@ name: syft -version: 1.48.0 -mtime: 1784211682 -commit: 3e2bc6ed095f7ec1a415fb38cfe1c319e95dfed6 +version: 1.49.0 +mtime: 1784570697 +commit: 29fd7d0dec81cf03e0a1194a1985c7c893bb2396 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/syft/vendor.tar.gz /work/SRC/openSUSE:Factory/.syft.new.24530/vendor.tar.gz differ: char 13, line 1
