Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package syft for openSUSE:Factory checked in at 2026-07-29 18:59:54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/syft (Old) and /work/SRC/openSUSE:Factory/.syft.new.2004 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "syft" Wed Jul 29 18:59:54 2026 rev:130 rq:1368305 version:1.50.0 Changes: -------- --- /work/SRC/openSUSE:Factory/syft/syft.changes 2026-07-22 19:07:53.586786913 +0200 +++ /work/SRC/openSUSE:Factory/.syft.new.2004/syft.changes 2026-07-29 19:01:07.153514628 +0200 @@ -1,0 +2,48 @@ +Wed Jul 29 05:06:47 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 1.50.0: + * Added Features + - Add bun binary classifier [PR #5103 @rezmoss] + * Bug Fixes + - Fix Cargo PURLs for local workspace packages [PR #5105 + @3nesdeniz] + - Decode golang symbols [PR #5089 @wagoodman] + - CPE vendor field incorrectly includes publisher URL for SUSE + RPM packages [Issue #5073] [PR #5081 @Eljees] + - apk-db-cataloger silently drops the entire APK catalog when + one installed-DB field exceeds 64 KB [Issue #5094] [PR #5100 + @cyphercodes] + * Additional Changes + - package-lock.json v1: nested dependencies entries are never + cataloged (flat top-level iteration only) [Issue #5101] [PR + #5108 @Eljees] + - consider vendored golang packages in module attribution [PR + #5093 @kzantow] + - Fix inverted bounds check dropping every Erlang string with a + backslash [PR #5110 @arpitjain099] + * Dependencies + 14 dependency changes (14 updated). 1 vulnerability remediated. + - Remediated (1) + - GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc + - Updated (14 packages) + - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp + v1.31.0 → v1.32.0 + - github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58 + - github.com/envoyproxy/go-control-plane/envoy v1.36.0 → + v1.37.0 + - github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3 + - github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0 + - go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0 + - google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → + v0.0.0-afd174a + - google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → + v0.0.0-afd174a + - google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated + GHSA-hrxh-6v49-42gf) + - modernc.org/cc/v4 v4.28.4 → v4.29.0 + - modernc.org/ccgo/v4 v4.34.4 → v4.34.6 + - modernc.org/gc/v3 v3.1.3 → v3.1.4 + - modernc.org/libc v1.73.4 → v1.74.1 + - modernc.org/sqlite v1.53.0 → v1.54.0 + +------------------------------------------------------------------- Old: ---- syft-1.49.0.obscpio New: ---- syft-1.50.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ syft.spec ++++++ --- /var/tmp/diff_new_pack.NSjg7G/_old 2026-07-29 19:01:10.725637831 +0200 +++ /var/tmp/diff_new_pack.NSjg7G/_new 2026-07-29 19:01:10.745638522 +0200 @@ -17,7 +17,7 @@ Name: syft -Version: 1.49.0 +Version: 1.50.0 Release: 0 Summary: CLI tool and library for generating a Software Bill of Materials License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.NSjg7G/_old 2026-07-29 19:01:10.973646386 +0200 +++ /var/tmp/diff_new_pack.NSjg7G/_new 2026-07-29 19:01:11.005647490 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/syft.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.49.0</param> + <param name="revision">refs/tags/v1.50.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.NSjg7G/_old 2026-07-29 19:01:11.177653422 +0200 +++ /var/tmp/diff_new_pack.NSjg7G/_new 2026-07-29 19:01:11.189653836 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/syft</param> <param name="changesrevision">b15c5dbfe2bb21c9d73002c1056a829c8c411c75</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/syft.git</param> - <param name="changesrevision">29fd7d0dec81cf03e0a1194a1985c7c893bb2396</param></service></servicedata> + <param name="changesrevision">16223e6dd7893fe578787658ceb876257483d404</param></service></servicedata> (No newline at EOF) ++++++ syft-1.49.0.obscpio -> syft-1.50.0.obscpio ++++++ ++++ 1685 lines of diff (skipped) ++++++ syft.obsinfo ++++++ --- /var/tmp/diff_new_pack.NSjg7G/_old 2026-07-29 19:01:18.517906589 +0200 +++ /var/tmp/diff_new_pack.NSjg7G/_new 2026-07-29 19:01:18.521906728 +0200 @@ -1,5 +1,5 @@ name: syft -version: 1.49.0 -mtime: 1784570697 -commit: 29fd7d0dec81cf03e0a1194a1985c7c893bb2396 +version: 1.50.0 +mtime: 1785180049 +commit: 16223e6dd7893fe578787658ceb876257483d404 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/syft/vendor.tar.gz /work/SRC/openSUSE:Factory/.syft.new.2004/vendor.tar.gz differ: char 15, line 1
