Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grype for openSUSE:Factory checked in at 2026-11-05 18:21:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grype (Old) and /work/SRC/openSUSE:Factory/.grype.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grype" Thu Nov 5 18:21:08 2026 rev:133 rq:1395119 version:0.121.1 Changes: -------- --- /work/SRC/openSUSE:Factory/grype/grype.changes 2026-10-20 12:43:33.038617523 +0200 +++ /work/SRC/openSUSE:Factory/.grype.new.3759290/grype.changes 2026-11-05 18:22:46.123833977 +0100 @@ -1,0 +2,87 @@ +Wed Nov 04 08:50:04 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.121.1: + * Bug Fixes + - extract the quality gate debug artifact outside the checkout + [PR #3875] + - incorrect constraint for versionless purls in openvex [PR + #3874] + - report additional version-range records for a package [PR + #3782] + - report a package's vulnerability as added or removed only + when its affected record set changes [PR #3784] + - report the lowest overlapping AlmaLinux fix [PR #3783] + - report fix date and kind changes under the package [PR #3781] + - label db diff databases in the order they were provided [PR + #3816] + - time out stalled db diff downloads [PR #3858] + - only remove db diff directories that grype created [PR #3828] + - make db diff --packages and --vulns include only what was + requested [PR #3815] + * Performance + - index ignore rules by vulnerability ID [PR #3817] + - speed up db diff and reduce its memory and temp disk use [PR + #3813] + * Additional Changes + - grype 0.119.0 allocates without bound on a CycloneDX + machine-learning-model component with no purl and no CPE + [Issue #3767] + - add a directory for grype-specific match labels [PR #3849] + - let go-make own the go version and move images to debian13 + [PR #3840] + * Dependencies + 41 dependency changes (39 updated, 1 added, 1 removed). 1 + vulnerability remediated. + - Remediated (1) + - GHSA-mgcc-cww5-fp2q (High) — github.com/go-jose/go-jose/v4 + - Updated (39 packages) + - github.com/Microsoft/go-winio v0.6.3-0.ad3df93 → + v0.6.3-0.f19d971 + - github.com/ProtonMail/go-crypto v1.4.1 → v1.5.2 + - github.com/anchore/clio v0.1.1 → v0.1.2 + - github.com/anchore/stereoscope v0.3.4 → v0.4.0 + - github.com/anchore/syft v1.55.0 → v1.56.0 + - github.com/bmatcuk/doublestar/v4 v4.10.2 → v4.10.3 + - github.com/containerd/containerd/v2 v2.4.1 → v2.4.2 + - github.com/containerd/stargz-snapshotter/estargz + v0.18.2 → v0.19.0 + - github.com/deitch/magic v0.0.0-c67ab88 → v1.0.0 + - github.com/docker/cli v29.8.2+incompatible → + v29.9.2+incompatible + - github.com/docker/docker-credential-helpers v0.9.8 → + v0.9.10 + - github.com/docker/go-connections v0.8.1 → v0.8.2 + - github.com/gabriel-vasile/mimetype v1.4.15 → v1.4.16 + - github.com/github/go-spdx/v2 v2.7.1 → v2.8.0 + - github.com/gkampitakis/go-snaps v0.5.23 → v0.5.24 + - github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 + (remediated GHSA-mgcc-cww5-fp2q) + - github.com/go-test/deep v1.1.1 → v1.1.2 + - github.com/google/pprof v0.0.0-ef3492d → v0.0.0-1facf8f + - github.com/gookit/color v1.6.2 → v1.6.3 + - github.com/gpustack/gguf-parser-go v0.26.4 → v0.27.0 + - github.com/klauspost/compress v1.20.1 → v1.20.3 + - github.com/klauspost/pgzip v1.2.6 → v1.2.7 + - github.com/mattn/go-runewidth v0.0.27 → v0.0.31 + - github.com/mattn/go-sqlite3 v1.14.48 → v1.14.52 + - github.com/moby/moby/api v1.56.0 → v1.56.1 + - github.com/moby/moby/client v0.6.0 → v0.6.2 + - github.com/ncruces/go-strftime v1.0.0 → v1.1.0 + - github.com/sigstore/fulcio v1.8.7 → v1.8.8 + - github.com/vbauerster/cupwriter v0.0.4 → v0.0.5 + - github.com/vbauerster/mpb/v8 v8.14.0 → v8.16.2 + - go.podman.io/image/v5 v5.41.2 → v5.42.0 + - go.podman.io/storage v1.64.1 → v1.65.0 + - golang.org/x/mod v0.41.0 → v0.42.0 + - golang.org/x/tools v0.51.0 → v0.52.0 + - modernc.org/cc/v4 v4.29.7 → v4.30.3 + - modernc.org/ccgo/v4 v4.36.1 → v4.37.0 + - modernc.org/gc/v3 v3.1.5 → v3.2.0 + - modernc.org/libc v1.77.1 → v1.79.0 + - modernc.org/sqlite v1.60.1 → v1.61.0 + - Added (1 package) + - github.com/varlink/go v0.4.1-0.c935be0 + - Removed (1 package) + - github.com/becheran/wildmatch-go v1.0.0 + +------------------------------------------------------------------- Old: ---- grype-0.121.0.obscpio New: ---- grype-0.121.1.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grype.spec ++++++ --- /var/tmp/diff_new_pack.KoL6bT/_old 2026-11-05 18:22:48.360927194 +0100 +++ /var/tmp/diff_new_pack.KoL6bT/_new 2026-11-05 18:22:48.362927277 +0100 @@ -17,7 +17,7 @@ Name: grype -Version: 0.121.0 +Version: 0.121.1 Release: 0 Summary: A vulnerability scanner for container images and filesystems License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.KoL6bT/_old 2026-11-05 18:22:48.403928986 +0100 +++ /var/tmp/diff_new_pack.KoL6bT/_new 2026-11-05 18:22:48.407929152 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/grype.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.121.0</param> + <param name="revision">refs/tags/v0.121.1</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.KoL6bT/_old 2026-11-05 18:22:48.437930403 +0100 +++ /var/tmp/diff_new_pack.KoL6bT/_new 2026-11-05 18:22:48.442930611 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/grype</param> <param name="changesrevision">fa8b7e2a528cf1f8b098123f256c61db9e5df69c</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/grype.git</param> - <param name="changesrevision">afe2742527d98d822da06c9f32eed86fe3d193e0</param></service></servicedata> + <param name="changesrevision">b99e19b96962b1190ad1bd5685acc74f420c1014</param></service></servicedata> (No newline at EOF) ++++++ grype-0.121.0.obscpio -> grype-0.121.1.obscpio ++++++ ++++ 154193 lines of diff (skipped) ++++++ grype.obsinfo ++++++ --- /var/tmp/diff_new_pack.KoL6bT/_old 2026-11-05 18:22:50.983036454 +0100 +++ /var/tmp/diff_new_pack.KoL6bT/_new 2026-11-05 18:22:50.989036704 +0100 @@ -1,5 +1,5 @@ name: grype -version: 0.121.0 -mtime: 1792438632 -commit: afe2742527d98d822da06c9f32eed86fe3d193e0 +version: 0.121.1 +mtime: 1793639329 +commit: b99e19b96962b1190ad1bd5685acc74f420c1014 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/grype/vendor.tar.gz /work/SRC/openSUSE:Factory/.grype.new.3759290/vendor.tar.gz differ: char 53, line 1
