Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grype for openSUSE:Factory checked in at 2026-11-06 19:57:08 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grype (Old) and /work/SRC/openSUSE:Factory/.grype.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grype" Fri Nov 6 19:57:08 2026 rev:134 rq:1395698 version:0.121.2 Changes: -------- --- /work/SRC/openSUSE:Factory/grype/grype.changes 2026-11-05 18:22:46.123833977 +0100 +++ /work/SRC/openSUSE:Factory/.grype.new.3759290/grype.changes 2026-11-06 20:03:07.385187160 +0100 @@ -1,0 +2,12 @@ +Fri Nov 06 07:44:07 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.121.2: + * Bug Fixes + - deterministic ordering of db search match results [PR #3883] + * Dependencies + 2 dependency changes (2 updated). + - Updated (2 packages) + - github.com/anchore/stereoscope v0.4.0 → v0.4.1 + - github.com/anchore/syft v1.56.0 → v1.57.0 + +------------------------------------------------------------------- Old: ---- grype-0.121.1.obscpio New: ---- grype-0.121.2.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grype.spec ++++++ --- /var/tmp/diff_new_pack.IK96uH/_old 2026-11-06 20:03:10.139302496 +0100 +++ /var/tmp/diff_new_pack.IK96uH/_new 2026-11-06 20:03:10.145302748 +0100 @@ -17,7 +17,7 @@ Name: grype -Version: 0.121.1 +Version: 0.121.2 Release: 0 Summary: A vulnerability scanner for container images and filesystems License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.IK96uH/_old 2026-11-06 20:03:10.220305889 +0100 +++ /var/tmp/diff_new_pack.IK96uH/_new 2026-11-06 20:03:10.228306224 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/grype.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.121.1</param> + <param name="revision">refs/tags/v0.121.2</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.IK96uH/_old 2026-11-06 20:03:10.274308150 +0100 +++ /var/tmp/diff_new_pack.IK96uH/_new 2026-11-06 20:03:10.282308485 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/grype</param> <param name="changesrevision">fa8b7e2a528cf1f8b098123f256c61db9e5df69c</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/grype.git</param> - <param name="changesrevision">b99e19b96962b1190ad1bd5685acc74f420c1014</param></service></servicedata> + <param name="changesrevision">82d7a0ea911946b99343c672056867d372f9b319</param></service></servicedata> (No newline at EOF) ++++++ grype-0.121.1.obscpio -> grype-0.121.2.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.1/cmd/grype/cli/commands/internal/dbsearch/matches.go new/grype-0.121.2/cmd/grype/cli/commands/internal/dbsearch/matches.go --- old/grype-0.121.1/cmd/grype/cli/commands/internal/dbsearch/matches.go 2026-11-02 18:08:49.000000000 +0100 +++ new/grype-0.121.2/cmd/grype/cli/commands/internal/dbsearch/matches.go 2026-11-05 22:02:48.000000000 +0100 @@ -110,8 +110,16 @@ }) } + // the same vulnerability ID can come from multiple providers (and records), so break ties to keep the order stable sort.Slice(rows, func(i, j int) bool { - return rows[i].Vulnerability.ID < rows[j].Vulnerability.ID + a, b := rows[i].Vulnerability, rows[j].Vulnerability + if a.ID != b.ID { + return a.ID < b.ID + } + if a.Provider != b.Provider { + return a.Provider < b.Provider + } + return a.Model.ID < b.Model.ID }) return rows, retErr diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.1/cmd/grype/cli/commands/internal/dbsearch/matches_test.go new/grype-0.121.2/cmd/grype/cli/commands/internal/dbsearch/matches_test.go --- old/grype-0.121.1/cmd/grype/cli/commands/internal/dbsearch/matches_test.go 2026-11-02 18:08:49.000000000 +0100 +++ new/grype-0.121.2/cmd/grype/cli/commands/internal/dbsearch/matches_test.go 2026-11-05 22:02:48.000000000 +0100 @@ -1,6 +1,7 @@ package dbsearch import ( + "fmt" "testing" "github.com/stretchr/testify/assert" @@ -262,6 +263,44 @@ } } +func TestNewMatchesRows_StableOrder(t *testing.T) { + pkg := func(id v6.ID, name, provider string) affectedPackageWithDecorations { + return affectedPackageWithDecorations{ + AffectedPackageHandle: v6.AffectedPackageHandle{ + Vulnerability: &v6.VulnerabilityHandle{ + ID: id, + Name: name, + Provider: &v6.Provider{ID: provider}, + BlobValue: &v6.VulnerabilityBlob{ID: name}, + }, + }, + } + } + input := []affectedPackageWithDecorations{ + pkg(2, "CVE-2024-1234", "ubuntu"), + pkg(4, "CVE-2024-1234", "nvd"), + pkg(1, "CVE-2024-1234", "ubuntu"), + pkg(3, "CVE-2024-0001", "ubuntu"), + } + + // row construction ranges over a map, so repeat to shake out any nondeterminism + for range 50 { + rows, err := newMatchesRows(input, nil) + assert.NoError(t, err) + + var got []string + for _, r := range rows { + got = append(got, fmt.Sprintf("%s/%s/%d", r.Vulnerability.ID, r.Vulnerability.Provider, r.Vulnerability.Model.ID)) + } + assert.Equal(t, []string{ + "CVE-2024-0001/ubuntu/3", + "CVE-2024-1234/nvd/4", + "CVE-2024-1234/ubuntu/1", + "CVE-2024-1234/ubuntu/2", + }, got) + } +} + func makeTestPackages(count int) []affectedPackageWithDecorations { packages := make([]affectedPackageWithDecorations, count) for i := range count { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.1/go.mod new/grype-0.121.2/go.mod --- old/grype-0.121.1/go.mod 2026-11-02 18:08:49.000000000 +0100 +++ new/grype-0.121.2/go.mod 2026-11-05 22:02:48.000000000 +0100 @@ -17,7 +17,7 @@ github.com/anchore/go-logger v0.2.0 github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4 github.com/anchore/packageurl-go v0.2.0 - github.com/anchore/stereoscope v0.4.0 + github.com/anchore/stereoscope v0.4.1 github.com/aquasecurity/go-pep440-version v0.0.1 github.com/araddon/dateparse v0.0.0-20210429162001-6b43995a97de github.com/bitnami/go-version v0.0.0-20250505154626-452e8c5ee607 @@ -78,7 +78,7 @@ ) require ( - github.com/anchore/syft v1.56.0 + github.com/anchore/syft v1.57.0 github.com/bmatcuk/doublestar/v4 v4.10.3 github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.121.1/go.sum new/grype-0.121.2/go.sum --- old/grype-0.121.1/go.sum 2026-11-02 18:08:49.000000000 +0100 +++ new/grype-0.121.2/go.sum 2026-11-05 22:02:48.000000000 +0100 @@ -156,10 +156,10 @@ github.com/anchore/go-version v1.2.2-0.20210903204242-51efa5b487c4/go.mod h1:Bkc+JYWjMCF8OyZ340IMSIi2Ebf3uwByOk6ho4wne1E= github.com/anchore/packageurl-go v0.2.0 h1:CkrM4RMUwrEGAiE1OVlxaZNzWj0TuHRey7o4T/EAErk= github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE= -github.com/anchore/stereoscope v0.4.0 h1:MDL7YFRDaGzhCdjm/s+em1D/X9HwnZMYupfgg+mvqPI= -github.com/anchore/stereoscope v0.4.0/go.mod h1:hYJsi3M8a8N1O66u+rMQSgv5TREGM7QIjKBjPPnwiD8= -github.com/anchore/syft v1.56.0 h1:hpIzQsvlNPCgrz7KJZ79HX59I44yE/AyqTbvO5Q92jM= -github.com/anchore/syft v1.56.0/go.mod h1:xSTo7HeWF/zil0aQOTxwDjGZcN3GjM2X+hkHrMZs0Hk= +github.com/anchore/stereoscope v0.4.1 h1:7mxw24JCabbJIAcyvQDjBd2pbzo+0HSFVgjYlE8Zm+k= +github.com/anchore/stereoscope v0.4.1/go.mod h1:hYJsi3M8a8N1O66u+rMQSgv5TREGM7QIjKBjPPnwiD8= +github.com/anchore/syft v1.57.0 h1:H/UHtf0KbIlD12dXsfklFMjZ2+erj2an3h/jBHoX/zE= +github.com/anchore/syft v1.57.0/go.mod h1:rxIyiyV5/ng1PxfmJBGMKcCcpfnCI/j9laRBTBxv+K0= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= ++++++ grype.obsinfo ++++++ --- /var/tmp/diff_new_pack.IK96uH/_old 2026-11-06 20:03:11.242348690 +0100 +++ /var/tmp/diff_new_pack.IK96uH/_new 2026-11-06 20:03:11.249348983 +0100 @@ -1,5 +1,5 @@ name: grype -version: 0.121.1 -mtime: 1793639329 -commit: b99e19b96962b1190ad1bd5685acc74f420c1014 +version: 0.121.2 +mtime: 1793912568 +commit: 82d7a0ea911946b99343c672056867d372f9b319 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/grype/vendor.tar.gz /work/SRC/openSUSE:Factory/.grype.new.3759290/vendor.tar.gz differ: char 15, line 1
