Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package syft for openSUSE:Factory checked in at 2026-11-06 19:56:34 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/syft (Old) and /work/SRC/openSUSE:Factory/.syft.new.3759290 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "syft" Fri Nov 6 19:56:34 2026 rev:137 rq:1395670 version:1.56.0 Changes: -------- --- /work/SRC/openSUSE:Factory/syft/syft.changes 2026-10-23 20:33:02.371495480 +0200 +++ /work/SRC/openSUSE:Factory/.syft.new.3759290/syft.changes 2026-11-06 20:02:15.248003766 +0100 @@ -1,0 +2,80 @@ +Tue Nov 3 09:37:11 UTC 2026 - Andrea Manzini <[email protected]> + +- Update to version 1.56.0 (boo#1288290, boo#1288425): + * Added Features + - tighten source-distribution external refs [PR #5493] + - output source PURL as external reference [PR #5246] + - Full cataloging of archive contents [Issue #246] [PR #5260] + * Bug Fixes + - hash each file once in the file digest cataloger [PR #5491] + - Support envoy binary various versions [Issue #5470] [PR + #5476] + - Support istio binary various versions [Issue #5060] [PR + #5121] + - CPE identifiers contain a wildcard in the CPE part field for + packages discovered by the Bitnami cataloger [Issue #5123] + [PR #5127] + * Additional Changes + - Gradle lockfile comment line is catalogued as a package + [Issue #5371] [PR #5372] + - use correct error variable in package load [PR #4983] + - let go-make own the go version [PR #5464] + - preserve semver build metadata in ffmpeg version [PR #5452] + * Dependencies + 40 dependency changes (38 updated, 1 added, 1 removed). 1 + vulnerability remediated. + - Remediated (1) + - GHSA-mgcc-cww5-fp2q (High) — github.com/go-jose/go-jose/v4 + CVE-2026-116585, CVE-2026-116586, CVE-2026-116587 + (boo#1288290) + - Updated (38 packages) + - github.com/Microsoft/go-winio v0.6.3-0.ad3df93 → + v0.6.3-0.f19d971 + - github.com/ProtonMail/go-crypto v1.4.1 → v1.5.2 + - github.com/anchore/clio v0.1.1 → v0.1.2 + - github.com/anchore/stereoscope v0.3.4 → v0.4.0 + - github.com/bmatcuk/doublestar/v4 v4.10.2 → v4.10.3 + - github.com/containerd/containerd/v2 v2.4.1 → v2.4.2 + - github.com/containerd/stargz-snapshotter/estargz v0.18.2 → + v0.19.0 + - github.com/deitch/magic v0.0.0-1ff89d7 → v1.0.0 + - github.com/docker/cli v29.8.2+incompatible → + v29.9.2+incompatible + - github.com/docker/docker-credential-helpers v0.9.8 → + v0.9.10 + - github.com/docker/go-connections v0.8.1 → v0.8.2 + - github.com/gabriel-vasile/mimetype v1.4.15 → v1.4.16 + - github.com/github/go-spdx/v2 v2.7.1 → v2.8.0 + - github.com/gkampitakis/go-snaps v0.5.23 → v0.5.24 + - github.com/go-jose/go-jose/v4 v4.1.5 → v4.1.6 + (remediated GHSA-mgcc-cww5-fp2q) + - github.com/go-test/deep v1.1.1 → v1.1.2 + - github.com/google/pprof v0.0.0-ef3492d → v0.0.0-1facf8f + - github.com/gookit/color v1.6.2 → v1.6.3 + - github.com/gpustack/gguf-parser-go v0.26.4 → v0.27.0 + - github.com/klauspost/compress v1.20.1 → v1.20.3 + CVE-2026-116591 (boo#1288425) + - github.com/klauspost/pgzip v1.2.6 → v1.2.7 + - github.com/mattn/go-runewidth v0.0.27 → v0.0.31 + - github.com/mattn/go-sqlite3 v1.14.48 → v1.14.52 + - github.com/moby/moby/api v1.56.0 → v1.56.1 + - github.com/moby/moby/client v0.6.0 → v0.6.2 + - github.com/ncruces/go-strftime v1.0.0 → v1.1.0 + - github.com/sigstore/fulcio v1.8.7 → v1.8.8 + - github.com/vbauerster/cupwriter v0.0.4 → v0.0.5 + - github.com/vbauerster/mpb/v8 v8.14.0 → v8.16.2 + - go.podman.io/image/v5 v5.41.2 → v5.42.0 + - go.podman.io/storage v1.64.1 → v1.65.0 + - golang.org/x/mod v0.41.0 → v0.42.0 + - golang.org/x/tools v0.51.0 → v0.52.0 + - modernc.org/cc/v4 v4.29.7 → v4.30.3 + - modernc.org/ccgo/v4 v4.36.1 → v4.37.0 + - modernc.org/gc/v3 v3.1.5 → v3.2.0 + - modernc.org/libc v1.77.1 → v1.79.0 + - modernc.org/sqlite v1.60.1 → v1.61.0 + - Added (1 package) + - github.com/varlink/go v0.4.1-0.c935be0 + - Removed (1 package) + - github.com/becheran/wildmatch-go v1.0.0 + +------------------------------------------------------------------- Old: ---- syft-1.55.0.obscpio New: ---- syft-1.56.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ syft.spec ++++++ --- /var/tmp/diff_new_pack.N0BEed/_old 2026-11-06 20:02:18.658146575 +0100 +++ /var/tmp/diff_new_pack.N0BEed/_new 2026-11-06 20:02:18.660146659 +0100 @@ -17,7 +17,7 @@ Name: syft -Version: 1.55.0 +Version: 1.56.0 Release: 0 Summary: CLI tool and library for generating a Software Bill of Materials License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.N0BEed/_old 2026-11-06 20:02:18.723149297 +0100 +++ /var/tmp/diff_new_pack.N0BEed/_new 2026-11-06 20:02:18.729149549 +0100 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/syft.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v1.55.0</param> + <param name="revision">refs/tags/v1.56.0</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> <param name="changesgenerate">enable</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.N0BEed/_old 2026-11-06 20:02:18.783151810 +0100 +++ /var/tmp/diff_new_pack.N0BEed/_new 2026-11-06 20:02:18.792152187 +0100 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/syft</param> <param name="changesrevision">b15c5dbfe2bb21c9d73002c1056a829c8c411c75</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/syft.git</param> - <param name="changesrevision">f15c3343e29dfb20cf6d82c820e7090b49808c96</param></service></servicedata> + <param name="changesrevision">173055c39e9752f7b450ea404cd1801695277426</param></service></servicedata> (No newline at EOF) ++++++ syft-1.55.0.obscpio -> syft-1.56.0.obscpio ++++++ ++++ 25441 lines of diff (skipped) ++++++ syft.obsinfo ++++++ --- /var/tmp/diff_new_pack.N0BEed/_old 2026-11-06 20:02:23.104332772 +0100 +++ /var/tmp/diff_new_pack.N0BEed/_new 2026-11-06 20:02:23.114333191 +0100 @@ -1,5 +1,5 @@ name: syft -version: 1.55.0 -mtime: 1792435243 -commit: f15c3343e29dfb20cf6d82c820e7090b49808c96 +version: 1.56.0 +mtime: 1793637025 +commit: 173055c39e9752f7b450ea404cd1801695277426 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/syft/vendor.tar.gz /work/SRC/openSUSE:Factory/.syft.new.3759290/vendor.tar.gz differ: char 13, line 1
