chore(deps): update tools

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Update
github.com/anchore/syft	v1.46.0 → v1.48.0					minor
github.com/sigstore/cosign/v2	v2.6.3 → v2.6.4					patch
istio/istio	1.30.2 → 1.30.3					patch

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.48.0

Compare Source

Added Features

• emit dependency relationships from mix.lock [PR #​4985 @​cgreeno]
• add safe tensor model type to SBOM output [PR #​4844 @​spiffcs]
• Capture golang binary symbols [PR #​4988 @​spiffcs]
• Detect Ubuntu Pro/ESM extended support [PR #​5028 @​wagoodman]
• Add scan duration timer to Syft [Issue #​4587] [PR #​4858 @​ChrisJr404]
• Support for vcpkg [Issue #​2110] [PR #​4081 @​gabetrau]
• Add macOS .app cataloger [Issue #​4010] [PR #​4490 @​rezmoss]
• Add support for Kerberos 5 library cataloging [Issue #​4780] [PR #​4781 @​nadimz]
• Include date of scan in results [Issue #​3910]

Bug Fixes

• use printf instead of echo to fix ANSI color output [PR #​4978 @​Jouini-Mohamed-Chaker]
• Strip peer-dep suffix from deno.lock npm keys [PR #​5055 @​Synvoya]
• Allow more PEP440-compliant characters in python versions [PR #​4964 @​kzantow]
• PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #​4996 @​activeobd]
• Fix panic parsing a rockspec comment that ends at EOF [PR #​5053 @​arpitjain099]
• Fix Debian point release detection [PR #​4997 @​OsamaSE]
• Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #​5041 @​Synvoya]
• npm redis client generates no CPE [Issue #​5011] [PR #​5012 @​rezmoss]
• Debug Docker images are running as nonroot user [Issue #​4113] [PR #​4608 @​spiffcs]
• libxml2 gets the wrong cpe vendor [Issue #​5015] [PR #​5016 @​rezmoss]
• wrong purl for spring-ldap-core dependency [Issue #​4030] [PR #​4908 @​jonasboos]
• Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #​3961] [PR #​4785 @​SAY-5]
• conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #​5017] [PR #​5020 @​jfjrh2014]
• dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #​4514] [PR #​4517 @​rezmoss]
• Go template sprig date functions not defined [Issue #​2372] [PR #​4644 @​sputnik-mac]
• CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #​4720] [PR #​4782 @​SAY-5]

Dependencies

9 dependency changes (8 updated, 1 added).

Updated (8 packages)

• github.com/bmatcuk/doublestar v1.3.1 → v8.8.8
• github.com/klauspost/compress v1.18.6 → v1.19.0
• golang.org/x/tools v0.46.0 → v0.47.0
• modernc.org/cc/v4 v4.28.2 → v4.28.4
• modernc.org/ccgo/v4 v4.34.0 → v4.34.4
• modernc.org/gc/v3 v3.1.2 → v3.1.3
• modernc.org/libc v1.72.3 → v1.73.4
• modernc.org/sqlite v1.51.0 → v1.53.0

Added (1 package)

• howett.net/plist v1.0.1

(Full Changelog)

v1.47.0

Compare Source

sigstore/cosign (github.com/sigstore/cosign/v2)

v2.6.4

Compare Source

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

• 26261f0 Allow attestation download to handle both bundle types (#​4996) (#​5017)
• d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#​5002)

Thanks to all contributors!

istio/istio (istio/istio)

v1.30.3: Istio 1.30.3

Compare Source

Artifacts
Release Notes

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign inteon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment