chore(deps): update module github.com/anchore/grype to v0.79.4

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
github.com/anchore/grype	v0.78.0 -> v0.79.4

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anchore/grype (github.com/anchore/grype)

v0.79.4

Compare Source

Bug Fixes

• Disable ui before run function on db status [#​2008 @​wagoodman]

Additional Changes

• update Syft to v1.10.0 [#​2019 @​anchore-actions-token-generator]

(Full Changelog)

v0.79.3

Compare Source

Bug Fixes

• correct logic checking cpe target software component against package type [#​1658 @​westonsteimel]

Additional Changes

• update Syft to v1.9.0 [#​1986 @​anchore-actions-token-generator]

(Full Changelog)

v0.79.2

Compare Source

Bug Fixes

• use location RealPath not String() for match sorting [#​1950 @​luhring]

(Full Changelog)

v0.79.1

Compare Source

Updates

• update CI to install golang at the latest version [#​1949 @​spiffcs]
• Grype is now built with the latest version of Golang at v1.22.x. This resolves a few security findings that would have been flagged against the v0.79.0 binary for using an older version of the Golang standard library.

(Full Changelog)

v0.79.0

Compare Source

Added Features

• Installation script: Support checksum signature verification [#​1627 #​1670 @​hibare]

Bug Fixes

• fix match sort ordering for different locations [#​1944 @​luhring]
• Sort order for matches should consider fix info [#​1933 @​wagoodman]
• Go main module pseudo version matching: turn off by default [#​1894 @​luhring]
• Inconsistent naming of matchDetails.searchedBy.package field [#​1877 #​1900 @​kzantow]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - "after 8am on Monday" in timezone Etc/UTC, Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

ℹ Artifact update notice

File name: scanner/go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 24 additional dependencies were updated

Details:

Package	Change
github.com/CycloneDX/cyclonedx-go	v0.8.0 -> v0.9.0
github.com/anchore/stereoscope	v0.0.3-0.20240624202600-753b5576fe42 -> v0.0.3-0.20240725180315-50ce3be7aa1f
github.com/anchore/syft	v1.5.0 -> v1.10.0
github.com/BurntSushi/toml	v1.3.2 -> v1.4.0
github.com/adrg/xdg	v0.4.0 -> v0.5.0
github.com/charmbracelet/lipgloss	v0.11.0 -> v0.12.1
github.com/charmbracelet/x/ansi	v0.1.1 -> v0.1.4
github.com/docker/cli	v26.1.4+incompatible -> v27.0.3+incompatible
github.com/docker/docker	v26.1.5+incompatible -> v27.1.1+incompatible
github.com/gabriel-vasile/mimetype	v1.4.4 -> v1.4.5
github.com/github/go-spdx/v2	v2.2.0 -> v2.3.1
github.com/go-test/deep	v1.1.0 -> v1.1.1
github.com/moby/sys/mountinfo	v0.7.1 -> v0.7.2
github.com/pierrec/lz4/v4	v4.1.15 -> v4.1.19
github.com/saferwall/pe	v1.5.3 -> v1.5.4
github.com/spdx/tools-golang	v0.5.4 -> v0.5.5
github.com/sylabs/sif/v2	v2.16.0 -> v2.17.1
github.com/sylabs/squashfs	v0.6.1 -> v1.0.0
github.com/vbatts/go-mtree	v0.5.3 -> v0.5.4
golang.org/x/mod	v0.17.0 -> v0.19.0
golang.org/x/net	v0.26.0 -> v0.27.0
gorm.io/gorm	v1.25.10 -> v1.25.11
modernc.org/libc	v1.49.3 -> v1.55.3
modernc.org/sqlite	v1.29.10 -> v1.31.1

[renovate]

Renovate Ignore Notification

Because you closed this PR without merging, Renovate will ignore this update (v0.79.4). You will get a PR once a newer version is released. To ignore this dependency forever, add it to the ignoreDeps array of your Renovate config.

If you accidentally closed this PR, or if you changed your mind: rename this PR to get a fresh replacement PR.

[paralta]

needs #1951