chore: update dependencies

[renovate]

ℹ️ Note

This PR body was truncated due to platform limits.

Update Request | Renovate Bot

This PR contains the following updates:

Package	Type	Update	Change	Age	Adoption	Passing	Confidence
actions/stale	action	digest	9971854 → d6f8a33
cgr.dev/chainguard/wolfi-base		digest	0c79f2e → 17ab070
cloudflare/cloudflared		patch	2026.1.1 → 2026.1.2
fosrl/newt		minor	1.8.1 → 1.9.0
git://git.kernel.org/pub/scm/utils/mdadm/mdadm.git		minor	4.4 → 4.5
github.com/anchore/grype	indirect	minor	v0.0.0-00010101000000-000000000000 → v0.107.0
github.com/anchore/syft	indirect	minor	v1.28.0 → v1.41.1
github.com/dsseng/grype	replace	digest	2197792 → 9b7e8e2
github.com/dsseng/syft	replace	minor	v1.26.2-0.20250703101014-f39c35d156d9 → v1.38.0
github.com/gomodule/redigo	replace	major	v0.0.0-20150301180006-535138d7bcd7 → v1.9.3
golang.org/x/sys	require	minor	v0.39.0 → v0.40.0
google/gvisor		patch	20260112.0 → 20260126.0
https://sourceware.org/git/glibc.git		minor	2.41 → 2.43
kata-containers/kata-containers		minor	3.25.0 → 3.26.0
netbirdio/netbird		patch	0.64.0 → 0.64.3
nvidia/libnvidia-container		patch	v1.18.1 → v1.18.2
nvidia/nvidia-container-toolkit		patch	v1.18.1 → v1.18.2
tailscale/tailscale		minor	1.92.5 → 1.94.1

---

Release Notes

cloudflare/cloudflared (cloudflare/cloudflared)

v2026.1.2

Compare Source

SHA256 Checksums:

cloudflared-amd64.pkg: 28ecdb34b07c91235f8137ec237fbc7719769d61d0b27c914d7a64ae260b741c
cloudflared-arm64.pkg: c6ccb0fc705119aad26c2b5eecabb4f4291e9fd873e44d3a9a5f4bc7c0ce9e7e
cloudflared-darwin-amd64.tgz: f7726beb912ad3314e11f95719f8b303502e8e4932b810732ba9ef2330bd0848
cloudflared-darwin-arm64.tgz: f450d90e86129dac1fab1f35ee185eb02b0e23bef3e3dcfb0ce45c48fad70390
cloudflared-fips-linux-amd64: 83ac976273b2f0771b60eb64369fd06e9265da761db0838ebfffa072925a80d0
cloudflared-fips-linux-amd64.deb: 793ce66164581faa62033123ff1cb3118fa8d7ebc82bb84d1afc220107e742e1
cloudflared-fips-linux-x86_64.rpm: b94be3a341ca2773445c63eb54ed65606a077126f43cf30ca234de413ac82414
cloudflared-linux-386: 66329c02d81ef6d52c71b1661651cf92c97a1e961ab880090989c0926ba67e8b
cloudflared-linux-386.deb: 32567f268fd360891e88f2910274076a2afe43cd5971607e37d1370df98d11af
cloudflared-linux-386.rpm: 02e4a3a9448f096b7c6b7c0e22120817a9bbf666de12fb0a5e0ec311d6c6eab4
cloudflared-linux-aarch64.rpm: dbdf6eed4e6b5f0c0f6311da77e34d0457d63d0aa558e9ede9462167de40c129
cloudflared-linux-amd64: e157c54e929cc289cbd53860453168c2fe3439eb55e2e965a56579252585d9c1
cloudflared-linux-amd64.deb: 590f7a62da4f734f31443ad60f2660dad65f44c7fb4027748bb761e655b1175e
cloudflared-linux-arm: 1196bd9b5a3f8c6cc62fc1c63a7562b9c05e886478d1a51f3310087e755daca7
cloudflared-linux-arm.deb: 379e1af6091d848a5fbf1ab4dc6176944aa3855eb7211e7c65dec209e20686dd
cloudflared-linux-arm.rpm: c246430a6c7145700d5a5b18603940bd97d8a7c6dd206d256c64c5fa1dbcb3a8
cloudflared-linux-arm64: 1362498b9975e018f290cc4412af61391cca65cccbc06f2d8b128324ae9a18ef
cloudflared-linux-arm64.deb: d10604452d59f2fdbb9dd46f318f04cbe8c9625aef3385dfa89561301d97a7aa
cloudflared-linux-armhf: fa87d89b508df9c9c8fde33eb0732571f996399739cbdb9a85b13213a9c67fb3
cloudflared-linux-armhf.deb: 41c694016f0539e02a126fd2c0b9243bbb37da303830298d0c8e84d3b46d6a33
cloudflared-linux-armhf.rpm: d2ec1d9befbbddecbe81572cf69737cb9328b44f99fd18d928fc74b9999736d0
cloudflared-linux-x86_64.rpm: e0289e640172c231ff5038828e394a7ac0c4b1050ff9399d380a9eedaf045afd
cloudflared-windows-386.exe: cd3f6f71df1c5172ea42b2ee5cb9f681485b83194237e8cd9e342f19320ac8bc
cloudflared-windows-386.msi: aa51605301cbc4e7b269c0651b718310e3380babe9fcaf7870781992f6d96871
cloudflared-windows-amd64.exe: 6304f5e1c017c038fb74a02c0157b2b63d4bc1f15709c639fcc08cb6dbe4c126
cloudflared-windows-amd64.msi: 2d65df33b77caaa297cfabb68e29252ddb39ab12d0945ecbd16822414d935dc1

fosrl/newt (fosrl/newt)

v1.9.0

Compare Source

Container Images

• GHCR: ghcr.io/fosrl/newt@sha256:22edec551d81c500a9a3c790a41cd8f7eada3b47ba0a31a187c80d61318e4cc6
• Docker Hub: docker.io/fosrl/newt@sha256:22edec551d81c500a9a3c790a41cd8f7eada3b47ba0a31a187c80d61318e4cc6
  Digest: sha256:22edec551d81c500a9a3c790a41cd8f7eada3b47ba0a31a187c80d61318e4cc6

What's Changed

• Support olm low power mode in sub packages
• Support iOS and Android clients with rebind suppor

Full Changelog: fosrl/newt@1.8.1...1.9.0

anchore/grype (github.com/anchore/grype)

v0.107.0

Compare Source

Added Features

• Add secureos distro [#​3086 @​divolgin]
• add hex matcher for Erlang/Elixir ecosystem [#​3194 @​willmurphyscode]

Bug Fixes

• disable version fallback in EOL query [#​3195 @​willmurphyscode]
• VEX documents with docker.io registry reference not matching, require index.docker.io instead [#​2818 #​3172 @​jainlakshya]

(Full Changelog)

v0.106.0

Compare Source

Added Features

• warn about packages from EOL distros [#​3171 @​willmurphyscode]
• make it configurable what grype assumes when incoming package to grype is missing dpkg/RPM epoch [#​2964 #​2976 @​willmurphyscode]

Bug Fixes

• RHEL EUS: --only-fixed should filter out matches are not fixed in the current EUS version [#​2847 #​3181 @​willmurphyscode]

Additional Changes

• support scientific linux [#​3175 @​westonsteimel]

(Full Changelog)

v0.105.0

Compare Source

Added Features

• Add archlinux matcher to grype [#​3154 @​willmurphyscode]

(Full Changelog)

v0.104.4

Compare Source

Bug Fixes

• preserve local version segment in constraints for PEP 440 comparison [#​3146 @​willmurphyscode]

Additional Changes

• correct help text for return code for fail-on severity option [#​3138 @​u-ways]

(Full Changelog)

v0.104.3

Compare Source

Bug Fixes

• Use specifier matching rules when comparing python versions [#​3121 @​wagoodman]

(Full Changelog)

v0.104.2

Compare Source

Bug Fixes

• Since version 0.104.0 shaded jars are not reported [#​3098]
• db search fails with misleading message (out of memory) when no db is present [#​3049 #​3077 @​JvD-Ericsson]

Additional Changes

• replace os.Chdir with t.Chdir in test code [#​3067 @​joonas]

(Full Changelog)

v0.104.1

Compare Source

Bug Fixes

• Redact during file output [#​3068 @​kzantow]
• Unaffected match table does not filter results if CPE matching is enabled [#​3056 #​3066 @​kzantow]

Additional Changes

• Migrate grype to use mholt/archives instead of anchore fork [#​3036 @​joonas]

(Full Changelog)

v0.104.0

Compare Source

Added Features

• Add --from flag [#​3035 @​wagoodman]
• Let a suppression expire to prevent that one will forget to resolve a vulnerability [#​3031]

Bug Fixes

• Unnormalized fix version triggers false-positive in mssql-jdbc [#​3042 #​3034 @​jamestexas]

Additional Changes

• junit template use CDATA block to prevent XML parse errors [#​3019 @​nvtkaszpir]
• Keep nested loggers labeled [#​3040 @​wagoodman]

(Full Changelog)

v0.103.0

Compare Source

Added Features

• Allow hyphen in version string [#​3021 @​willmurphyscode]
• Respect rpmmod PURL qualifier [#​3020 @​willmurphyscode]

(Full Changelog)

v0.102.0

Compare Source

Added Features

• Use Alma Linux specific advisories for Alma Linux scans [#​2745 #​2939 @​willmurphyscode]

Bug Fixes

• Bitnami packages with CPEs are not matched against CPE-based vulnerabilities [#​2997]

Additional Changes

• add markdown template [#​2987 @​sebdanielsson]

(Full Changelog)

v0.101.1

Compare Source

Bug Fixes

• Panic error scanning images with v0.101.0 on some java dependencies [#​3002]

(Full Changelog)

v0.101.0

Compare Source

Added Features

• Add cyclonedx to RpmMetadata [#​2935 @​sfc-gh-rmaj]
• grype db search can filter by fixed state [#​2968 @​willmurphyscode]
• Support using VEX documents with directory scans and SBOMs [#​2471 #​2811 @​alegrey91]

Bug Fixes

• Issue installing Grype using documented curl command [#​2985]
• Advisory ID blank in JSON output [#​2965]

Additional Changes

• update flags with v3 to not use default config [#​3000 @​spiffcs]
• fix Cosign documentation URL in installer [#​2995 @​lime]
• set advisory id again [#​2979 @​willmurphyscode]
• add db schema validation [#​2962 @​willmurphyscode]

(Full Changelog)

v0.100.0

Compare Source

Added Features

• Add unaffected package and CPE stores [#​2888 @​wagoodman]
• use unaffected match table to remove appropriate vulns [#​2886 @​CrosleyZack]

(Full Changelog)

v0.99.1

Compare Source

Bug Fixes

• Present fix available version in grype JSON output [#​2905 @​wagoodman]
• detect patch numbers in fuzzy version comparison [#​2844 @​willmurphyscode]
• Make timestamp in output configurable (so that results are more reproducible) [#​522 #​2724 @​gabetrau]
• Grype .98 misidentifies the container package version [#​2884]

(Full Changelog)

v0.99.0

Compare Source

Added Features

• Add fix availability information to DB schema [#​2862 @​wagoodman]
• Add support vulnerability matching for raspbian [#​2893 @​westonsteimel]
• Add Vex CSAF support [#​1826 @​juan131]

Bug Fixes

• include channel in grype db search output [#​2873 @​willmurphyscode]
• add UnmarshalJSON to fix availability blob [#​2889 @​willmurphyscode]
• Grype misdetect Grafana version [#​2783]

Breaking Changes

• CSAF support [#​1826 @​juan131]

(Full Changelog)

v0.98.0

Compare Source

Added Features

• move debian 13 (trixie) to released and debian 14 (forky) to testing/sid/unstable [#​2861 @​westonsteimel]

(Full Changelog)

v0.97.2

Compare Source

Grype v0.97.2

Added Features

• new syft version adds binary classifier for hashicorp vault [#​4121 @​willmurphyscode]

Bug Fixes

• fix: update syft's nondeterministic Java archive purl and improve groupID for better matching [#​3521 #​4118 @​kzantow]

(Full Changelog)

v0.97.1

Compare Source

Bug Fixes

• Multiple EUS advisories where only some are fixed result in unexpected vulnerabilities [#​2840 #​2841 @​kzantow]

(Full Changelog)

v0.97.0

Compare Source

Added Features

• Add support for RHEL EUS [#​2446 #​2787 @​wagoodman]

Bug Fixes

• Error scanning snap "unsupported source: source.SnapMetadata" [#​2819 #​2821 @​kzantow]

Additional Changes

• add channel to os / distro [#​2782 @​wagoodman]

(Full Changelog)

v0.96.1

Compare Source

Syft Improvments

• Update to latest version of syft v1.29.0

Performance Improvements

• Create ignore regex objects conditionally[#​2805 @​wagoodman ]

(Full Changelog)

v0.96.0

Compare Source

Added Features

• Added the EPSS score and KEV indications as CycloneDX vulnerabilities.ratings entries [#​2695 #​2765 @​AlinaPodoba]

Bug Fixes

• The go run and go install broken due to useless redirect directive in go.mod [#​2777 #​2780 @​stefanb]
• EPSS implementation using percentile instead of percent probability [#​2778 #​2785 @​wagoodman]
• Latest version of grype with V6 schema lists incorrect URL for v6 database [#​2513]

Additional Changes

• Add more detail around cataloging and DB load log statements [#​2779 @​wagoodman]
• add version set and combined constraint [#​2763 @​wagoodman]
• add v6 OS store [#​2766 @​wagoodman]

(Full Changelog)

v0.95.0

Compare Source

Added Features

• Add string severity to db search json results [#​2730 @​wagoodman]
• Add package specifier overrides for kb, dpkg, and apkg [#​2742 @​westonsteimel]

Bug Fixes

• show related NVD records for non-NVD matches [#​2755 @​kzantow]
• assume that a vulnerability with no ranges is always vulnerable [#​2759 @​wagoodman]
• DB should hydrate for when the client has new features [#​2758 @​wagoodman]
• show relationship back to NVD for all CVE ids [#​2756 @​westonsteimel]
• properly escape CPE segments [#​2731 @​kzantow]
• msrc matcher should search by package ecosystem, not by distro [#​2748 @​westonsteimel]
• Grype does not report any vulnerabilities for CPEs with target_sw field set to value that does not correspond to known package type [#​2768 #​2772 @​willmurphyscode]
• malformed CPE in grype db search output [#​2767 #​2769 @​westonsteimel]
• vex documents from the --vex flag do get processed or applied to the output correctly [#​1836 #​2741 @​willmurphyscode]

Additional Changes

• replace deprecated GoReleaser configurations [#​2729 @​emmanuel-ferdman]
• specify types for all match details [#​2762 @​wagoodman]
• Refactor the version package [#​2735 @​wagoodman]

(Full Changelog)

v0.94.0

Compare Source

Added Features

• Add echo os to grype [#​2647 @​orizerah]

Bug Fixes

• Nonroot can't load local docker image with docker socket bind [#​2721 #​2723 @​kzantow]
• "Harden Container Runtime with Non-Root User" breaks --output usage [#​2720 #​2723 @​kzantow]

(Full Changelog)

v0.93.0

Compare Source

Added Features

• Add support for MinimOS [#​2627 @​Daniel-Wachter]
• Use the upstream Bitmani vulndb data for matching [#​1609 #​2538 @​juan131]
• Support rubygems specific version comparision [#​2646 #​2712 @​willmurphyscode]

Bug Fixes

• Harden Container Runtime with Non-Root User [#​2716 @​wagoodman]
• valid cpes in db search output [#​2706 @​westonsteimel]
• Always show results with json output for db search commands [#​2692 @​wagoodman]
• False positive: CVE-2025-5702 reported with High severity on glibc 2.34 (wrong severity and affected version) [#​2718]

(Full Changelog)

v0.92.2

Compare Source

Bug Fixes

• unpin dockerfile base images to prevent wget TLS errors [#​2671 @​spiffcs]
• Parse java group ID and artifact ID from PURL when missing [#​2675 @​wagoodman]
• Grype can't update DB in docker volume (regression) [#​2517 #​2672 @​willmurphyscode]

Additional Changes

• Remove getDB() from the v6 DB reader [#​2669 @​wagoodman]

(Full Changelog)

v0.92.1

Compare Source

(Full Changelog)

v0.92.0

Compare Source

Added Features

• improve html template [#​2635 @​OnceUponALoop]
• Add EPSS metrics to grype results [#​1973 #​2587 @​wagoodman]
• Show indication of known exploited vulnerabilities (from CISA) [#​1511 #​2587 @​wagoodman]

Bug Fixes

• adjust namespace translation logic to be v5 compatible [#​2634 @​westonsteimel]
• fall back to fuzzy constraint units [#​2651 @​willmurphyscode]
• adjust version prefix check when excluding overlapping packages [#​2653 @​westonsteimel]
• Dropping group from npm package names leads to false positives [#​2554 #​2645 @​kzantow]
• Potential regression in CVE detection from 0.87.0 (v5 schema) to 0.88.0 (v6 schema) for go-module detection [#​2642]
• Removal of temporary files not working on Windows [#​2233 #​2657 @​popey]
• @​jridgewell/gen-mapping incorrectly attributed GHSA-8rmg-jf7p-4p22 [#​1886 #​2645 @​kzantow]
• Vulnerability reported on @​group/name dependency when actual vulnerability exists on name dependency [#​1701 #​2645 @​kzantow]
• Grype false negatives in versions v0.88.0 and later leading to missed critical vulnerabilities [#​2628 #​2645 @​kzantow]
• PHP pecl redis mixes with redis project itself and creates false positive cve [#​1804]
• False Positive: Openssl CVE-2022-2068, CVE-2022-1292, CVE-2021-3711 in SUSE Enterprise 15 SP5 [#​1729]
• Grype does not handle purl file input with packages from different distributions [#​2630 #​2639 @​chovanecadam]
• grype pkg:golang/k8s.io/ingress-nginx@​v1.11.2 does not show cve [#​2580 #​2586 @​goatwu1993]

(Full Changelog)

v0.91.2

Compare Source

Bug Fixes

• Various false positives starting with 0.91.1 [#​2618 #​2621 @​willmurphyscode]

(Full Changelog)

v0.91.1

Compare Source

Bug Fixes

• Assume that empty versions should match on all possible versions [#​2591 @​wagoodman]
• Fix severity field in db search vuln [#​2589 @​wagoodman]
• Recover from panic within a matcher [#​2590 @​wagoodman]
• Should only check maven central if pom info is missing [#​2216 #​2547 @​tdunlap607]
• grype db search GHSA-mrrh-fwg8-r2c3 doesn't return results [#​2530]
• Grype stopped reporting vulnerabilities after upgrade [#​2608 #​2610 @​willmurphyscode]
• Grype does not handle cache-dir containing ~ correctly [#​2599 #​2600 @​kzantow]
• Grype should expand ~ in paths in config file [#​2024 #​2600 @​kzantow]
• False Positive: Multiple old CVEs in chromium 134.0.6998.117 for apk ecosystem [#​2581]
• Missing grype DB update from 2025041 [#​2593]
• Does not fill in the Level field of the SARIF result object [#​2511 #​2571 @​bdovaz]

Additional Changes

• add timing info to log output [#​2597 @​kzantow]
• Replace os.ReadDir with afero.ReadDir for consistency [#​2579 @​joe-ton]

(Full Changelog)

v0.91.0

Compare Source

Added Features

• Add v5 namespace emulation to db search output [#​2539 @​wagoodman]
• Add CVSS metrics in search JSON output [#​2568 @​wagoodman]
• Exit with a different return code for a failed scan [#​1922]

Bug Fixes

• Use data driven approach when detecting Alpine:edge and Debian:sid [#​2556 @​wagoodman]
• db list should render out full URLs for text format [#​2553 @​wagoodman]
• grype db import fails since v0.88 and above [#​2542 #​2546 @​kzantow]

(Full Changelog)

v0.90.0

Compare Source

Added Features

• Match vulnerabilities by distro name when no version specified [#​2521 #​2534 @​kzantow]
• Allow DB import from a URL [#​2134 #​2532 @​wagoodman]
• Add the DB url to the JSON descriptor block [#​356 #​2529 @​wagoodman]

(Full Changelog)

v0.89.1

Compare Source

Bug Fixes

• Ensure fatal error from maven search bubbles up [#​2518 @​luhring]
• Source URLs missing/broken in output with latest release [#​2520 #​2523 @​kzantow]
• Grype results set a vulnerability as its own related vulnerability [#​2514 #​2515 @​kzantow]

(Full Changelog)

v0.89.0

Compare Source

[!IMPORTANT]
As of Grype v0.88.0, the listing file which hosts the URLs of databases to download has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.

Added Features

• Show suggested fixed version when there are multiple listed [#​2264 #​2271 @​tomersein]

Bug Fixes

• Check for vulnerability database update failed with unsupported protocol scheme when referencing local file [#​2507 #​2508 @​wagoodman]

(Full Changelog)

v0.88.0

Compare Source

[!IMPORTANT]
With #​2126 the listing file which hosts the URLs of databases to download has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.

Added Features

• Add KEV information to v6 DB [#​2464 @​wagoodman]
• Add pretty format option [#​2406 @​tomersein]
• Add configuration for maven rate limit functionality [#​2397 @​rawlingsj]
• Allow specifying literal CPEs via the CLI [#​2463 @​wagoodman]
• Add KEV & EPSS to db search schema [#​2481 @​wagoodman]
• Update vulnerability matchers to use v6 DB schema [#​2132 #​2311 @​kzantow]
• Configure and use new V6 DB distribution URLs [#​2126 #​2439 @​kzantow]

Bug Fixes

• fix golang 1.24 versions when not semver compliant [#​2486 @​xnox]
• error out on maven search rate limiting [#​2460 @​luhring]
• CPE search failed when considering target software for unknown package type [#​2434 #​2438 @​westonsteimel]
• Grype Does Not Clean TMPDIR When Running in a Docker Container [#​2500]
• GetMavenPackageBySha can be rate limited by maven central, grype will silently fail which results in inconsistent scan results [#​2383]
• Grype exits with error on JSON output with PURL input [#​2360]
• Removal of temporary files not working on Windows [#​2233 #​2439 @​kzantow]
• grype db status reports "valid" when the DB is missing [#​2077 #​2439 @​kzantow]
• grype db status doesn't always check the db's checksum and validity [#​1648 #​2439 @​kzantow]
• False positive of CVE-2023-45853 on apt zlib1g/now 1:1.2.13.dfsg-1 package [#​2412 #​2474 @​westonsteimel]
• GHSA-93ww-43rr-79v3 / CVE-2024-10039 does not get patched version [#​2408]
• "grype config" output swaps comments for search-indexed-archives / search-unindexed-archives [#​2409 #​2414 @​spiffcs]

Breaking Changes

• Remove DB schema v3 and v4 code [#​2435 @​wagoodman]
• Replace grype db diff with grype db search --modified-after and --published-after flags [#​2129 #​2439 @​kzantow]

Additional Changes

• Refactor presenters to use static model over dynamic lookups [#​2492 @​wagoodman]
• update syft to 1.20 [#​2473 @​kzantow]

(Full Changelog)

v0.87.0

[Compare Source](https://redirect.github.com/anchore/grype/comp