Skip to content

Bump github.com/anchore/syft from 0.60.3 to 0.62.0#426

Closed
dependabot[bot] wants to merge 1 commit intov2from
dependabot/go_modules/github.com/anchore/syft-0.62.0
Closed

Bump github.com/anchore/syft from 0.60.3 to 0.62.0#426
dependabot[bot] wants to merge 1 commit intov2from
dependabot/go_modules/github.com/anchore/syft-0.62.0

Conversation

@dependabot
Copy link
Copy Markdown
Contributor

@dependabot dependabot Bot commented on behalf of github Nov 21, 2022

Bumps github.com/anchore/syft from 0.60.3 to 0.62.0.

Release notes

Sourced from github.com/anchore/syft's releases.

v0.62.0

Changelog

v0.62.0 (2022-11-18)

Full Changelog

Added Features

Bug Fixes

v0.61.0

Changelog

v0.61.0 (2022-11-18)

Full Changelog

Added Features

Bug Fixes

Commits

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot
Bump github.com/anchore/syft from 0.60.3 to 0.62.0
894a426 
Bumps [github.com/anchore/syft](https://github.com/anchore/syft) from 0.60.3 to 0.62.0.
- [Release notes](https://github.com/anchore/syft/releases)
- [Changelog](https://github.com/anchore/syft/blob/main/.goreleaser.yaml)
- [Commits](anchore/syft@v0.60.3...v0.62.0)

---
updated-dependencies:
- dependency-name: github.com/anchore/syft
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot Bot requested a review from a team as a code owner November 21, 2022 05:02
@paketo-bot paketo-bot added the semver:patch A change requiring a patch version bump label Nov 21, 2022
@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Nov 21, 2022

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot Bot deleted the dependabot/go_modules/github.com/anchore/syft-0.62.0 branch November 21, 2022 14:40
@sophiewigmore sophiewigmore restored the dependabot/go_modules/github.com/anchore/syft-0.62.0 branch November 21, 2022 14:41
@sophiewigmore sophiewigmore reopened this Nov 21, 2022
@sophiewigmore
Copy link
Copy Markdown
Member

sophiewigmore commented Nov 21, 2022

@fg-j one of the failures we're encountering is that the Syft schema version has been bumped to v6.0.0. I can't quite remember - do we need to add new schema versions to sbom_format.go? It's been a minute since I've dealt with a breaking Syft release

@sophiewigmore
Copy link
Copy Markdown
Member

sophiewigmore commented Nov 21, 2022

Specifically this line is failing, because 6.0.0 is the actual schema version in the output SBOM. I'm assuming that the code behaviour is just broken and this should still be 3.0.0 until we add 6.0.0 down the line, but just checking.

@dependabot @github
Copy link
Copy Markdown
Contributor Author

dependabot Bot commented on behalf of github Nov 22, 2022

Superseded by #427.

@dependabot dependabot Bot closed this Nov 22, 2022
@dependabot dependabot Bot deleted the dependabot/go_modules/github.com/anchore/syft-0.62.0 branch November 22, 2022 05:04
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ryanmoran ryanmoran Awaiting requested review from ryanmoran ryanmoran is a code owner automatically assigned from paketo-buildpacks/tooling-maintainers

@robdimsdale robdimsdale Awaiting requested review from robdimsdale robdimsdale is a code owner automatically assigned from paketo-buildpacks/tooling-maintainers

Assignees

No one assigned

Labels

semver:patch A change requiring a patch version bump

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sophiewigmore @paketo-bot