chore(deps): update dependency anchore/syft to v0.105.1

[renovate]

This PR contains the following updates:

Package	Update	Change
anchore/syft	minor	v0.74.0 -> v0.105.1

---

Release Notes

anchore/syft (anchore/syft)

v0.105.1

Compare Source

Bug Fixes

• return error codes from install script [#​2664 @​hacst]
• SPDX tag value version selector [#​2665 @​kzantow]

Additional Changes

• Add syft version used to SBOM tool info by default [#​2647 @​wagoodman]

(Full Changelog)

v0.105.0

Compare Source

Added Features

• Guess go main module version based on binary contents [#​2608 @​wagoodman]
• Catalog wordpress plugins [#​1911 #​2218 @​disc]

Bug Fixes

• ensure version output to stdout [#​2621 @​kzantow]
• Survive indexing dead symlinks [#​2645 @​wagoodman]
• unable to index filesystem for amazonlinux images [#​2627 #​2644 @​wagoodman]
• CycloneDX OS component does not have a bom-ref [#​2101 #​2634 @​kzantow]
• v0.104.0 interface conversion error when creating bom from singularity image [#​2628 #​2631 @​wagoodman]

Additional Changes

• Rename binary cataloger to be more unique [#​2633 @​wagoodman]
• Suppress executable parsing issues [#​2614 @​wagoodman]
• update license list, cpe dictionary [#​2620 @​spiffcs]

(Full Changelog)

v0.104.0

Compare Source

Added Features

• Adding metadata fields when parsing yarn.lock and poetry.lock [#​2350 @​asi-cider]
• Add Erlang OTP Application cataloger [#​2403 @​LaurentGoderre]
• Support Conan lockfiles v0.5 [#​2050]
• Identify security-features-of-interest within binaries [#​2434 #​2443 @​wagoodman]
• Top-level API should be more composable [#​558 #​2517 @​wagoodman]
• Annotate where each CPE on a package is sourced from [#​2282 #​2552 @​willmurphyscode]

Bug Fixes

• unmarshal key values in Java, Go, and Conan metadata [#​2603 @​willmurphyscode]
• incorrect conversion between integer types [#​2605 @​spiffcs]
• prefer portable executable product version when semantically greater than file version [#​2600 @​westonsteimel]
• Stop iterating maps in catalogers [#​2405 #​2553 @​wagoodman]
• unknown flag: --key when use syft attest --key [KEY] [#​2544 #​2551 @​willmurphyscode]
• purl generation broken for kafka jars [#​2385 #​2573 @​westonsteimel]

Breaking Changes

• Top-level API should be more composable [#​558 #​2517 @​wagoodman]
• Annotate where each CPE on a package is sourced from [#​2282 #​2552 @​willmurphyscode]

(Full Changelog)

v0.103.1

Compare Source

Security Fixes

• Bump archiver and stereoscope to address path traversal issues [#​2570 @​wagoodman]

Bug Fixes

• Revert cosign signing of release checksums file [#​2571 @​wagoodman]
• java archive parser incorrectly splitting filenames [#​2563 #​2565 @​willmurphyscode]

Breaking Changes

• Internalize format helpers [#​2543 @​wagoodman]
• Internalize CPE generation logic [#​2541 @​wagoodman]

(Full Changelog)

v0.103.0

Compare Source

v0.102.0

Compare Source

Added Features

• Swap format uses of io.ReadSeeker for io.Reader [#​2515 @​wagoodman]
• Cataloger interface should accept context.Context [#​2521 #​2528 @​wagoodman]

Bug Fixes

• Implement golang Purl subpath [#​2547 @​LaurentGoderre]
• CPE definition on pkg.Package is coupled to an external package as a type alias [#​2529 #​2534 @​willmurphyscode]
• Turn off SBOM cataloger by default [#​1555 #​2527 @​wagoodman]
• Syft missing linux kernel archives from SBOM results [#​2524 #​2526 @​wagoodman]
• LocationResolver can leak goroutines [#​2487 #​2518 @​willmurphyscode]
• Duplicates in Syft JSON "artifactRelationships" [#​2251]

Breaking Changes

• Use the json schema as input for templating [#​2542 @​wagoodman]
• Unexport types and functions cataloger packages [#​2530 @​wagoodman]
• Internalize majority of cmd package [#​2533 @​wagoodman]
• Allow for RPM modularity to be optional [#​2540 @​wagoodman]
• CPE definition on pkg.Package is coupled to an external package as a type alias [#​2529 #​2534 @​willmurphyscode]
• Cataloger interface should accept context.Context [#​2521 #​2528 @​wagoodman]
• Remove deprecated API features [#​2257 #​2508 @​wagoodman]
• Remove deprecated configuration [#​1864 #​2508 @​wagoodman]
• Turn off SBOM cataloger by default [#​1555 #​2527 @​wagoodman]

Additional Changes

• Fix migration of integration test [#​2546 @​wagoodman]
• minor cataloger and docs nits [#​2519 @​luhring]

(Full Changelog)

v0.101.1

Compare Source

Bug Fixes

• Deduplicate digests from user configuration [#​2522 @​wagoodman]
• Duplicate relationships in final SBOM [#​2509 #​2516 @​spiffcs]

(Full Changelog)

v0.101.0

Compare Source

Security Fixes

• bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 [#​2501 @​dependabot]

Added Features

• Added binary classifier for GCC [#​2479 @​LaurentGoderre]
• Add binary classifier for pypy [#​2474 @​LaurentGoderre]
• Add binary classifiers for Percona Software for MySQL [#​2478 @​abg]
• Added classifier for wordpress cli binary [#​2473 @​LaurentGoderre]
• Add cataloger list command [#​2366 @​wagoodman]
• Add ability to enable or disable individual catalogers [#​1731 #​1383 @​wagoodman]
• Improve cataloger selection capabilities [#​1039 #​1383 @​wagoodman]

Bug Fixes

• Include binary cataloger configuration defaults [#​2504 @​wagoodman]
• Condense binary cataloger config in JSON output [#​2499 @​wagoodman]
• Add support for the traefik binary from the official Docker image [#​2484 @​LaurentGoderre]
• When specify java-cataloger, java-pom-cataloger will also be selected [#​2136 #​1383 @​wagoodman]

(Full Changelog)

v0.100.0

Compare Source

Added Features

• Add more functionality to the ErLang parser [#​2390 @​LaurentGoderre]
• Added OpenSSL binary matcher [#​2416 @​LaurentGoderre]
• Add ability to extend the binaries cataloguers [#​2469 @​LaurentGoderre]

Bug Fixes

• Added missing Purl for busybox [#​2457 @​LaurentGoderre]
• Fix diff error obfuscating binary test failures message [#​2468 @​LaurentGoderre]
• v0.99.0: CycloneDX json output breaks osv-scanner [#​2467]

Additional Changes

• update openssl binary to -x [#​2456 @​spiffcs]

(Full Changelog)

v0.99.0

Compare Source

Added Features

• Look for a maven version in a pom from a parent dependency management… [#​2423 @​coheigea]
• Adding the ability to retrieve remote licenses for yarn.lock [#​2338 @​coheigea]
• Retrieve remote licenses using pom.properties when there is no pom.xml [#​2315 @​coheigea]
• Add the option to retrieve remote licenses for projects defined in a … [#​2409 @​coheigea]
• Parse Python licenses from LicenseFile entry in the Wheel Metadata [#​2331 @​coheigea]
• Add binary classifier for the ERLang interpreter [#​2417 @​LaurentGoderre]
• Parse Python licenses from LicenseExpression entry in the Wheel Metadata [#​2431 @​coheigea]
• Add binary classifier for Julia lang [#​2427 @​LaurentGoderre]
• Add binary detection for PHP composer [#​2432 @​LaurentGoderre]

Bug Fixes

• bump fangs for ptr summarize fix [#​2387 @​willmurphyscode]
• improve identification for org.codehaus.groovy artifacts [#​2404 @​westonsteimel]
• improve identification for commons-jelly artifacts [#​2399 @​westonsteimel]
• improve identification for io.minio artifacts [#​2398 @​westonsteimel]
• improve identification for com.graphql-java artifacts [#​2397 @​westonsteimel]
• improve identification for org.apache.tapestry artifacts [#​2384 @​westonsteimel]
• improve identification for io.ratpack artifacts [#​2379 @​westonsteimel]
• improve identification for org.apache.cassandra artifacts [#​2386 @​westonsteimel]
• improve identification for org.neo4j.procedure artifacts [#​2388 @​westonsteimel]
• improve identification for org.elasticsearch artifacts [#​2383 @​westonsteimel]
• improve identification for org.apache.geode artifacts [#​2382 @​westonsteimel]
• improve identification for org.apache.tomcat artifacts [#​2381 @​westonsteimel]
• improve identification for io.projectreactor.netty artifacts [#​2378 @​westonsteimel]
• stop panic when parsing Haskell stack.yaml.lock with missing hackage field [#​2421 #​2419 @​houdini91]
• fix detecting the name of the eclipse OSGi artifact [#​2314 #​2349 @​westonsteimel]
• File Sources incorrectly exclude files on Windows [#​2410 #​2411 @​Racer159]
• Parser for dotnet_portable_executable using wrong attribute name [#​2029 #​2133 @​kzantow]

Breaking Changes

• Generalize UI events for cataloging tasks [#​2369 @​wagoodman]

Additional Changes

• refactor pkg.Collection to remove "catalog" references [#​2439 @​wagoodman]
• Expose javascript fields in cataloger configuration [#​2438 @​wagoodman]
• Use common archive catalog configuration [#​2437 @​wagoodman]
• Fix file digest cataloger when passed explicit coordinates [#​2436 @​wagoodman]

(Full Changelog)

v0.98.0

Compare Source

Added Features

• Add binary classifiers for MySQL and MariaDB [#​2316 @​duanemay]
• Enhance redis binary classifier to support additional versions [#​2329 @​whalelines]
• Expose compact JSON and XML format configuration [#​561 #​2275 @​wagoodman]

Bug Fixes

• Fix file metadata cataloger when passed explicit coordinates [#​2370 @​wagoodman]
• hardcode xalan group ID [#​2368 @​willmurphyscode]
• logging level for parsing potential PE files [#​2367 @​kzantow]
• Use read lock in pkg.Collection [#​2341 @​wagoodman]
• add manual namespace mapping for org.springframework jars [#​2345 @​westonsteimel]
• add manual namespace mapping for org.springframework.security jars [#​2343 @​westonsteimel]
• errors are printed into the stdout in syft 0.97.1 [#​2356 #​2364 @​kzantow]
• syft some-jar.jar fails to find packages if PWD is a symlink [#​2355 #​2359 @​willmurphyscode]
• Default for recently added base path, "", disables detection of symlinked *.jar files [#​1962 #​2359 @​willmurphyscode]
• syft attest broken since 0.85.0 [#​2333 #​2337 @​wagoodman]
• Incorrect Java PURL for org.bouncycastle jars [#​2339 #​2342 @​westonsteimel]

Breaking Changes

• Remove power-user command and related catalogers [#​1419 #​2306 @​wagoodman]

Additional Changes

• Normalize cataloger configuration patterns [#​2365 @​wagoodman]
• Normalize enums to lowercase with hyphens [#​2363 @​wagoodman]

(Full Changelog)

Special Thanks

Thanks @​duanemay and @​whalelines for the enhanced binary classifier support 👍

v0.97.1

Compare Source

Bug Fixes

• Syft does not use HTTP proxy when downloading the Docker image itself [#​2203 #​2336 @​anchore-actions-token-generator]

Additional Changes

• syft version report is broken with 0.97.0 release [#​2334 #​2335 @​spiffcs]

(Full Changelog)

v0.97.0

Compare Source

Added Features

• Add license for golang stdlib package [#​2317 @​coheigea]
• Fall back to searching maven central using groupIDFromJavaMetadata [#​2295 @​coheigea]

Bug Fixes

• Refine license search from groupIDFromJavaMetadata to account for artfactId in the groupId [#​2313 @​coheigea]
• capture content written to stdout outside of report [#​2324 @​kzantow]
• add manual groupid mappings for org.apache.velocity jars [#​2327 @​westonsteimel]
• skip maven bundle plugin logic if vendor id and symbolic name match [#​2326 @​westonsteimel]
• cataloger dpkg-db-cataloger not working [#​2323]

Breaking Changes

• Rename Location virtualPath to accessPath [#​1835 #​2288 @​wagoodman]

Additional Changes

• Export syft-json format package metadata type helper [#​2328 @​wagoodman]
• Add dotnet-portable-executable-cataloger to README [#​2322 @​noqcks]

(Full Changelog)

v0.96.0

Compare Source

Added Features

• Check maven central as well for licenses in parents poms for nested jars [#​2302 @​coheigea]
• store image annotations inside the SBOM [#​2267 #​2294 @​noqcks]
• Support parsing license information in Maven projects via parent poms [#​2103]

Bug Fixes

• SPDX file has duplicate sha256 tag in versionInfo [#​2300 @​coheigea]
• Report virtual path consistently between file.Resolvers [#​1836 #​2287 @​wagoodman]
• Unable to identify CycloneDX JSON documents without $schema property [#​2299 #​2303 @​kzantow]

(Full Changelog)

v0.95.0

Compare Source

Added Features

• Use case-insensitive matching for Go license files [#​2286 @​miquella]
• Add conaninfo.txt parser to detect conan packages in docker images [#​2234 @​Pro]
• Perform case insensitive matching on Java License files [#​2235 @​coheigea]
• Read a license from a parent pom stored in Maven Central [#​2228 @​coheigea]
• Add PURLs when scanning Gradle lock files [#​2278 @​robbiev]

Bug Fixes

• Fix CPE index workflow [#​2252 @​wagoodman]
• Fix cpe generation task [#​2270 @​willmurphyscode]
• Introduce cataloger naming conventions [#​1578 #​2277 @​wagoodman]
• .NET / nuget - invalid SBOM generated after parsing [#​2255 #​2273 @​spiffcs]
• Wrong parsing after v0.85.0 syft for some components [#​2241 #​2273 @​spiffcs]
• SPDX-2.3 is misidentified as SPDX-2.2 [#​2112 #​2186 @​wagoodman]
• Jar parser chokes on empty lines [#​2179 #​2254 @​spiffcs]
• Add a new Java configuration option to recursively search parent poms… [#​2274 @​coheigea]
• Fix directory resolver to always return virtual path [#​2259 @​wagoodman]
• Syft can now handle the case of parsing a jar with multiple poms [#​2231 @​coheigea]
• Add ruby.NewGemSpecCataloger to DirectoryCatalogers [#​1971 @​evanchaoli]

Breaking Changes

• Introduce cataloger naming conventions [#​1578 #​2277 @​wagoodman]
• Remove MetadataType from the core package struct [#​1735 #​1983 @​wagoodman]
• Add convention for JSON metadata type names and port existing values to the new convention [#​1844 #​1983 @​wagoodman]
• Remove deprecated syft.Format functions [#​1344 #​2186 @​wagoodman]

Additional Changes

• Upgrade tool management [#​2188 @​wagoodman]
• Fix homebrew post-release workflow [#​2242 @​wagoodman]

(Full Changelog)

v0.94.0

Compare Source

Added Features

• Add additional license filenames [#​2227 @​coheigea]
• Parse donet dependency trees [#​2143 @​noqcks]
• Find license by embedded license text [#​2147 #​2213 @​coheigea]
• Add support for dpkg dependency relationships [#​2040 #​2212 @​wagoodman]

Bug Fixes

• Report errors to stderr not stdout [#​2232 @​wagoodman]
• Python egg packages are not parsed for SBOM [#​1761 #​2239 @​spiffcs]
• Java archive is listed twice [#​2130 #​2220 @​wagoodman]
• Java archives not from Maven [#​2217 #​2220 @​wagoodman]
• Remove internal.StringSet [#​2209 #​2219 @​wagoodman]
• Invalid interface conversion in Swift cataloger [#​2225 #​2226 @​wagoodman]

(Full Changelog)

v0.93.0

Compare Source

Added Features

• Parse license from the pom.xml if not contained in the manifest [#​2115 @​coheigea]
• Add Golang STD library package given a Golang binary has been discovered compiled with that go binary [#​1853 #​2195 @​spiffcs]
• Improve --output CLI help and deprecate --file [#​2165 #​2187 @​sharief007]

Bug Fixes

• Converting a SBOM looses the algorithm type for added checksums [#​2183 #​2207 @​sharief007]

Additional Changes

• Refine the docs for building a cataloger [#​2175 @​wagoodman]
• update license list to 3.22 [#​2201 @​spiffcs]
• Add exact syntax of the conversion formats [#​2196 @​vargenau]

(Full Changelog)

v0.92.0

Compare Source

Added Features

• Support for multiple image refs of same sha in OCI layout [#​1544]

Bug Fixes

• Generated purls are different between runs of syft against the same image and artifact [#​2169 #​2170 @​willmurphyscode]

Additional Changes

• bump stereoscope to fix data race in UI code [#​2173 @​willmurphyscode]

(Full Changelog)

v0.91.0

Compare Source

Added Features

• Add support for CycloneDX 1.5 [#​2120 #​2123 @​spiffcs]
• Add support for containerd as an image source [#​201 #​1793 @​shanedell]
• Support cataloging github workflow & github action usages [#​1896 #​2140 @​wagoodman]

Bug Fixes

• Allow CycloneDX json input with no components [#​2127 @​ahoz]
• Prevent errors from clobbering terminal [#​2161 @​kzantow]
• Using syft as a go library to decode a syft json has incomplete data [#​2069 #​2083 @​kzantow]
• SBOMs are not the same on multiple runs of syft [#​1944]

Additional Changes

• Switch to stdlib's slices pkg [#​2148 @​hainenber]
• Remove unneeded arch switch in unit test [#​2156 @​willmurphyscode]
• Update chronicle to v0.8.0 [#​2154 @​wagoodman]
• Update to latest stereoscope [#​2151 @​spiffcs]
• Pin workflow checkout for cpe update-cpe-dictionary-index [#​2141 @​spiffcs]
• Add dependency information to conan lockfile parser [#​2131 @​Pro]
• Pin and update all workflow dependencies; add permission scopes [#​2138 @​spiffcs]
• Enforce race detector [#​2122 @​willmurphyscode]

(Full Changelog)

v0.90.0

Compare Source

v0.90.0 (2023-09-11)

Full Changelog

Added Features

• Expose cobra command in cli package [PR #​2097] [wagoodman]
• Explicitly test PURL generation against key packages [Issue #​2071]
• Add User-Agent with Syft version during update check [Issue #​2072] [PR #​2100] [hainenber]

Bug Fixes

• fix: correct group IDs for commons-codec, okhttp, okio, and add integration tests for Java PURL generation [PR #​2075] [willmurphyscode]
• Cyclonedx external reference URLs are not validated when encoding [Issue #​2079] [PR #​2091] [hainenber]

Additional Changes

• Bump the golang.org/x/exp dependency and fix a build breakage. [PR #​2088] [dlorenc]
• fix: update codeql-analysis for go 1.21 [PR #​2108] [spiffcs]

v0.89.0

Compare Source

v0.89.0 (2023-08-31)

Full Changelog

Added Features

• Add registry certificate verification support [PR #​1734] [5p2O5pe25ouT]
• Add SYFT_CONFIG environment variable for configuration file path [Issue #​1986] [PR #​2001] [kzantow]

Bug Fixes

• Fix quiet flag [PR #​2081] [wagoodman]
• Command line flags not overriding configuration file values [Issue #​1143] [PR #​2001] [kzantow]
• Django package CPE is not correct [Issue #​1298] [PR #​2068] [witchcraze]
• Config parsing includes config.yaml in working dir [Issue #​1634] [PR #​2001] [kzantow]
• Fix a possible panic on universal go binaries [Issue #​2073] [PR #​2078] [willmurphyscode]
• Disabling catalogers is not working in power user command [Issue #​2074] [PR #​2001] [kzantow]
• Virtual path changes to java cataloger causing creation of extra incorrect packages when jars are renamed [Issue #​2077] [PR #​2080] [willmurphyscode]

v0.88.0

Compare Source

v0.88.0 (2023-08-25)

Full Changelog

Added Features

• Detect golang boring crypto and fipsonly modules [PR #​2021] [bathina2]
• feat: 1944 - update purl generation to use a consistent groupID [PR #​2033] [spiffcs]
• Add support to detect bash binaries [Issue #​1963] [PR #​2055] [witchcraze]

Bug Fixes

• fix: properly parse conan ref and include user and channel [PR #​2034] [Pro]
• New version notice only showing the version and no text [PR #​2042] [wagoodman]
• Fix: don't validate pom declared group [PR #​2054] [willmurphyscode]
• Errors when handling symlinks on Windows with syft v0.85.0 [Issue #​1950] [PR #​2051] [selzoc]
• Syft seems unable to parse non UTF-8 pom.xml files [Issue #​2044] [PR #​2047] [wagoodman]
• Error parsing pom.xml with v0.87.1 [Issue #​2060] [PR #​2064] [willmurphyscode]
• Invalid CycloneDX: duplicates in relationships section [Issue #​2062] [PR #​2063] [kzantow]

v0.87.1

Compare Source

v0.87.1 (2023-08-17)

Full Changelog

Bug Fixes

• Use Java package names to determine known groupIDs [PR #​2032] [kzantow]
• Relationships section of CycloneDX is not outputting even when the data is present [Issue #​1972] [PR #​1974] [markgalpin] [kzantow]
• SPDX Tag-Value conversion not handling files directly set on packages [Issue #​2013] [PR #​2014] [kzantow]
• Intermittent binary listings, different results every time [Issue #​2035] [PR #​2036] [kzantow]

v0.87.0

Compare Source

v0.87.0 (2023-08-14)

Full Changelog

Added Features

• feat: use originator logic to fill supplier [PR #​1980] [spiffcs]
• Expand deb cataloger to include opkg [PR #​1985] [johnDeSilencio]
• Package duplicated by different cataloger [Issue #​931] [PR #​1948] [spiffcs]
• Add binary cataloger for Nginx built from source [Issue #​1945] [PR #​1988] [SemProvoost]

Bug Fixes

• chore: update bubbly to fix hanging [PR #​1990] [kzantow]
• fix: update glob to use newer usr/lib/sysimage path [PR #​1997] [spiffcs]
• fix: SPDX license values and download location [PR #​2007] [kzantow]
• Different CPEs between java-cataloger and java-gradle-lockfile-cataloger [Issue #​1957] [PR #​1995] [kzantow]

v0.86.1

Compare Source

Changelog

v0.86.1 (2023-07-31)

Full Changelog

Bug Fixes

• Source requires default image name as user input for unparsable reference [PR #​1979] [kzantow]

v0.86.0

Compare Source

Changelog

v0.86.0 (2023-07-31)

Full Changelog

Added Features

• Introduce indexed embedded CPE dictionary [PR #​1897] [luhring]
• Add cataloger for Swift Package Manager. [PR #​1919] [trilleplay]
• Guess unpinned versions in python requirements.txt [PR #​1597] [PR #​1966] [manifestori] [wagoodman]
• Create a package record for the artifact an SBOM described when creating a SPDX SBOM [Issue #​1661] [Issue #​1241] [PR #​1934] [kzantow]

Bug Fixes

• Fix panic condition on docker pull failure [PR #​1968] [wagoodman]
• Syft reports the "minimum required version" of .NET assemblies rather than the "assembly version" [Issue #​1799] [PR #​1943] [luhring]
• Grype cannot read SPDX documents generated by SPDX-maven-plugin [PR #​1969] [spiffcs]

Breaking Changes

• Remove jotframe UI [PR #​1932] [wagoodman]
• Simplify python env markers [PR #​1967] [wagoodman]

v0.85.0

Compare Source

Changelog

v0.85.0 (2023-07-12)

Full Changelog

Added Features

• Add a --base-path command line flag to set the directory base for scans (this option was previously exposed via API only) [PR #​1867] [deitch]
• Add file source digest support [PR #​1914] [wagoodman]
• Remove erroneous Java CPEs from generation [PR #​1918] [luhring]
• Fix CPE generation for k8s python client [PR #​1921] [luhring]
• Don't use the actual redis or grpc CPEs for gems [PR #​1926] [luhring]
• The text user interface is now provided by the bubbletea library [Issue #​1441] [PR #​1888] [wagoodman]

Bug Fixes

• Install script returns exit code 0 even if install fails [Issue #​1566] [PR #​1915] [lorsatti]
• [Windows] Not able to scan volume mounted to folder [Issue #​1828] [PR #​1884] [dd-cws]
• Deprecated license: GFDL-1.2+ [Issue #​1899] [PR #​1907] [spiffcs]

Breaking Changes

• Refactor the source API and syft-json source block data shape [Issue #​1866] [PR #​1846] [wagoodman]

Additional Changes

• chore: update iterations to protect against race [PR #​1927] [spiffcs]
• fix: background reader apart from global handler for testing [PR #​1929] [spiffcs]

v0.84.1

Compare Source

Changelog

v0.84.1 (2023-06-29)

Full Changelog

Bug Fixes

• Fix version detection in Java archive name parsing [PR #​1889] [luhring]
• Improve support for Dart SDK package dependency lockfiles [PR #​1891] [rufman]
• Fix license output for some CycloneDX JSON SBOMs [Issue #​1877] [PR #​1879] [kzantow]

---

Configuration

📅 Schedule: Branch creation - "before 4am on Monday" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.