Update dependency anchore/grype to v0.117.0

[renovate]

This PR contains the following updates:

Package	Update	Change
anchore/grype	minor	v0.116.0 → 0.117.0

---

Release Notes

anchore/grype (anchore/grype)

v0.117.0

Compare Source

Added Features

• Include vulnerable ranges in CycloneDX output format [Issue #​3512] [PR #​3519 @​somaz94]

Bug Fixes

• honor match.rust.using-cpes configuration [PR #​3611 @​Dashtid]

Dependencies

11 dependency changes (11 updated). 2 vulnerabilities remediated.

🟢 Remediated (2)

• GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
• GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5

Updated (11 packages)

• github.com/anchore/syft v1.50.0 → v1.51.0
• github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
• github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15
• github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
• github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)
• github.com/klauspost/compress v1.19.0 → v1.19.1
• github.com/magiconair/properties v1.8.10 → v1.18.11
• github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3
• github.com/ulikunitz/xz v0.5.15 → v0.5.16
• go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
• modernc.org/sqlite v1.54.0 → v1.55.0

(Full Changelog)

v0.116.1

Compare Source

Bug Fixes

• Ensure channel parsing is consistent [PR #​3603 @​wagoodman]
• Scope Go GHSA twins by shared CVE [PR #​3592 @​wagoodman]
• do not cache a comparator that failed to build [PR #​3567 @​arpitjain099]
• Add fix date to rhel minor records created from rhsa [PR #​3585 @​wagoodman]
• grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #​3591]
• panic: index out of range in distro.parseVersion for VERSION_ID=v [Issue #​3588] [PR #​3589 @​matiasinsaurralde]
• False Positive: GO-2026-5932 [Issue #​3573]

Dependencies

30 dependency changes (30 updated). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

Updated (30 packages)

• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
• github.com/anchore/stereoscope v0.2.2 → v0.3.0
• github.com/anchore/syft v1.48.0 → v1.50.0
• github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
• github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
• github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
• github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
• github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
• github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
• github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
• github.com/moby/moby/api v1.54.2 → v1.55.0
• github.com/moby/moby/client v0.4.1 → v0.5.0
• github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
• go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
• golang.org/x/crypto v0.53.0 → v0.54.0
• golang.org/x/mod v0.37.0 → v0.38.0
• golang.org/x/net v0.56.0 → v0.57.0
• golang.org/x/sync v0.21.0 → v0.22.0
• golang.org/x/sys v0.46.0 → v0.47.0
• golang.org/x/term v0.44.0 → v0.45.0
• golang.org/x/text v0.39.0 → v0.40.0
• golang.org/x/tools v0.47.0 → v0.48.0
• google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
• google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
• google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
• modernc.org/cc/v4 v4.28.4 → v4.29.0
• modernc.org/ccgo/v4 v4.34.4 → v4.34.6
• modernc.org/gc/v3 v3.1.3 → v3.1.4
• modernc.org/libc v1.73.4 → v1.74.1
• modernc.org/sqlite v1.53.0 → v1.54.0

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.