chore(deps): bump github.com/anchore/syft from 1.10.0 to 1.11.0

[dependabot[bot]]

Bumps github.com/anchore/syft from 1.10.0 to 1.11.0.

Release notes

Sourced from github.com/anchore/syft's releases.

v1.11.0

Added Features

• Added the SWI Prolog (swipl) ecosystem [#3076 @​LaurentGoderre]
• Improved java cataloging [#2769 @​GijsCalis]

Bug Fixes

• Empty version field on some dependencies when reading pom.xml [#1129 #2769 @​GijsCalis]
• Support Maven multi-level configuration file / parent POM [#2017 #2769 @​GijsCalis]
• DependencyManagement ignored in pom.xml [#1813 #2769 @​GijsCalis]
• Version parsing regression for Go binaries [#3086 #3087 @​spiffcs]

Additional Changes

• rather than have a hard max recursive depth - syft should detect parent pom cycles [#2284 #2769 @​GijsCalis]
• increase java purl generation test coverage [#3110 @​westonsteimel]
• Updated PackageSupplier to type Organization for JAR files [#3093 @​harippriyas]
• Ensure accurate java main artifact name retrieval for multi-JARs and refine fallback approach [#3054 @​dor-hayun]

(Full Changelog)

Commits

• 19cc664 test: increase java purl generation test coverage (#3110)
• 64a9ecb chore(deps): bump modernc.org/sqlite from 1.31.1 to 1.32.0 (#3106)
• 6267d69 chore(deps): bump sigstore/cosign-installer from 3.5.0 to 3.6.0 (#3107)
• 1fb47d9 chore(deps): update tools to latest versions (#3099)
• 2339743 chore(deps): bump github/codeql-action from 3.25.15 to 3.26.0 (#3101)
• 9031592 chore(deps): bump actions/upload-artifact from 4.3.5 to 4.3.6 (#3102)
• 47d192d chore(deps): bump github.com/google/go-containerregistry (#3103)
• 040b683 chore(deps): bump golang.org/x/net from 0.27.0 to 0.28.0 (#3104)
• dcd87d1 chore(deps): bump actions/upload-artifact from 4.3.4 to 4.3.5 (#3095)
• 214a049 chore(deps): update CPE dictionary index (#3094)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)