Bump github.com/anchore/syft from 0.80.0 to 1.5.0

[dependabot[bot]]

Bumps github.com/anchore/syft from 0.80.0 to 1.5.0.

Release notes

Sourced from github.com/anchore/syft's releases.

v1.5.0

Added Features

• Add abstraction for adding relationships from package cataloger results [#2853 @​wagoodman]
• Capture dependencies when parsing SPDX SBOMs [#2869 @​russellhaering]
• Add python wheel egg relationships [#2903 @​wagoodman]
• Added functionality to convert major, minor, patch to version [#2864 @​LaurentGoderre]
• Add support for RPM DB package relationships [#2872 @​wagoodman]
• Detect fluent-bit binaries [#2904 #2905 @​kzantow]
• Add syft config command [#2598 #2892 @​kzantow]

Bug Fixes

• Fix DecoderCollection discarding input from non-seekable Readers [#2878 @​russellhaering]
• Handle GOEXPERIMENTs in go version [#2893 @​jonjohnsonjr]
• Go Mod Cataloger: Remove Replaced Packages [#2891 @​russellhaering]
• Use values in relationship To/From fields [#2871 @​wagoodman]
• Java package names showing up namespaced packages [#2230]

Additional Changes

• update spdx license list to 3.24.0 [#2895 @​spiffcs]

(Full Changelog)

v1.4.1

Bug Fixes

• Fix redundant package deletions when considering ELF packages [#2862 @​wagoodman]

(Full Changelog)

v1.4.0

Added Features

• Add detection for newer version of ErLang/OTP [#2829 @​LaurentGoderre]
• Add missing CPE for traefik, memcached, and postgres binaries [#2845 @​LaurentGoderre]
• Add binary classifier for ArangoDB [#2830 @​LaurentGoderre]
• Add relationships to ELF packages [#2715 @​brian-ebarb @​cdivers18 ]
• Add relationships for ALPM packages (arch linux) [#2851 @​wagoodman]

Bug Fixes

• close temp rpmdb file [#2792 @​testwill]
• fix Windows file paths in local go mod cache [#2654 @​willmurphyscode]
• Package Count doesn't match list of packages [#2304 #2839 @​wagoodman]
• New version 1.3.0 leads to "too many open files" while scanning bigger images [#2819 #2823 @​willmurphyscode]
• license_info_in_file is mandatory in SPDX-2.2 [#2163 #2168 @​kzantow]
• Wrong CPE for dnsmasq [#2636 #2659 @​kzantow]

... (truncated)

Commits

• ac34808 feat: detect fluent-bit binaries (#2905)
• 2b70ea3 chore(deps): update tools to latest versions (#2907)
• 5eb1e71 chore(deps): bump docker/login-action from 3.1.0 to 3.2.0 (#2909)
• 774602f chore(deps): bump github.com/charmbracelet/bubbletea (#2901)
• c314e05 Handle GOEXPERIMENTs in go version (#2893)
• 05e8ba9 Add python wheel egg relationships (#2903)
• 64e11d5 chore(deps): bump github.com/charmbracelet/lipgloss (#2902)
• b51252d feat: Add Lua cataloger (#2613)
• 77b3f66 chore(deps): update tools to latest versions (#2900)
• 1c37bab feat: add config command (#2892)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

Superseded by #578.