Bump github.com/anchore/syft from 1.10.0 to 1.15.0

[dependabot[bot]]

Bumps github.com/anchore/syft from 1.10.0 to 1.15.0.

Release notes

Sourced from github.com/anchore/syft's releases.

v1.15.0

Added Features

• Merge config files hierarchically and add support for config profiles [#3337 @​kzantow]
• Enable cargo-auditable-binary-cataloger for files/directories [#3376 @​ariel-miculas]
• Improve mariadb binary classifer to detect older versions [#3052]
• Look for dpkg status file at additional globs [#2692 #3373 @​njv299]
• Emit relationships for Java dependencies [#3189 #3363 @​kzantow]

(Full Changelog)

v1.14.2

Bug Fixes

• Use single license scanner for all catalogers [#3348 @​wagoodman]
• use official CPE for linux kernel [#3343 @​westonsteimel]
• improve mariadb binary classifer to detect older versions [#3339 @​westonsteimel]

Additional Changes

• Update to latest packageurl-go [#3347 @​wagoodman]

(Full Changelog)

v1.14.1

Bug Fixes

• stop some log.Warn spam due parsing an empty string as a CPE [#3330 @​willmurphyscode]
• improve go binary semver extraction for traefik [#3325 @​westonsteimel]

(Full Changelog)

v1.14.0

Added Features

• Report known unknowns directly in the output SBOM [#518 #2998 @​kzantow]
• Identify bash.preinst [#3191 #3228 @​wagoodman]
• Support HAProxy rc and some old versions [#3233 #3277 @​witchcraze]
• Support Redis arm/v5, arm/v7, 386 in 7.2, 7.4, 8.0 [#3279 #3281 @​witchcraze]
• Support node old versions [#3236 #3284 @​witchcraze]
• Support rubylang/ruby dev versions [#3239 #3285 @​witchcraze]
• Support ruby rc, preview [#3238 #3285 @​witchcraze]

Bug Fixes

• performance: instantiate license check scanner to prevent memory leak [#3290 @​govrin]
• Parse package.json with non-standard fields in 'author' section [#3300 @​nuada]
• make failed CPE validation correctly return error [#2762 @​willmurphyscode]
• Improve subpath to mount matching [#3269 @​cdupuis]

... (truncated)

Commits

• 55cc187 chore(deps): update stereoscope to bcc40c6817524718277256d6b774ce643f98640a (...
• 367c699 chore(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (#3384)
• 46445ff chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.1 to 1.1.2 (#3385)
• 5faa6d3 chore(deps): update tools to latest versions (#3383)
• c7c0366 chore(deps): update CPE dictionary index (#3387)
• a0c62da chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#3380)
• 759b898 feat: multi-level configuration and profiles (#3337)
• a00533c feat: Java dependency graph information (#3363)
• b505317 Expanded dpkg cataloger globs (#3373)
• 06d300e Enable cargo-auditable-binary-cataloger for files/directories (#3376)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot show ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot[bot]]

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.