Update containers-syft-packages-extractor to v1.0.18 (AST-112118)

[cx-shaked-karta]

Update containers-syft-packages-extractor to v1.0.18 (AST-112118)

[cx-andre-macedo]

Checkmarx One – Scan Summary & Details – 2c80d842-1c07-4e6c-8e9f-0dbb20b931b5

New Issues (1)

Checkmarx found the following issues in this Pull Request

Severity	Issue	Source File / Package	Checkmarx Insight
	CVE-2025-27144	Go-gopkg.in/go-jose/go-jose.v2-v2.6.3	details Description: Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryptio... Attack Vector: NETWORK Attack Complexity: LOW ID: qHdaKgMwY8g3lvNIQSuz65mngBUW4425YlRA27l1r3c%3D Vulnerable Package

Fixed Issues (5)

Great job! The following issues were fixed in this Pull Request

Severity	Issue	Source File / Package
	CVE-2025-52893	Go-github.com/mitchellh/mapstructure-v1.5.0
	CVE-2025-55198	Go-helm.sh/helm/v3-v3.17.4
	CVE-2025-55199	Go-helm.sh/helm/v3-v3.17.4
	CVE-2025-58058	Go-github.com/ulikunitz/xz-v0.5.12
	Cx17483713-ac68	Go-github.com/go-viper/mapstructure/v2-v2.3.0

---

Use @Checkmarx to reach out to us for assistance.

Just send a PR comment with @Checkmarx followed by a natural language request.

Examples: @Checkmarx how are you able to help me? @Checkmarx rescan this PR

[cx-shaked-karta]

@Checkmarx rescan this PR

[cx-andre-macedo]

@Checkmarx rescan this PR

I've successfully initiated security scans on both branches:

• Source branch (sk-ast-112118): Scan started
• Target branch (main): Scan started

The scans are now running and results will be available once they complete.