chore(deps): updated module github.com/anchore/syft from v1.40.1 to v1.42.1

[paketo-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/anchore/syft	require	minor	v1.40.1 → v1.42.1

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.42.1

Compare Source

Bug Fixes

• Use redhat as namespace for hummingbird rpms [#​4615 @​scoheb]
• False Positive: Emacs snap package version CVE-2024-39331 [#​4485]

Additional Changes

• call cleanup on tmpfile and replace some io.ReadAlls with streams [#​4629 @​willmurphyscode]
• bumps go mod version to 1.25; ci takes latest patch [#​4628 @​spiffcs]

(Full Changelog)

v1.42.0

Compare Source

Added Features

• Add support for scanning GGUF models from OCI registries [#​4335 @​spiffcs]
• yarn lockfile scan doesnt catch dev dependencies [#​4548 #​4549 @​rezmoss]

Additional Changes

• CPE detection for APK libavif to use aomedia vendor [#​4597 @​naag]

(Full Changelog)

v1.41.2

Compare Source

Bug Fixes

• further improve go binary classifier, including windows [#​4593 @​kzantow]
• Wrong format in license [#​4233 #​4588 @​spiffcs]
• Cannot detect installation of Qt6 [#​4467 #​4550 @​rezmoss]
• bug: Syft mis-identifies binary as deb inside a snap [#​4486 #​4500 @​popey]

(Full Changelog)

v1.41.1

Compare Source

Bug Fixes

• [Bug Report] Missing some dependencies on cyclonedx formatted SBOM using syft [#​4562 #​4573 @​spiffcs]

(Full Changelog)

v1.41.0

Compare Source

Added Features

• detect Debian version from /etc/debian_version [#​4569 @​kzantow]

Bug Fixes

• correctly report supporting evidence for binary packages [#​4558 @​kzantow]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[paketo-bot]

ℹ️ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 17 additional dependencies were updated

Details:

Package	Change
github.com/CycloneDX/cyclonedx-go	v0.9.3 -> v0.10.0
github.com/anchore/stereoscope	v0.1.18 -> v0.1.20
github.com/bmatcuk/doublestar/v4	v4.9.2 -> v4.10.0
github.com/charmbracelet/colorprofile	v0.2.3-0.20250311203215-f60798e515dc -> v0.4.1
github.com/charmbracelet/x/ansi	v0.10.1 -> v0.11.5
github.com/charmbracelet/x/cellbuf	v0.0.13-0.20250311204145-2c3ea96c31dd -> v0.0.15
github.com/charmbracelet/x/term	v0.2.1 -> v0.2.2
github.com/clipperhouse/displaywidth	v0.6.0 -> v0.9.0
github.com/clipperhouse/uax29/v2	v2.3.0 -> v2.5.0
github.com/github/go-spdx/v2	v2.3.5 -> v2.3.6
github.com/go-viper/mapstructure/v2	v2.4.0 -> v2.5.0
github.com/ncruces/go-strftime	v0.1.9 -> v1.0.0
github.com/olekukonko/ll	v0.1.3 -> v0.1.4-0.20260115111900-9e59c2286df0
github.com/olekukonko/tablewriter	v1.1.2 -> v1.1.3
github.com/spdx/tools-golang	v0.5.6 -> v0.5.7
modernc.org/libc	v1.66.10 -> v1.67.6
modernc.org/sqlite	v1.43.0 -> v1.44.3