chore(deps): Update supply-chain

[github-actions]

This PR contains the following updates:

Package	Type	Update	Change
anchore/grype	security_tools	minor	v0.112.0 → v0.114.0
anchore/syft	security_tools	minor	v1.44.0 → v1.45.1

---

Warning

Some dependencies could not be looked up. Check the warning logs for more information.

---

Release Notes

anchore/grype (anchore/grype)

v0.114.0

Compare Source

Added Features

• Add ability to scan zarf packages [#​3329 #​3366 @​brandtkeller]

Additional Changes

• respect withdrawn status of Go Vuln DB OSV records [#​3495 @​willmurphyscode]
• Govulndb OSV transformer [#​3485 @​willmurphyscode]

(Full Changelog)

v0.113.0

Compare Source

Added Features

• Include Ubuntu 26.04 "resolute" in distro codenames [#​3397 @​anchore-oss-update-bot]
• source RPM filtering on Hummingbird [#​3410 @​willmurphyscode]

Bug Fixes

• use relatedVulnerabilities description as fallback in SARIF output [#​3271 @​axidex]
• improve platform CPE determination logic [#​3470 @​westonsteimel]
• normalize uppercase V in semantic version comparison [#​3461 @​immanuwell]
• purl handling in cgr maven libs [#​3420 @​willmurphyscode]
• Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#​3037 #​3089 @​wasup-yash]
• Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#​3101 #​3396 @​Dashtid]
• Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#​3442 #​3475 @​msnandhis]
• zsh completion fails [#​2933 #​3433 @​brandtkeller]

(Full Changelog)

anchore/syft (anchore/syft)

v1.45.1

Compare Source

Bug Fixes

• bump stereoscope to pull in fix for registry client hanging [#​4934 @​anchore-oss-update-bot]

(Full Changelog)

v1.45.0

Compare Source

Added Features

• Add support for ZapAddOns as jar files [#​4654 #​4932 @​douglasclarke]
• MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#​3297 #​4907 @​witchcraze]
• Catalog ingress-nginx binary [#​4818 #​4857 @​witchcraze]

Bug Fixes

• Support helm binary various versions [#​4820 #​4922 @​witchcraze]
• Support julia binary various versions [#​4867 #​4945 @​witchcraze]
• Support deno binary old versions [#​4865 #​4939 @​witchcraze]
• Compressed kernel modules are not scanned by the linux-kernel-cataloger [#​4721 #​4740 @​will-bates11]
• Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#​4691 #​4838 @​calumleslie]
• Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#​4539 #​4882 @​witchcraze]
• Support elixir binary rc versions [#​4819 #​4851 @​ChrisJr404]
• Exclude path ending with a slash are discarded [#​4839 #​4892 @​ChrisJr404]
• Incorrect CPE for .NET Runtime [#​4738 #​4743 @​PGrayCS]
• fix parsing of debian/copyright files [#​4708 #​4754 @​Bahtya]
• Grype ignores python requirements in arbitrary equality (===) format [#​4834 #​4835 @​cyphercodes]
• valkey is detected as both of valkey and redis [#​4591 #​4619 @​witchcraze]
• TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#​4837 #​4848 @​ChrisJr404]

Additional Changes

• hoist name normalization regexp to package level [#​4926 @​matiasinsaurralde]
• bump the actions-minor-patch group across 1 directory with 6 updates [#​4946 @​dependabot]
• bump the actions-minor-patch group across 2 directories with 2 updates [#​4936 @​dependabot]
• bump the actions-minor-patch group across 1 directory with 4 updates [#​4927 @​dependabot]
• bump the actions-minor-patch group across 1 directory with 2 updates [#​4920 @​dependabot]
• bump the actions-minor-patch group across 1 directory with 2 updates [#​4897 @​dependabot]
• update CPE dictionary index [#​4831 @​anchore-oss-update-bot]

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate.