chore(deps): update tools

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence	Update
github.com/anchore/syft	v1.46.0 → v1.49.0					minor
github.com/sigstore/cosign/v2	v2.6.3 → v2.6.4					patch
istio/istio	1.30.2 → 1.30.3					patch
k8s.io/code-generator	v0.36.2 → v0.36.3					patch
k8s.io/kube-openapi	v0.0.0-20260706235625-cdb1db5517a0 → v0.0.0-20260721132016-d427ff9ee9ad					patch
kubernetes/kubernetes	v1.36.2 → v1.36.3					patch
redhat-openshift-ecosystem/openshift-preflight	1.19.1 → 1.19.2					patch

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.49.0

Compare Source

Added Features

• Support for application/vnd.oci.image.index.v1+json manifests in root OCI layout [Issue #​1545] [PR #​5074 @​jasonpaulos]

Bug Fixes

• Misinterpretation of Multiple replace Directives in Golang [Issue #​2721] [PR #​5069 @​ychampion]

Dependencies

16 dependency changes (16 updated).

Updated (16 packages)

• github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
• github.com/anchore/stereoscope v0.2.2 → v0.3.0
• github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
• github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
• github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
• github.com/moby/moby/api v1.54.2 → v1.55.0
• github.com/moby/moby/client v0.4.1 → v0.5.0
• github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
• golang.org/x/crypto v0.53.0 → v0.54.0
• golang.org/x/mod v0.37.0 → v0.38.0
• golang.org/x/net v0.56.0 → v0.57.0
• golang.org/x/sync v0.21.0 → v0.22.0
• golang.org/x/sys v0.46.0 → v0.47.0
• golang.org/x/term v0.44.0 → v0.45.0
• golang.org/x/text v0.38.0 → v0.40.0
• golang.org/x/tools v0.47.0 → v0.48.0

(Full Changelog)

v1.48.0

Compare Source

Added Features

• emit dependency relationships from mix.lock [PR #​4985 @​cgreeno]
• add safe tensor model type to SBOM output [PR #​4844 @​spiffcs]
• Capture golang binary symbols [PR #​4988 @​spiffcs]
• Detect Ubuntu Pro/ESM extended support [PR #​5028 @​wagoodman]
• Add scan duration timer to Syft [Issue #​4587] [PR #​4858 @​ChrisJr404]
• Support for vcpkg [Issue #​2110] [PR #​4081 @​gabetrau]
• Add macOS .app cataloger [Issue #​4010] [PR #​4490 @​rezmoss]
• Add support for Kerberos 5 library cataloging [Issue #​4780] [PR #​4781 @​nadimz]
• Include date of scan in results [Issue #​3910]

Bug Fixes

• use printf instead of echo to fix ANSI color output [PR #​4978 @​Jouini-Mohamed-Chaker]
• Strip peer-dep suffix from deno.lock npm keys [PR #​5055 @​Synvoya]
• Allow more PEP440-compliant characters in python versions [PR #​4964 @​kzantow]
• PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #​4996 @​activeobd]
• Fix panic parsing a rockspec comment that ends at EOF [PR #​5053 @​arpitjain099]
• Fix Debian point release detection [PR #​4997 @​OsamaSE]
• Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #​5041 @​Synvoya]
• npm redis client generates no CPE [Issue #​5011] [PR #​5012 @​rezmoss]
• Debug Docker images are running as nonroot user [Issue #​4113] [PR #​4608 @​spiffcs]
• libxml2 gets the wrong cpe vendor [Issue #​5015] [PR #​5016 @​rezmoss]
• wrong purl for spring-ldap-core dependency [Issue #​4030] [PR #​4908 @​jonasboos]
• Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #​3961] [PR #​4785 @​SAY-5]
• conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #​5017] [PR #​5020 @​jfjrh2014]
• dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #​4514] [PR #​4517 @​rezmoss]
• Go template sprig date functions not defined [Issue #​2372] [PR #​4644 @​sputnik-mac]
• CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #​4720] [PR #​4782 @​SAY-5]

Dependencies

9 dependency changes (8 updated, 1 added).

Updated (8 packages)

• github.com/bmatcuk/doublestar v1.3.1 → v8.8.8
• github.com/klauspost/compress v1.18.6 → v1.19.0
• golang.org/x/tools v0.46.0 → v0.47.0
• modernc.org/cc/v4 v4.28.2 → v4.28.4
• modernc.org/ccgo/v4 v4.34.0 → v4.34.4
• modernc.org/gc/v3 v3.1.2 → v3.1.3
• modernc.org/libc v1.72.3 → v1.73.4
• modernc.org/sqlite v1.51.0 → v1.53.0

Added (1 package)

• howett.net/plist v1.0.1

(Full Changelog)

v1.47.0

Compare Source

sigstore/cosign (github.com/sigstore/cosign/v2)

v2.6.4

Compare Source

This release is a backport of OCI manifest fixes, and better support for cosign attestation download when you are using a mix of old Cosign signatures with the more recent bundle format.

We strongly encourage folks to continue their migration to the bundle format. The Cosign v3.1.x releases support both formats; the primary change being that the default for signing is the bundle format (although you can specify --new-bundle-format=false to sign with the old format). The verification commands in Cosign v3.1.x support both formats, and will try to detect the format for you for maximum compatibility.

Changelog

• 26261f0 Allow attestation download to handle both bundle types (#​4996) (#​5017)
• d49a0c1 fix: include artifactType in OCI 1.1 signature referrer manifest (cherry-pick PR-4997 to release-2.6) (#​5002)

Thanks to all contributors!

istio/istio (istio/istio)

v1.30.3: Istio 1.30.3

Compare Source

Artifacts
Release Notes

kubernetes/code-generator (k8s.io/code-generator)

v0.36.3

Compare Source

kubernetes/kubernetes (kubernetes/kubernetes)

v1.36.3

Compare Source

See kubernetes-announce@. Additional binary downloads are linked in the CHANGELOG.

See the CHANGELOG for more details.

redhat-openshift-ecosystem/openshift-preflight (redhat-openshift-ecosystem/openshift-preflight)

v1.19.2

Compare Source

What's Changed

• build(deps): bump the prod-dependencies group with 3 updates by @​dependabot[bot] in #​1480
• build(deps): bump actions/checkout from 6.0.2 to 6.0.3 by @​dependabot[bot] in #​1479
• ci: separate test dependencies from prod in dependabot config by @​bcrochet in #​1483
• Update OWNERS... remove TC add caxu-rh by @​acornett21 in #​1486
• build(deps): bump the prod-dependencies group across 1 directory with 4 updates by @​dependabot[bot] in #​1484
• updating docs urls (docs.rh.com redirect is broken) by @​acornett21 in #​1487
• build(deps): bump the test-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in #​1485
• build(deps): bump actions/checkout from 6.0.3 to 7.0.0 by @​dependabot[bot] in #​1490
• build(deps): bump actions/setup-go from 6.4.0 to 6.5.0 by @​dependabot[bot] in #​1488
• build(deps): bump the test-dependencies group with 2 updates by @​dependabot[bot] in #​1489
• build(deps): bump zizmorcore/zizmor-action from 0.5.6 to 0.5.7 by @​dependabot[bot] in #​1491
• build(deps): bump the prod-dependencies group across 1 directory with 2 updates by @​dependabot[bot] in #​1492
• update operator sdk install process and version by @​acornett21 in #​1493
• build(deps): bump github.com/docker/cli from 29.6.0+incompatible to 29.6.1+incompatible in the prod-dependencies group by @​dependabot[bot] in #​1494
• build(deps): bump docker/setup-qemu-action from 4.1.0 to 4.2.0 by @​dependabot[bot] in #​1495
• build(deps): bump docker/login-action from 4.2.0 to 4.4.0 by @​dependabot[bot] in #​1496
• switching to hardened images to reduce image size and CVE footprint by @​acornett21 in #​1481
• Revert "switching to hardened images to reduce image size and CVE footprint" by @​acornett21 in #​1497

Full Changelog: redhat-openshift-ecosystem/openshift-preflight@1.19.1...1.19.2

---

Configuration

📅 Schedule: (in timezone Europe/London)

• Branch creation
  • At any time (no schedule defined)
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[cert-manager-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign inteon for approval. For more information see the Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment