updates dependencies

Author: timbastin

go.mod

@@ -4,32 +4,27 @@
 
 buildGoModule rec {
   pname = "crane";
-  version = "0.21.3";
+  version = "0.21.5";
 
   src = fetchFromGitHub {
     owner = "google";
     repo = "go-containerregistry";
     rev = "v${version}";
-    hash = "sha256-BfKiBjfL5th1TPpw6hpno04MffLnXmOVq7BsGUCkPT0=";
+    hash = "sha256-2cC2fZe22K8mPIXa8YI1MgUlEn6p1z7RBEQhFjYNsxA=";
   };
 
   # Source tree includes a vendor/ directory.
   vendorHash = null;
 
-  subPackages = [
-    "cmd/crane"
-    "cmd/gcrane"
-  ];
+  subPackages = [ "cmd/crane" "cmd/gcrane" ];
 
   ldflags = [
     "-s"
     "-w"
     "-X github.com/google/go-containerregistry/cmd/crane/cmd.Version=v${version}"
     "-X github.com/google/go-containerregistry/internal/version.Version=${version}"
   ];
-  env = {
-    CGO_ENABLED = 0;
-  };
+  env = { CGO_ENABLED = 0; };
   nativeBuildInputs = [ installShellFiles ];
 
   postInstall = "";

go.sum

@@ -33,8 +33,8 @@
     inherit src;
     # vendorHash differs per OS because `go mod vendor` applies build constraints.
     vendorHash = if lib.hasSuffix "-darwin" system
-      then "sha256-dIdEIzV/ZPxbfKn73g8vydjqrP1osIGoq2hnqtqAaIo="
-      else "sha256-vRd0SFu7i6NQOQCqLZDXaMxnMgq1TYjkD/fZsF3Q9NQ=";
+      then "sha256-Z36CfY7CqDwnGaeT/3kr8+LL7Uu7Sg0E3nvvnUg8bcM="
+      else "sha256-hxKsFo9eeLWcJQxrKGgzMpfzqQxZxk4dzrjTbMIgxMo=";
     inherit ldflags;
     buildFlags =
       [ "-trimpath" ]; # compiler-level flag, mirrors Makefile FLAGS

nix/crane.nix

@@ -3,14 +3,12 @@ name = "devguard-scanner-tools"
 version = "0.1.0"
 requires-python = ">=3.13"
 dependencies = [
-    "semgrep==1.157.0",
-    "checkov==3.2.517",
+    "semgrep==1.161.0",
+    "checkov==3.2.526",
 ]
 
 [tool.uv]
 # Pin transitive deps to versions that fix known CVEs.
 # These constraints are enforced during `uv lock` and captured in uv.lock —
 # no manual Nix overrides needed.
-constraint-dependencies = [
-    "aiohttp==3.13.4",
-]
+constraint-dependencies = []

nix/devguard.nix

@@ -4,19 +4,19 @@
 
 buildGoModule rec {
   pname = "trivy";
-  version = "0.69.3";
+  version = "0.70.0";
 
   src = fetchFromGitHub {
     owner = "aquasecurity";
     repo = "trivy";
     rev = "v${version}";
-    hash = "sha256-lzFcLyrORA+1LxS4nzJVvilg29GTNiGRmnjJ47ev/yU=";
+    hash = "sha256-xMj5xA/q3ekMW8k1aHCKa5hsYZSFShghOO5K6MnDCBo=";
   };
 
   # vendor hash differs across Linux and Darwin builds — bypass the source
   # vendor dir entirely and fetch modules via the Go module proxy.
   proxyVendor = true;
-  vendorHash = "sha256-aqSB2pakYH713GSbIAHwAL9Gio17MzZtwqfh9sbzDBs=";
+  vendorHash = "sha256-VbkCDzSF8gHxXpzzNxtPVRqUn/4l0AVHNzlsOKmXNG8=";
 
   subPackages = [ "cmd/trivy" ];