[dependabot]

Bumps the go-modules group with 4 updates: github.com/anchore/syft, github.com/docker/cli, github.com/huandu/xstrings and google.golang.org/api.

Updates github.com/anchore/syft from 1.54.1 to 1.55.0

Release notes

Sourced from github.com/anchore/syft's releases.

v1.55.0

Added Features

• Add support for scanning IPK packages using the deb-archive-cataloger [PR #5111 @​skyhisi]

Bug Fixes

• Pin Gguff lib to prevent dropping packages [PR #5447 @​spiffcs]
• Licensing: copyright holder missing, needed for Debian packaging [Issue #5394] [PR #5414 @​wagoodman]
• Syft cli.Command() panics when invoked multiple times [Issue #2285] [PR #5386 @​JasonMetal]

Additional Changes

• bump go-make module and action together [PR #5415 @​wagoodman]

Dependencies

49 dependency changes (46 updated, 1 added, 2 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GO-2026-6603 (High) — golang.org/x/net
• GO-2026-6610 (High) — golang.org/x/net
• GO-2026-6611 (High) — golang.org/x/net
• GO-2026-6612 (Critical) — golang.org/x/net
• GO-2026-6617 (High) — golang.org/x/net

• cloud.google.com/go/auth v0.23.2 → v0.23.3
• cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
• cloud.google.com/go/storage v1.65.1 → v1.68.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
• github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
• github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
• github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
• github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
• github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
• github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
• github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
• github.com/github/go-spdx/v2 v2.7.0 → v2.7.1

... (truncated)

Commits

• f15c334 Pin Gguff lib to prevent dropping packages (#5447)
• a811932 chore(deps): bump github.com/hashicorp/go-getter from 1.8.9 to 1.8.10 (#5436)
• 50ea429 chore(deps): bump actions/download-artifact from 8.0.1 to 8.0.2 (#5433)
• 83ba830 chore(deps): bump github.com/gookit/color from 1.6.1 to 1.6.2 (#5435)
• 0f1cd9c chore(deps): bump actions/upload-artifact from 7.0.1 to 7.0.2 (#5432)
• 758c232 chore(deps): bump github.com/github/go-spdx/v2 from 2.7.0 to 2.7.1 (#5434)
• 30200f1 fix: upgrade to golang.org/x/net v0.61.0 (#5427)
• ddc490c chore(deps): update anchore dependencies (#5387)
• 46bac23 chore(deps): bump golang.org/x/tools from 0.50.0 to 0.51.0 (#5417)
• 07752f0 chore(deps): bump github.com/go-git/go-git/v5 from 5.19.2 to 5.19.3 (#5416)
• Additional commits viewable in compare view

Updates github.com/docker/cli from 29.9.1+incompatible to 29.9.2+incompatible

Commits

• a82e528 Merge pull request #7418 from vvoland/7417-29.x
• e35bc1b Update to go1.26.10
• baf6c13 Bump version
• 4051f75 Merge tag 'v29.9.1' into 7417-29.x
• 76321a6 Merge tag 'v29.9.0' into 7417-29.x
• b82456c Merge tag 'v29.8.2' into 7417-29.x
• a98becc Bump version
• See full diff in compare view

Updates github.com/huandu/xstrings from 1.6.2 to 1.6.3

Release notes

Sourced from github.com/huandu/xstrings's releases.

Bug fixes for ExpandTabs, Squeeze, justification and first-rune case mapping

This release fixes invalid UTF-8 handling in ExpandTabs, Squeeze and the justification helpers, and makes FirstRuneToUpper / FirstRuneToLower honor all Unicode case mappings.

Most fixes preserve bytes which were not supposed to be changed. As a result, invalid UTF-8 bytes are no longer rewritten as U+FFFD in these functions; valid UTF-8 output is unchanged.

Bug fixes

ExpandTabs: invalid bytes after the first tab

ExpandTabs copied the input prefix before the first tab, but every later rune was written back with WriteRune. Invalid bytes decode to utf8.RuneError and were rewritten as U+FFFD, so the same byte was preserved before a tab and corrupted after it.

• ExpandTabs("\t\xffx", 4) returned " \uFFFDx" instead of " \xffx".
• ExpandTabs("\xff\t\xfe", 4) returned "\xff \uFFFD" instead of "\xff \xfe".

Non-tab bytes are now copied unchanged.

Squeeze: retained bytes and duplicate detection

Two separate issues affected invalid input:

• After the first squeeze, retained runes were written with WriteRune, rewriting invalid bytes as U+FFFD: Squeeze("aa\xffb", "a") returned "a\uFFFDb" instead of "a\xffb", and even a non-matching pattern such as "z" changed the bytes (#73).
• Duplicate detection compared decoded runes. Every invalid byte decodes to RuneError, so distinct invalid bytes, and an invalid byte next to a valid U+FFFD, were treated as repeated runes and collapsed: Squeeze("\xff\xfe", "") returned "\xff" and Squeeze("\xff\uFFFD", "") returned "\xff" (#76).

Retained bytes are now copied unchanged, and adjacent runes are compared by their original bytes. Identical bytes still squeeze normally when the rune is eligible for squeezing, while distinct sequences are kept.

LeftJustify, RightJustify, Center: truncated pad strings

When the pad string was cut in the middle of its runes, writePadString decoded each pad rune and wrote it back with WriteRune. Invalid bytes in that partial pad became U+FFFD, although complete pad repetitions were already copied unchanged.

• LeftJustify("a", 3, "x\xffy") returned "ax\uFFFD" instead of "ax\xff".
• RightJustify("a", 2, "\xffx") returned "\uFFFDa" instead of "\xffa".
• Center("a", 4, "x\xffy") returned "xax\uFFFD" instead of "xax\xff".

Partial pad bytes are now copied unchanged (#75).

FirstRuneToUpper / FirstRuneToLower: Unicode case mappings outside Ll/Lu

The functions only changed the first rune when unicode.IsLower / unicode.IsUpper was true. Characters with case mappings outside those categories were skipped, including titlecase digraphs, Roman numerals and circled letters.

• FirstRuneToUpper("Džuro") returned "Džuro" instead of "DŽuro".
• FirstRuneToLower("Džuro") returned "Džuro" instead of "džuro".
• FirstRuneToUpper("ⅳ chapter") returned "ⅳ chapter" instead of "Ⅳ chapter".
• FirstRuneToUpper("ⓐ label") returned "ⓐ label" instead of "Ⓐ label".

The functions now apply unicode.ToUpper / unicode.ToLower and return the original string when the first rune has no mapping. Suffixes, uncased runes and invalid UTF-8 are handled as before (#72).

Behaviour changes

• FirstRuneToUpper and FirstRuneToLower now change every rune with a standard Unicode simple case mapping, not only runes in Ll/Lu. This includes titlecase, letterlike and circled characters.
• ExpandTabs, Squeeze, LeftJustify, RightJustify and Center now preserve invalid UTF-8 bytes instead of rewriting them as U+FFFD in the affected paths. The output is byte-preserving, but remains invalid UTF-8 if the input is invalid. Valid UTF-8 results are unchanged.

... (truncated)

Commits

• 28aabeb Merge pull request #76 from huandu/fix/squeeze-byte-equality
• 2584c02 Distinguish invalid bytes when squeezing strings
• 51092b1 Merge pull request #75 from huandu/fix/justify-preserve-pad-bytes
• 3ded970 Merge pull request #74 from yuefdev/fix/expandtabs-preserve-bytes-sol
• 51da7c1 Merge pull request #73 from yuefdev/fix/squeeze-preserve-bytes
• 2128155 Merge pull request #72 from ac1982/fix/first-rune-unicode-case
• e9f44f0 Preserve pad bytes when justifying strings
• 8292f9c Preserve untouched bytes when expanding tabs
• 95eed7c Preserve untouched bytes when squeezing strings
• 5225f07 Honor Unicode case mappings for the first rune
• See full diff in compare view

Updates google.golang.org/api from 0.304.0 to 0.305.0

Release notes

Sourced from google.golang.org/api's releases.

v0.305.0

0.305.0 (2026-10-18)

Features

• all: Auto-regenerate discovery clients (#3774) (d5374f1)
• all: Auto-regenerate discovery clients (#3776) (a306b7a)
• all: Auto-regenerate discovery clients (#3777) (abd2ce1)

Changelog

Sourced from google.golang.org/api's changelog.

0.305.0 (2026-10-18)

Features

• all: Auto-regenerate discovery clients (#3774) (d5374f1)
• all: Auto-regenerate discovery clients (#3776) (a306b7a)
• all: Auto-regenerate discovery clients (#3777) (abd2ce1)

Commits

• b51045e chore(main): release 0.305.0 (#3775)
• abd2ce1 feat(all): auto-regenerate discovery clients (#3777)
• a306b7a feat(all): auto-regenerate discovery clients (#3776)
• d5374f1 feat(all): auto-regenerate discovery clients (#3774)
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions