grype

Additional Changes

• further CPE to more precise package identifier mappings PR [#3886 @westonsteimel]

Dependencies

18 dependency changes (8 updated, 10 removed). 8 vulnerabilities remediated.

🟢 Remediated (8)

• GHSA-pxq6-2prw-chj9 (Medium) — github.com/docker/docker
• GHSA-rg2x-37c3-w2rh (High) — github.com/docker/docker
• GHSA-vp62-88p7-qqf5 (Medium) — github.com/docker/docker
• GHSA-x86f-5xw2-fm2r (High) — github.com/docker/docker
• GO-2026-4887 (High) — github.com/docker/docker
• GO-2026-6860 (High) — golang.org/x/net
• GO-2026-6866 (Medium) — golang.org/x/net
• GO-2026-6888 (Critical) — github.com/andybalholm/brotli

Updated (8 packages)

• github.com/anchore/syft v1.57.0 → v1.57.1
• github.com/andybalholm/brotli v1.2.0 → v1.2.8 (🟢 remediated GO-2026-6888)
• github.com/bmatcuk/doublestar/v4 v4.10.3 → v4.10.4
• github.com/gkampitakis/go-snaps v0.5.24 → v0.5.25
• github.com/gpustack/gguf-parser-go v0.27.0 → v0.28.1
• github.com/moby/sys/mountinfo v0.7.2 → v0.7.3
• go.yaml.in/yaml/v3 v3.0.5 → v3.0.6
• golang.org/x/net v0.61.0 → v0.62.0 (🟢 remediated GO-2026-6860, GO-2026-6866)

Removed (10 packages)

• github.com/cenkalti/backoff/v5 v5.0.3
• github.com/docker/docker v28.5.2+incompatible (🟢 remediated GHSA-pxq6-2prw-chj9, GHSA-rg2x-37c3-w2rh, GHSA-vp62-88p7-qqf5, GHSA-x86f-5xw2-fm2r, GO-2026-4887)
• github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0
• github.com/moby/sys/atomicwriter v0.1.0
• github.com/moby/sys/sequential v0.6.0
• github.com/moby/term v0.5.2
• github.com/morikuni/aec v1.1.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.46.0
• go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.46.0
• go.opentelemetry.io/proto/otlp v1.11.0

(Full Changelog)