Update anchore/scan-action action to v7

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
anchore/scan-action	action	major	v2.0.0 → v7.3.1

---

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

---

Release Notes

anchore/scan-action (anchore/scan-action)

v7.3.1

Compare Source

v7.3.1

⬆️ Dependencies

• chore(deps): update Grype to v0.106.0 (#​583) [@​anchore-actions-token-generator[bot]]
• chore(deps): bump lodash from 4.17.21 to 4.17.23 (#​580) [@​dependabot[bot]]

v7.3.0

Compare Source

New in scan-action v7.3.0

⬆️ Dependencies

• chore(deps): bump @​actions/tool-cache from 2.0.2 to 3.0.0 (#​567) [@​dependabot]
• chore(deps): bump @​actions/cache from 5.0.1 to 5.0.2 (#​568) [@​dependabot]
• chore(deps): bump @​actions/core from 2.0.1 to 2.0.2 (#​569) [@​dependabot]
• chore(deps-dev): bump tar from 7.5.2 to 7.5.3 (#​574) [@​dependabot]
• chore(deps): update Grype to v0.105.0 (#​572) [@​anchore-actions-token-generator[bot]]

v7.2.3

Compare Source

New in scan-action v7.2.3

• chore(deps): update Grype to v0.104.4 (#​566) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• chore(deps): bump @​actions/cache from 4.1.0 to 5.0.1 (#​563) [[dependabot[bot]](https://github.com/dependabot[bot])]

v7.2.2

Compare Source

New in scan-action v7.2.2

• update Grype to v0.104.2 (#​557) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• bump glob from 10.4.5 to 10.5.0 (#​546) [[dependabot[bot]](https://github.com/dependabot[bot])]

v7.2.1

Compare Source

New in scan-action v7.2.1

• updated Grype to v0.104.1 (#​550) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• bump js-yaml from 3.14.1 to 3.14.2 (#​544) [[dependabot[bot]](https://github.com/dependabot[bot])]

v7.2.0

Compare Source

New in scan-action v7.2.0

• chore(deps): update Grype to v0.104.0 (#​541) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• chore(deps-dev): bump tar from 7.5.1 to 7.5.2 (#​538) [[dependabot[bot]](https://github.com/dependabot[bot])]
• chore(deps-dev): bump eslint from 9.38.0 to 9.39.0 (#​539) [[dependabot[bot]](https://github.com/dependabot[bot])]

v7.1.0

Compare Source

New in scan-action v7.1.0

• chore(deps): update Grype to v0.102.0 (#​536) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• chore(deps-dev): bump lint-staged from 16.2.5 to 16.2.6 (#​535) [[dependabot[bot]](https://github.com/dependabot[bot])]
• chore(deps-dev): bump eslint from 9.37.0 to 9.38.0 (#​533) [[dependabot[bot]](https://github.com/dependabot[bot])]
• chore(deps-dev): bump lint-staged from 16.2.4 to 16.2.5 (#​534) [[dependabot[bot]](https://github.com/dependabot[bot])]

v7.0.2

Compare Source

New in scan-action v7.0.2

• chore(deps): update Grype to v0.101.1 (#​532) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]

v7.0.1

Compare Source

scan-action v7.0.1

v7.0.0

Compare Source

New in scan-action v7.0.0

• chore(deps): update Grype to v0.100.0 (#​516)

v6.5.1

Compare Source

New in scan-action v6.5.1

• Update Grype to v0.97.1 (#​495)

v6.5.0

Compare Source

New in scan-action v6.5.0

• Update Grype to v0.96.1 (#​493) [[anchore-actions-token-generator[bot]](https://github.com/anchore-actions-token-generator[bot])]
• fix: output stderr for nonzero exit code (#​491) [kzantow]

v6.4.0

Compare Source

New in scan-action v6.4.0

• Update Grype to v0.95.0 (#​486)
• chore(deps-dev): bump eslint from 9.30.0 to 9.30.1 (#​485)
• chore(deps-dev): bump lint-staged from 16.1.0 to 16.1.2 (#​476)
• chore(deps-dev): bump jest from 30.0.0 to 30.0.3 (#​481)
• chore(deps-dev): bump prettier from 3.5.3 to 3.6.2 (#​483)
• chore(deps-dev): bump eslint from 9.28.0 to 9.30.0 (#​484)

v6.3.0

Compare Source

New in scan-action v6.3.0

• Update Grype to v0.94.0 (#​470)

v6.2.0

Compare Source

New in scan-action v6.2.0

• feat: update Scan action to use grype db v6 (#​462) [spiffcs]

v6.1.0

Compare Source

New in scan-action v6.1.0

• Feature (deps): update Grype to v0.87.0 (#​430)
  • See Grype changes for new updates

v6.0.0

Compare Source

New in scan-action v6.0.0

Breaking Change

• feat: add output-file option, default to random directory output in temp (#​346) [kzantow]

The action no longer generates files in your working directory by default, instead you should use the action outputs: ${{ steps.<id>.outputs.sarif }} where the <id> needs to match the id you configured to reference the scan-action, e.g.:

      - uses: anchore/scan-action@v6
        id: scan
        ...
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: ${{ steps.scan.outputs.sarif }}

Other Changes

• chore(deps): update Grype to v0.86.1 (#​416) [anchore-actions-token-generator]
• feat: add support for cyclonedx and cyclonedx-json output-formats (#​396) [ps-e]
• chore(deps): bump @​actions/cache from 3.3.0 to 4.0.0 (#​412) [dependabot]
• chore(deps): update Grype to v0.86.0 (#​413) [anchore-actions-token-generator]

v5.3.0

Compare Source

New in scan-action v5.3.0

• chore(deps): update Grype to v0.85.0 (#​408) [anchore-actions-token-generator]
• chore(deps-dev): bump @​vercel/ncc from 0.38.2 to 0.38.3 (#​406) [dependabot]
• chore(deps-dev): bump eslint from 9.14.0 to 9.15.0 (#​405) [dependabot]
• chore(deps-dev): bump husky from 9.1.6 to 9.1.7 (#​407) [dependabot]

v5.2.1

Compare Source

New in scan-action v5.2.1

• update Grype to v0.84.0 (#​404) [anchore-actions-token-generator]
• bump @​actions/cache from 3.2.4 to 3.3.0 (#​402) [dependabot]

v5.2.0

Compare Source

New in scan-action v5.2.0

• chore(deps): update Grype to v0.83.0 (#​398) [anchore-actions-token-generator]
• chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#​394) [dependabot]
• chore(deps): bump actions/setup-node from 4.0.4 to 4.1.0 (#​395) [dependabot]

v5.1.0

Compare Source

New in scan-action v5.1.0

• chore(deps): update Grype to v0.82.2 (#​393) [anchore-actions-token-generator]
• chore(deps-dev): bump eslint from 9.12.0 to 9.13.0 (#​392) [dependabot]
• chore(deps-dev): bump tslib from 2.7.0 to 2.8.0 (#​391) [dependabot]

v5.0.1

Compare Source

New in scan-action v5.0.1

• chore(deps): update Grype to v0.82.1 (#​389) [anchore-actions-token-generator]

v5.0.0

Compare Source

New in scan-action v5.0.0

• chore(deps): update Grype to v0.82.0 (#​383) [anchore-actions-token-generator]

🚀 Features

• feat: short-lived grype-db cache (#​348) [kzantow]
  Note: with this release grype is no longer installed on $PATH. We suspect the changes here could break a number of users of the action who have learned to expect Grype be installed on $PATH.

v4.1.2

Compare Source

New in scan-action v4.1.2

• Update Grype to v0.80.0 (#​358) [anchore-actions-token-generator]

v4.1.1

Compare Source

New in scan-action v4.1.1

• chore(deps): update Grype to v0.79.6 (#​352) [anchore-actions-token-generator]
• Document grype-version parameter (#​319) [vprivat-ads]

v4.1.0

Compare Source

New in scan-action v4.1.0

• chore(deps): update Grype to v0.79.3 (#​341) [anchore-actions-token-generator]

v4.0.0

Compare Source

New in scan-action v4.0.0

• Update Grype to v0.79.2 (#​338) [anchore-actions-token-generator]
• Download Grype on Windows (#​336) [willmurphyscode] (#​315) [kzantow]
• Bump Node to v20 (#​295) [ViacheslavKudinov]

v3.6.4

Compare Source

New in scan-action v3.6.4

• Update Grype to v0.74.4 (#​279) [anchore-actions-token-generator]

v3.6.3

Compare Source

New in scan-action v3.6.3

• chore: migrate action to use node v20.11.0 (Iron) FROM node v16.x.x (#​278) [spiffcs]

v3.6.2

Compare Source

New in scan-action v3.6.2

• chore(deps): update Grype to v0.74.3 (#​275) [anchore-actions-token-generator]

v3.6.1

Compare Source

New in scan-action v3.6.1

• chore(deps): update Grype to v0.74.2 (#​272) [anchore-actions-token-generator]
• chore(deps-dev): bump prettier from 3.2.2 to 3.2.4 (#​270) [dependabot]

v3.6.0

Compare Source

New in scan-action v3.6.0

• chore(deps): update Grype to v0.74.1 (#​271) [anchore-actions-token-generator]
• chore(deps-dev): bump prettier from 3.1.1 to 3.2.2 (#​268) [dependabot]

v3.5.0

Compare Source

New in scan-action v3.5.0

• chore(deps): update Grype to v0.74.0 (#​267) [anchore-actions-token-generator]
• chore(deps): bump @​actions/core from 1.10.0 to 1.10.1 (#​262) [dependabot]

v3.4.0

Compare Source

New in scan-action v3.4.0

• chore(deps-dev): bump tslib from 2.5.0 to 2.6.2 (#​258) [dependabot]
• chore(deps-dev): bump @​vercel/ncc from 0.36.1 to 0.38.1 (#​261) [dependabot]
• chore(deps): update Grype to v0.73.5 (#​264) [anchore-actions-token-generator]
• Add support for the --vex flag (#​254) [ferozsalam]

v3.3.8

Compare Source

New in scan-action v3.3.8

• Update Grype to v0.73.4 (#​252) [anchore-actions-token-generator]
• Add input grype-version (#​228) [ViacheslavKudinov]
• Chore: upgrade and pin all GH actions (#​250) [willmurphyscode]

v3.3.7

Compare Source

New in scan-action v3.3.7

• chore: address test flakes (#​249) [willmurphyscode]
• chore(deps): update Grype to v0.73.3 (#​248) [anchore-actions-token-generator]
• chore: add manual trigger to test workflow (#​247) [willmurphyscode]
• fix: updated semver version (#​241) [gicappa]
• chore(docs): update docker related actions to avoid warnings in workflow (#​240) [kuzm1ch]
• chore: add new exception for audit (#​235) [spiffcs]
• chore(deps): update Grype to v0.63.1 (#​233) [anchore-actions-token-generator]
• Add by-cve option (#​229) [too-gee]
• add oss community board auto-add workflow (#​231) [wagoodman]

🐛 Bug Fixes

• chore(deps): update Grype to v0.73.2; remove snapshot tests (#​236) [anchore-actions-token-generator]

v3.3.6

Compare Source

New in scan-action v3.3.6

• chore(deps): update Grype to v0.63.0 (#​225) [anchore-actions-token-generator]
• chore: update grype update (#​224) [kzantow]
• chore: update deprecated set-output call (#​223) [kzantow]

v3.3.5

Compare Source

New in scan-action v3.3.5

• Set json output (#​222) [kklopfenstein]
• Update Grype to v0.60.0 (#​221) [anchore-actions-token-generator]
• Add input for --add-cpes-if-none flag (#​219) [sebhoss]

v3.3.4

Compare Source

New in scan-action v3.3.4

• Update Grype to v0.56.0 (#​205)

v3.3.3

Compare Source

New in scan-action v3.3.3

• Add only-fixed option (#​208) [lucacome]
• Update Grype to v0.54.0 (#​204) [anchore-actions-token-generator]

v3.3.2

Compare Source

New in scan-action v3.3.2

• Include process environment into grype execution (#​202) [erhan- + kzantow]

v3.3.1

Compare Source

New in scan-action v3.3.1

• Update Grype to v0.52.0 (#​201) [anchore-actions-token-generator]

v3.3.0

Compare Source

New in scan-action v3.3.0

• Add output-format and allow json to be used (#​184,#​187) [GiliFaroEnv0 + maartenh]
• Add table option for output-format to show vulnerabilities in console (#​135) [ken-chou-finn + kzantow]
• Update Grype to v0.50.1 (#​191) [anchore-actions-token-generator]

v3.2.5

Compare Source

New in scan-action v3.2.5

• Update node versions to v16 from v12 (#​176) [spiffcs]
• Update Grype to v0.38.0 (#​173)

v3.2.4

Compare Source

New in scan-action v3.2.4

• Update Grype to v0.34.7 (#​163)
• More closely align parameters with sbom-action (#​158)

v3.2.3

Compare Source

New in scan-action v3.2.3

• Support SBOM input for scanning (#​154) [@​harmw]

v3.2.2

Compare Source

New in scan-action v3.2.2

• Add sub-action to download Grype (#​152)
• Update Grype to 0.34.4 to fix a nil pointer in SARIF generation (#​151)

v3.2.1

Compare Source

New in scan-action v3.2.1

• Remove SARIF processing (#​148)

v3.2.0

Compare Source

New in scan-action v3.2.0

• Update Grype to 0.27.3 (#​136)
• Output Grype stderr to action logs (#​137)
• Readme should point to CONTRIBUTING.md (#​126)
• Improve documentation (#​125)

v3.1.0

Compare Source

New in scan-action v3.1.0

• Update Grype to 0.22.0 - this includes the ability to ignore vulnerability matches (#​121)

v3.0.0

Compare Source

New in scan-action v3.0.0

• Upgrade to Grype to 0.17.0 and add tests #​102 (#​112) (#​118)
• Improve SARIF output #​114 (#​115)
• Change default behavior so action fails on medium (and higher) severities (#​86)
• Respect verbosity from action to call Grype (#​82)

v2.0.4

Compare Source

New in scan-action v2.0.4

• bump grype to 0.7.0 (#​81)

v2.0.3

Compare Source

New in scan-action 2.0.3

• bump grype to 0.6.1 (#​79)
• Halt execution when invalid options are provided (#​76)
• bump grype to 0.5.0 (#​75)

v2.0.2

Compare Source

Minor bug-fix release:

• Update actions/core to use version 1.2.6 (Issue #​71)

v2.0.1

Compare Source

Minor bug-fix release.

Fixes:

• Removes unnecessary constraint in deduplication for SARIF reporting
• Allows defining and referencing the location of the SARIF report file
• Fixes multiple instances where undefined items in the reporting would break scanning

---

Configuration

📅 Schedule: Branch creation - "after 10pm every weekday,before 5am every weekday,every weekend" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot

See analysis details on SonarQube Cloud