all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fef9:c897
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 60895962-c779-4af7-96de-f143b6600b01
        host_id: 063a101b67161296bfe4ca59644a37fa2e240be637ab6c95039adf80
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fef9:c897
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.108
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.165
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fef9:c897
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/release/.zuul.yaml@main#2>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: ed3da2970a164139a6441ccdc2e84a7f
      build_refs:
      - branch: main
        change: '2368'
        change_message: "chore(deps): update anchore/syft docker tag to v1.41.0\n\nThis
          PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.38.0`
          \u2192 `v1.41.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
          (anchore/syft)</summary>\n\n### [`v1.41.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.41.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)\n\n#####
          Added Features\n\n- detect Debian version from /etc/debian\\_version \\[[#&#8203;4569](https://redirect.github.com/anchore/syft/pull/4569)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n##### Bug Fixes\n\n-
          correctly report supporting evidence for binary packages \\[[#&#8203;4558](https://redirect.github.com/anchore/syft/pull/4558)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n**[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)**\n\n###
          [`v1.40.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.1)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)\n\n>
          \\[!Important]\n> This release bumps github.com/containerd/containerd to
          v2, which will cause compiler errors if used alongside other dependencies
          that use v1 of containerd. See [anchore/stereoscope#495](https://redirect.github.com/anchore/stereoscope/pull/495)
          for a detailed discussion.\n\n##### Bug Fixes\n\n- mongodb binary not detected
          manual/source install \\[[#&#8203;4540](https://redirect.github.com/anchore/syft/issues/4540)
          [#&#8203;4541](https://redirect.github.com/anchore/syft/pull/4541) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)**\n\n###
          [`v1.40.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)\n\n#####
          Added Features\n\n- Exclude development or test dependencies for PNPM Package
          type \\[[#&#8203;4430](https://redirect.github.com/anchore/syft/issues/4430)
          [#&#8203;4487](https://redirect.github.com/anchore/syft/pull/4487) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Catalog istio binary (pilot-discovery, pilot-agent) \\[[#&#8203;4508](https://redirect.github.com/anchore/syft/issues/4508)
          [#&#8203;4521](https://redirect.github.com/anchore/syft/pull/4521) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Catalog envoy binary \\[[#&#8203;4506](https://redirect.github.com/anchore/syft/issues/4506)
          [#&#8203;4530](https://redirect.github.com/anchore/syft/pull/4530) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Catalog grafana binary \\[[#&#8203;4505](https://redirect.github.com/anchore/syft/issues/4505)
          [#&#8203;4516](https://redirect.github.com/anchore/syft/pull/4516) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Add a binary classifier for valkey \\[[#&#8203;3400](https://redirect.github.com/anchore/syft/issues/3400)
          [#&#8203;4509](https://redirect.github.com/anchore/syft/pull/4509) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n\n#####
          Bug Fixes\n\n- old bitnami images without spdx files arent getting picked
          up correctly in the catalog \\[[#&#8203;4529](https://redirect.github.com/anchore/syft/issues/4529)
          [#&#8203;4532](https://redirect.github.com/anchore/syft/pull/4532) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          wrong traefik rc versions at binary detection \\[[#&#8203;3535](https://redirect.github.com/anchore/syft/issues/3535)
          [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          FromPOSIX() in internals\\windows\\path.go assumes that all Windows root
          paths must have a colon terminator \\[[#&#8203;4070](https://redirect.github.com/anchore/syft/issues/4070)
          [#&#8203;4075](https://redirect.github.com/anchore/syft/pull/4075) [@&#8203;luissantosHCIT](https://redirect.github.com/luissantosHCIT)]\n-
          binary cataloger is picking up the go version instead of the actual binary
          version in traefik experimental images \\[[#&#8203;4498](https://redirect.github.com/anchore/syft/issues/4498)
          [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)**\n\n###
          [`v1.39.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.39.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)\n\n#####
          Added Features\n\n- add support for Gemfile.next.lock \\[[#&#8203;4457](https://redirect.github.com/anchore/syft/pull/4457)
          [@&#8203;HatiCode](https://redirect.github.com/HatiCode)]\n- Command output
          to give more information on what catalogers look for and what they can find
          \\[[#&#8203;4155](https://redirect.github.com/anchore/syft/issues/4155)
          [#&#8203;4317](https://redirect.github.com/anchore/syft/pull/4317) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Support reading lzma compressed `.go.buildinfo` sections with upx \\[[#&#8203;4411](https://redirect.github.com/anchore/syft/issues/4411)
          [#&#8203;4480](https://redirect.github.com/anchore/syft/pull/4480) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Specify specific snap revision to pull \\[[#&#8203;4389](https://redirect.github.com/anchore/syft/issues/4389)
          [#&#8203;4439](https://redirect.github.com/anchore/syft/pull/4439) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Cannot detect embedded deps.json metadata in single-file .NET binaries \\[[#&#8203;4344](https://redirect.github.com/anchore/syft/issues/4344)
          [#&#8203;4375](https://redirect.github.com/anchore/syft/pull/4375) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          ELF note cataloger does not pick up OS field, but should \\[[#&#8203;4384](https://redirect.github.com/anchore/syft/issues/4384)
          [#&#8203;4438](https://redirect.github.com/anchore/syft/pull/4438) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n\n#####
          Bug Fixes\n\n- remove debug print statement in dependency parser \\[[#&#8203;4412](https://redirect.github.com/anchore/syft/pull/4412)
          [@&#8203;cgreeno](https://redirect.github.com/cgreeno)]\n- dotnet-deps cataloger
          should skip project references with type \"project\" when building the sbom
          \\[[#&#8203;4423](https://redirect.github.com/anchore/syft/issues/4423)
          [#&#8203;4436](https://redirect.github.com/anchore/syft/pull/4436) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          File digests not computed when using `--base-path` \\[[#&#8203;4410](https://redirect.github.com/anchore/syft/issues/4410)
          [#&#8203;4478](https://redirect.github.com/anchore/syft/pull/4478) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Syft should not define subpaths by default in PURLs \\[[#&#8203;4394](https://redirect.github.com/anchore/syft/issues/4394)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          go: valid purl but incorrect name \\[[#&#8203;1737](https://redirect.github.com/anchore/syft/issues/1737)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Incorrect Go module PURL generation when module path contains /vN (e.g.
          /v5) \\[[#&#8203;4316](https://redirect.github.com/anchore/syft/issues/4316)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Failing to convert npm repository information correctly to SPDX \\[[#&#8203;4362](https://redirect.github.com/anchore/syft/issues/4362)
          [#&#8203;4390](https://redirect.github.com/anchore/syft/pull/4390) [@&#8203;kendrickm](https://redirect.github.com/kendrickm)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)**\n\n###
          [`v1.38.2`](https://redirect.github.com/anchore/syft/releases/tag/v1.38.2)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.1...v1.38.2)\n\n#####
          Bug Fixes\n\n- drop cpe from gguf \\[[#&#8203;4383](https://redirect.github.com/anchore/syft/pull/4383)
          [@&#8203;spiffcs](https://redirect.github.com/spiffcs)]\n- emit lua rockspec
          dependencies in metadata \\[[#&#8203;4376](https://redirect.github.com/anchore/syft/pull/4376)
          [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
          Invalid SBOMs are created when GO replace directive is used \\[[#&#8203;4415](https://redirect.github.com/anchore/syft/issues/4415)
          [#&#8203;4419](https://redirect.github.com/anchore/syft/pull/4419) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Incorrect CPE for Vercel's Next js \\[[#&#8203;4443](https://redirect.github.com/anchore/syft/issues/4443)
          [#&#8203;4450](https://redirect.github.com/anchore/syft/pull/4450) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
          v1.38.0 generates empty sbom for tgz sources \\[[#&#8203;4416](https://redirect.github.com/anchore/syft/issues/4416)
          [#&#8203;4421](https://redirect.github.com/anchore/syft/pull/4421) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Syft: The dependency graph does not include all Requires-Dist relationships
          defined in the package\u2019s METADATA file \\[[#&#8203;4401](https://redirect.github.com/anchore/syft/issues/4401)
          [#&#8203;4408](https://redirect.github.com/anchore/syft/pull/4408) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.2)**\n\n###
          [`v1.38.1`](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time
          (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
          **Automerge**: Disabled by config. Please merge this manually once you are
          satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
          tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR
          and you won't be reminded about this update again.\n\n---\n\n - [ ] <!--
          rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis
          PR was generated by [Mend Renovate](https://mend.io/renovate/). View the
          [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuOTIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/osism/release/pull/2368
        commit_id: 9ac72384993e50a23d88610112bb2c94ae8f4348
        patchset: 9ac72384993e50a23d88610112bb2c94ae8f4348
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: e60c02bb54fb4ba081ca425fd4a420d7
      buildset_refs:
      - branch: main
        change: '2368'
        change_message: "chore(deps): update anchore/syft docker tag to v1.41.0\n\nThis
          PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.38.0`
          \u2192 `v1.41.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
          (anchore/syft)</summary>\n\n### [`v1.41.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.41.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)\n\n#####
          Added Features\n\n- detect Debian version from /etc/debian\\_version \\[[#&#8203;4569](https://redirect.github.com/anchore/syft/pull/4569)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n##### Bug Fixes\n\n-
          correctly report supporting evidence for binary packages \\[[#&#8203;4558](https://redirect.github.com/anchore/syft/pull/4558)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n**[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)**\n\n###
          [`v1.40.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.1)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)\n\n>
          \\[!Important]\n> This release bumps github.com/containerd/containerd to
          v2, which will cause compiler errors if used alongside other dependencies
          that use v1 of containerd. See [anchore/stereoscope#495](https://redirect.github.com/anchore/stereoscope/pull/495)
          for a detailed discussion.\n\n##### Bug Fixes\n\n- mongodb binary not detected
          manual/source install \\[[#&#8203;4540](https://redirect.github.com/anchore/syft/issues/4540)
          [#&#8203;4541](https://redirect.github.com/anchore/syft/pull/4541) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)**\n\n###
          [`v1.40.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)\n\n#####
          Added Features\n\n- Exclude development or test dependencies for PNPM Package
          type \\[[#&#8203;4430](https://redirect.github.com/anchore/syft/issues/4430)
          [#&#8203;4487](https://redirect.github.com/anchore/syft/pull/4487) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Catalog istio binary (pilot-discovery, pilot-agent) \\[[#&#8203;4508](https://redirect.github.com/anchore/syft/issues/4508)
          [#&#8203;4521](https://redirect.github.com/anchore/syft/pull/4521) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Catalog envoy binary \\[[#&#8203;4506](https://redirect.github.com/anchore/syft/issues/4506)
          [#&#8203;4530](https://redirect.github.com/anchore/syft/pull/4530) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Catalog grafana binary \\[[#&#8203;4505](https://redirect.github.com/anchore/syft/issues/4505)
          [#&#8203;4516](https://redirect.github.com/anchore/syft/pull/4516) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Add a binary classifier for valkey \\[[#&#8203;3400](https://redirect.github.com/anchore/syft/issues/3400)
          [#&#8203;4509](https://redirect.github.com/anchore/syft/pull/4509) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n\n#####
          Bug Fixes\n\n- old bitnami images without spdx files arent getting picked
          up correctly in the catalog \\[[#&#8203;4529](https://redirect.github.com/anchore/syft/issues/4529)
          [#&#8203;4532](https://redirect.github.com/anchore/syft/pull/4532) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          wrong traefik rc versions at binary detection \\[[#&#8203;3535](https://redirect.github.com/anchore/syft/issues/3535)
          [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          FromPOSIX() in internals\\windows\\path.go assumes that all Windows root
          paths must have a colon terminator \\[[#&#8203;4070](https://redirect.github.com/anchore/syft/issues/4070)
          [#&#8203;4075](https://redirect.github.com/anchore/syft/pull/4075) [@&#8203;luissantosHCIT](https://redirect.github.com/luissantosHCIT)]\n-
          binary cataloger is picking up the go version instead of the actual binary
          version in traefik experimental images \\[[#&#8203;4498](https://redirect.github.com/anchore/syft/issues/4498)
          [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)**\n\n###
          [`v1.39.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.39.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)\n\n#####
          Added Features\n\n- add support for Gemfile.next.lock \\[[#&#8203;4457](https://redirect.github.com/anchore/syft/pull/4457)
          [@&#8203;HatiCode](https://redirect.github.com/HatiCode)]\n- Command output
          to give more information on what catalogers look for and what they can find
          \\[[#&#8203;4155](https://redirect.github.com/anchore/syft/issues/4155)
          [#&#8203;4317](https://redirect.github.com/anchore/syft/pull/4317) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Support reading lzma compressed `.go.buildinfo` sections with upx \\[[#&#8203;4411](https://redirect.github.com/anchore/syft/issues/4411)
          [#&#8203;4480](https://redirect.github.com/anchore/syft/pull/4480) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Specify specific snap revision to pull \\[[#&#8203;4389](https://redirect.github.com/anchore/syft/issues/4389)
          [#&#8203;4439](https://redirect.github.com/anchore/syft/pull/4439) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Cannot detect embedded deps.json metadata in single-file .NET binaries \\[[#&#8203;4344](https://redirect.github.com/anchore/syft/issues/4344)
          [#&#8203;4375](https://redirect.github.com/anchore/syft/pull/4375) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          ELF note cataloger does not pick up OS field, but should \\[[#&#8203;4384](https://redirect.github.com/anchore/syft/issues/4384)
          [#&#8203;4438](https://redirect.github.com/anchore/syft/pull/4438) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n\n#####
          Bug Fixes\n\n- remove debug print statement in dependency parser \\[[#&#8203;4412](https://redirect.github.com/anchore/syft/pull/4412)
          [@&#8203;cgreeno](https://redirect.github.com/cgreeno)]\n- dotnet-deps cataloger
          should skip project references with type \"project\" when building the sbom
          \\[[#&#8203;4423](https://redirect.github.com/anchore/syft/issues/4423)
          [#&#8203;4436](https://redirect.github.com/anchore/syft/pull/4436) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          File digests not computed when using `--base-path` \\[[#&#8203;4410](https://redirect.github.com/anchore/syft/issues/4410)
          [#&#8203;4478](https://redirect.github.com/anchore/syft/pull/4478) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Syft should not define subpaths by default in PURLs \\[[#&#8203;4394](https://redirect.github.com/anchore/syft/issues/4394)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          go: valid purl but incorrect name \\[[#&#8203;1737](https://redirect.github.com/anchore/syft/issues/1737)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Incorrect Go module PURL generation when module path contains /vN (e.g.
          /v5) \\[[#&#8203;4316](https://redirect.github.com/anchore/syft/issues/4316)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Failing to convert npm repository information correctly to SPDX \\[[#&#8203;4362](https://redirect.github.com/anchore/syft/issues/4362)
          [#&#8203;4390](https://redirect.github.com/anchore/syft/pull/4390) [@&#8203;kendrickm](https://redirect.github.com/kendrickm)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)**\n\n###
          [`v1.38.2`](https://redirect.github.com/anchore/syft/releases/tag/v1.38.2)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.1...v1.38.2)\n\n#####
          Bug Fixes\n\n- drop cpe from gguf \\[[#&#8203;4383](https://redirect.github.com/anchore/syft/pull/4383)
          [@&#8203;spiffcs](https://redirect.github.com/spiffcs)]\n- emit lua rockspec
          dependencies in metadata \\[[#&#8203;4376](https://redirect.github.com/anchore/syft/pull/4376)
          [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
          Invalid SBOMs are created when GO replace directive is used \\[[#&#8203;4415](https://redirect.github.com/anchore/syft/issues/4415)
          [#&#8203;4419](https://redirect.github.com/anchore/syft/pull/4419) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Incorrect CPE for Vercel's Next js \\[[#&#8203;4443](https://redirect.github.com/anchore/syft/issues/4443)
          [#&#8203;4450](https://redirect.github.com/anchore/syft/pull/4450) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
          v1.38.0 generates empty sbom for tgz sources \\[[#&#8203;4416](https://redirect.github.com/anchore/syft/issues/4416)
          [#&#8203;4421](https://redirect.github.com/anchore/syft/pull/4421) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Syft: The dependency graph does not include all Requires-Dist relationships
          defined in the package\u2019s METADATA file \\[[#&#8203;4401](https://redirect.github.com/anchore/syft/issues/4401)
          [#&#8203;4408](https://redirect.github.com/anchore/syft/pull/4408) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.2)**\n\n###
          [`v1.38.1`](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time
          (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
          **Automerge**: Disabled by config. Please merge this manually once you are
          satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
          tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR
          and you won't be reminded about this update again.\n\n---\n\n - [ ] <!--
          rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis
          PR was generated by [Mend Renovate](https://mend.io/renovate/). View the
          [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuOTIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/osism/release/pull/2368
        commit_id: 9ac72384993e50a23d88610112bb2c94ae8f4348
        patchset: 9ac72384993e50a23d88610112bb2c94ae8f4348
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2368'
      change_message: "chore(deps): update anchore/syft docker tag to v1.41.0\n\nThis
        PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
        [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.38.0`
        \u2192 `v1.41.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
        (anchore/syft)</summary>\n\n### [`v1.41.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.41.0)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)\n\n#####
        Added Features\n\n- detect Debian version from /etc/debian\\_version \\[[#&#8203;4569](https://redirect.github.com/anchore/syft/pull/4569)
        [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n##### Bug Fixes\n\n-
        correctly report supporting evidence for binary packages \\[[#&#8203;4558](https://redirect.github.com/anchore/syft/pull/4558)
        [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n**[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)**\n\n###
        [`v1.40.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.1)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)\n\n>
        \\[!Important]\n> This release bumps github.com/containerd/containerd to v2,
        which will cause compiler errors if used alongside other dependencies that
        use v1 of containerd. See [anchore/stereoscope#495](https://redirect.github.com/anchore/stereoscope/pull/495)
        for a detailed discussion.\n\n##### Bug Fixes\n\n- mongodb binary not detected
        manual/source install \\[[#&#8203;4540](https://redirect.github.com/anchore/syft/issues/4540)
        [#&#8203;4541](https://redirect.github.com/anchore/syft/pull/4541) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
        Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)**\n\n###
        [`v1.40.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.0)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)\n\n#####
        Added Features\n\n- Exclude development or test dependencies for PNPM Package
        type \\[[#&#8203;4430](https://redirect.github.com/anchore/syft/issues/4430)
        [#&#8203;4487](https://redirect.github.com/anchore/syft/pull/4487) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
        Catalog istio binary (pilot-discovery, pilot-agent) \\[[#&#8203;4508](https://redirect.github.com/anchore/syft/issues/4508)
        [#&#8203;4521](https://redirect.github.com/anchore/syft/pull/4521) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
        Catalog envoy binary \\[[#&#8203;4506](https://redirect.github.com/anchore/syft/issues/4506)
        [#&#8203;4530](https://redirect.github.com/anchore/syft/pull/4530) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
        Catalog grafana binary \\[[#&#8203;4505](https://redirect.github.com/anchore/syft/issues/4505)
        [#&#8203;4516](https://redirect.github.com/anchore/syft/pull/4516) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
        Add a binary classifier for valkey \\[[#&#8203;3400](https://redirect.github.com/anchore/syft/issues/3400)
        [#&#8203;4509](https://redirect.github.com/anchore/syft/pull/4509) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n\n#####
        Bug Fixes\n\n- old bitnami images without spdx files arent getting picked
        up correctly in the catalog \\[[#&#8203;4529](https://redirect.github.com/anchore/syft/issues/4529)
        [#&#8203;4532](https://redirect.github.com/anchore/syft/pull/4532) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
        wrong traefik rc versions at binary detection \\[[#&#8203;3535](https://redirect.github.com/anchore/syft/issues/3535)
        [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
        FromPOSIX() in internals\\windows\\path.go assumes that all Windows root paths
        must have a colon terminator \\[[#&#8203;4070](https://redirect.github.com/anchore/syft/issues/4070)
        [#&#8203;4075](https://redirect.github.com/anchore/syft/pull/4075) [@&#8203;luissantosHCIT](https://redirect.github.com/luissantosHCIT)]\n-
        binary cataloger is picking up the go version instead of the actual binary
        version in traefik experimental images \\[[#&#8203;4498](https://redirect.github.com/anchore/syft/issues/4498)
        [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
        Changelog)](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)**\n\n###
        [`v1.39.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.39.0)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)\n\n#####
        Added Features\n\n- add support for Gemfile.next.lock \\[[#&#8203;4457](https://redirect.github.com/anchore/syft/pull/4457)
        [@&#8203;HatiCode](https://redirect.github.com/HatiCode)]\n- Command output
        to give more information on what catalogers look for and what they can find
        \\[[#&#8203;4155](https://redirect.github.com/anchore/syft/issues/4155) [#&#8203;4317](https://redirect.github.com/anchore/syft/pull/4317)
        [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n- Support reading
        lzma compressed `.go.buildinfo` sections with upx \\[[#&#8203;4411](https://redirect.github.com/anchore/syft/issues/4411)
        [#&#8203;4480](https://redirect.github.com/anchore/syft/pull/4480) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
        Specify specific snap revision to pull \\[[#&#8203;4389](https://redirect.github.com/anchore/syft/issues/4389)
        [#&#8203;4439](https://redirect.github.com/anchore/syft/pull/4439) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
        Cannot detect embedded deps.json metadata in single-file .NET binaries \\[[#&#8203;4344](https://redirect.github.com/anchore/syft/issues/4344)
        [#&#8203;4375](https://redirect.github.com/anchore/syft/pull/4375) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
        ELF note cataloger does not pick up OS field, but should \\[[#&#8203;4384](https://redirect.github.com/anchore/syft/issues/4384)
        [#&#8203;4438](https://redirect.github.com/anchore/syft/pull/4438) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n\n#####
        Bug Fixes\n\n- remove debug print statement in dependency parser \\[[#&#8203;4412](https://redirect.github.com/anchore/syft/pull/4412)
        [@&#8203;cgreeno](https://redirect.github.com/cgreeno)]\n- dotnet-deps cataloger
        should skip project references with type \"project\" when building the sbom
        \\[[#&#8203;4423](https://redirect.github.com/anchore/syft/issues/4423) [#&#8203;4436](https://redirect.github.com/anchore/syft/pull/4436)
        [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n- File digests not
        computed when using `--base-path` \\[[#&#8203;4410](https://redirect.github.com/anchore/syft/issues/4410)
        [#&#8203;4478](https://redirect.github.com/anchore/syft/pull/4478) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
        Syft should not define subpaths by default in PURLs \\[[#&#8203;4394](https://redirect.github.com/anchore/syft/issues/4394)
        [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
        go: valid purl but incorrect name \\[[#&#8203;1737](https://redirect.github.com/anchore/syft/issues/1737)
        [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
        Incorrect Go module PURL generation when module path contains /vN (e.g. /v5)
        \\[[#&#8203;4316](https://redirect.github.com/anchore/syft/issues/4316) [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395)
        [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n- Failing to convert
        npm repository information correctly to SPDX \\[[#&#8203;4362](https://redirect.github.com/anchore/syft/issues/4362)
        [#&#8203;4390](https://redirect.github.com/anchore/syft/pull/4390) [@&#8203;kendrickm](https://redirect.github.com/kendrickm)]\n\n**[(Full
        Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)**\n\n###
        [`v1.38.2`](https://redirect.github.com/anchore/syft/releases/tag/v1.38.2)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.38.1...v1.38.2)\n\n#####
        Bug Fixes\n\n- drop cpe from gguf \\[[#&#8203;4383](https://redirect.github.com/anchore/syft/pull/4383)
        [@&#8203;spiffcs](https://redirect.github.com/spiffcs)]\n- emit lua rockspec
        dependencies in metadata \\[[#&#8203;4376](https://redirect.github.com/anchore/syft/pull/4376)
        [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
        Invalid SBOMs are created when GO replace directive is used \\[[#&#8203;4415](https://redirect.github.com/anchore/syft/issues/4415)
        [#&#8203;4419](https://redirect.github.com/anchore/syft/pull/4419) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
        Incorrect CPE for Vercel's Next js \\[[#&#8203;4443](https://redirect.github.com/anchore/syft/issues/4443)
        [#&#8203;4450](https://redirect.github.com/anchore/syft/pull/4450) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
        v1.38.0 generates empty sbom for tgz sources \\[[#&#8203;4416](https://redirect.github.com/anchore/syft/issues/4416)
        [#&#8203;4421](https://redirect.github.com/anchore/syft/pull/4421) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
        Syft: The dependency graph does not include all Requires-Dist relationships
        defined in the package\u2019s METADATA file \\[[#&#8203;4401](https://redirect.github.com/anchore/syft/issues/4401)
        [#&#8203;4408](https://redirect.github.com/anchore/syft/pull/4408) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n\n**[(Full
        Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.2)**\n\n###
        [`v1.38.1`](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time (no
        schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
        **Automerge**: Disabled by config. Please merge this manually once you are
        satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
        tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR and
        you won't be reminded about this update again.\n\n---\n\n - [ ] <!-- rebase-check
        -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis PR was
        generated by [Mend Renovate](https://mend.io/renovate/). View the [repository
        job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuOTIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
      change_url: https://github.com/osism/release/pull/2368
      child_jobs: []
      commit_id: 9ac72384993e50a23d88610112bb2c94ae8f4348
      event_id: e80c1480-fbba-11f0-960a-fcfb3402a58e
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/ed3da2970a164139a6441ccdc2e84a7f/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/ed3da2970a164139a6441ccdc2e84a7f/work/logs
        result_data_file: /var/lib/zuul/builds/ed3da2970a164139a6441ccdc2e84a7f/work/results.json
        src_root: /var/lib/zuul/builds/ed3da2970a164139a6441ccdc2e84a7f/work/src
        work_root: /var/lib/zuul/builds/ed3da2970a164139a6441ccdc2e84a7f/work
      include_vars: []
      items:
      - branch: main
        change: '2368'
        change_message: "chore(deps): update anchore/syft docker tag to v1.41.0\n\nThis
          PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.38.0`
          \u2192 `v1.41.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
          (anchore/syft)</summary>\n\n### [`v1.41.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.41.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)\n\n#####
          Added Features\n\n- detect Debian version from /etc/debian\\_version \\[[#&#8203;4569](https://redirect.github.com/anchore/syft/pull/4569)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n##### Bug Fixes\n\n-
          correctly report supporting evidence for binary packages \\[[#&#8203;4558](https://redirect.github.com/anchore/syft/pull/4558)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n\n**[(Full Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.1...v1.41.0)**\n\n###
          [`v1.40.1`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.1)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)\n\n>
          \\[!Important]\n> This release bumps github.com/containerd/containerd to
          v2, which will cause compiler errors if used alongside other dependencies
          that use v1 of containerd. See [anchore/stereoscope#495](https://redirect.github.com/anchore/stereoscope/pull/495)
          for a detailed discussion.\n\n##### Bug Fixes\n\n- mongodb binary not detected
          manual/source install \\[[#&#8203;4540](https://redirect.github.com/anchore/syft/issues/4540)
          [#&#8203;4541](https://redirect.github.com/anchore/syft/pull/4541) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.40.0...v1.40.1)**\n\n###
          [`v1.40.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.40.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)\n\n#####
          Added Features\n\n- Exclude development or test dependencies for PNPM Package
          type \\[[#&#8203;4430](https://redirect.github.com/anchore/syft/issues/4430)
          [#&#8203;4487](https://redirect.github.com/anchore/syft/pull/4487) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Catalog istio binary (pilot-discovery, pilot-agent) \\[[#&#8203;4508](https://redirect.github.com/anchore/syft/issues/4508)
          [#&#8203;4521](https://redirect.github.com/anchore/syft/pull/4521) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Catalog envoy binary \\[[#&#8203;4506](https://redirect.github.com/anchore/syft/issues/4506)
          [#&#8203;4530](https://redirect.github.com/anchore/syft/pull/4530) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Catalog grafana binary \\[[#&#8203;4505](https://redirect.github.com/anchore/syft/issues/4505)
          [#&#8203;4516](https://redirect.github.com/anchore/syft/pull/4516) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n-
          Add a binary classifier for valkey \\[[#&#8203;3400](https://redirect.github.com/anchore/syft/issues/3400)
          [#&#8203;4509](https://redirect.github.com/anchore/syft/pull/4509) [@&#8203;witchcraze](https://redirect.github.com/witchcraze)]\n\n#####
          Bug Fixes\n\n- old bitnami images without spdx files arent getting picked
          up correctly in the catalog \\[[#&#8203;4529](https://redirect.github.com/anchore/syft/issues/4529)
          [#&#8203;4532](https://redirect.github.com/anchore/syft/pull/4532) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          wrong traefik rc versions at binary detection \\[[#&#8203;3535](https://redirect.github.com/anchore/syft/issues/3535)
          [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          FromPOSIX() in internals\\windows\\path.go assumes that all Windows root
          paths must have a colon terminator \\[[#&#8203;4070](https://redirect.github.com/anchore/syft/issues/4070)
          [#&#8203;4075](https://redirect.github.com/anchore/syft/pull/4075) [@&#8203;luissantosHCIT](https://redirect.github.com/luissantosHCIT)]\n-
          binary cataloger is picking up the go version instead of the actual binary
          version in traefik experimental images \\[[#&#8203;4498](https://redirect.github.com/anchore/syft/issues/4498)
          [#&#8203;4499](https://redirect.github.com/anchore/syft/pull/4499) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.39.0...v1.40.0)**\n\n###
          [`v1.39.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.39.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)\n\n#####
          Added Features\n\n- add support for Gemfile.next.lock \\[[#&#8203;4457](https://redirect.github.com/anchore/syft/pull/4457)
          [@&#8203;HatiCode](https://redirect.github.com/HatiCode)]\n- Command output
          to give more information on what catalogers look for and what they can find
          \\[[#&#8203;4155](https://redirect.github.com/anchore/syft/issues/4155)
          [#&#8203;4317](https://redirect.github.com/anchore/syft/pull/4317) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Support reading lzma compressed `.go.buildinfo` sections with upx \\[[#&#8203;4411](https://redirect.github.com/anchore/syft/issues/4411)
          [#&#8203;4480](https://redirect.github.com/anchore/syft/pull/4480) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Specify specific snap revision to pull \\[[#&#8203;4389](https://redirect.github.com/anchore/syft/issues/4389)
          [#&#8203;4439](https://redirect.github.com/anchore/syft/pull/4439) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Cannot detect embedded deps.json metadata in single-file .NET binaries \\[[#&#8203;4344](https://redirect.github.com/anchore/syft/issues/4344)
          [#&#8203;4375](https://redirect.github.com/anchore/syft/pull/4375) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          ELF note cataloger does not pick up OS field, but should \\[[#&#8203;4384](https://redirect.github.com/anchore/syft/issues/4384)
          [#&#8203;4438](https://redirect.github.com/anchore/syft/pull/4438) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n\n#####
          Bug Fixes\n\n- remove debug print statement in dependency parser \\[[#&#8203;4412](https://redirect.github.com/anchore/syft/pull/4412)
          [@&#8203;cgreeno](https://redirect.github.com/cgreeno)]\n- dotnet-deps cataloger
          should skip project references with type \"project\" when building the sbom
          \\[[#&#8203;4423](https://redirect.github.com/anchore/syft/issues/4423)
          [#&#8203;4436](https://redirect.github.com/anchore/syft/pull/4436) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          File digests not computed when using `--base-path` \\[[#&#8203;4410](https://redirect.github.com/anchore/syft/issues/4410)
          [#&#8203;4478](https://redirect.github.com/anchore/syft/pull/4478) [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n-
          Syft should not define subpaths by default in PURLs \\[[#&#8203;4394](https://redirect.github.com/anchore/syft/issues/4394)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          go: valid purl but incorrect name \\[[#&#8203;1737](https://redirect.github.com/anchore/syft/issues/1737)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Incorrect Go module PURL generation when module path contains /vN (e.g.
          /v5) \\[[#&#8203;4316](https://redirect.github.com/anchore/syft/issues/4316)
          [#&#8203;4395](https://redirect.github.com/anchore/syft/pull/4395) [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n-
          Failing to convert npm repository information correctly to SPDX \\[[#&#8203;4362](https://redirect.github.com/anchore/syft/issues/4362)
          [#&#8203;4390](https://redirect.github.com/anchore/syft/pull/4390) [@&#8203;kendrickm](https://redirect.github.com/kendrickm)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.2...v1.39.0)**\n\n###
          [`v1.38.2`](https://redirect.github.com/anchore/syft/releases/tag/v1.38.2)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.1...v1.38.2)\n\n#####
          Bug Fixes\n\n- drop cpe from gguf \\[[#&#8203;4383](https://redirect.github.com/anchore/syft/pull/4383)
          [@&#8203;spiffcs](https://redirect.github.com/spiffcs)]\n- emit lua rockspec
          dependencies in metadata \\[[#&#8203;4376](https://redirect.github.com/anchore/syft/pull/4376)
          [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
          Invalid SBOMs are created when GO replace directive is used \\[[#&#8203;4415](https://redirect.github.com/anchore/syft/issues/4415)
          [#&#8203;4419](https://redirect.github.com/anchore/syft/pull/4419) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Incorrect CPE for Vercel's Next js \\[[#&#8203;4443](https://redirect.github.com/anchore/syft/issues/4443)
          [#&#8203;4450](https://redirect.github.com/anchore/syft/pull/4450) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n-
          v1.38.0 generates empty sbom for tgz sources \\[[#&#8203;4416](https://redirect.github.com/anchore/syft/issues/4416)
          [#&#8203;4421](https://redirect.github.com/anchore/syft/pull/4421) [@&#8203;VictorHuu](https://redirect.github.com/VictorHuu)]\n-
          Syft: The dependency graph does not include all Requires-Dist relationships
          defined in the package\u2019s METADATA file \\[[#&#8203;4401](https://redirect.github.com/anchore/syft/issues/4401)
          [#&#8203;4408](https://redirect.github.com/anchore/syft/pull/4408) [@&#8203;willmurphyscode](https://redirect.github.com/willmurphyscode)]\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.2)**\n\n###
          [`v1.38.1`](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.38.0...v1.38.1)\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: Branch creation - At any time
          (no schedule defined), Automerge - At any time (no schedule defined).\n\n\U0001F6A6
          **Automerge**: Disabled by config. Please merge this manually once you are
          satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes conflicted, or you
          tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**: Close this PR
          and you won't be reminded about this update again.\n\n---\n\n - [ ] <!--
          rebase-check -->If you want to rebase/retry this PR, check this box\n\n---\n\nThis
          PR was generated by [Mend Renovate](https://mend.io/renovate/). View the
          [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi45Mi4xIiwidXBkYXRlZEluVmVyIjoiNDIuOTIuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsicmVub3ZhdGUiXX0=-->\n"
        change_url: https://github.com/osism/release/pull/2368
        commit_id: 9ac72384993e50a23d88610112bb2c94ae8f4348
        patchset: 9ac72384993e50a23d88610112bb2c94ae8f4348
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBhbmNob3JlL3N5ZnQgZG9ja2VyIHRhZyB0byB2MS40MS4wCgpUaGlzIFBSIGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgdXBkYXRlczoKCnwgUGFja2FnZSB8IFVwZGF0ZSB8IENoYW5nZSB8CnwtLS18LS0tfC0tLXwKfCBbYW5jaG9yZS9zeWZ0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0KSB8IG1pbm9yIHwgYHYxLjM4LjBgIOKGkiBgdjEuNDEuMGAgfAoKLS0tCgojIyMgUmVsZWFzZSBOb3RlcwoKPGRldGFpbHM+CjxzdW1tYXJ5PmFuY2hvcmUvc3lmdCAoYW5jaG9yZS9zeWZ0KTwvc3VtbWFyeT4KCiMjIyBbYHYxLjQxLjBgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3JlbGVhc2VzL3RhZy92MS40MS4wKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuNDAuMS4uLnYxLjQxLjApCgojIyMjIyBBZGRlZCBGZWF0dXJlcwoKLSBkZXRlY3QgRGViaWFuIHZlcnNpb24gZnJvbSAvZXRjL2RlYmlhblxfdmVyc2lvbiBcW1sjJiM4MjAzOzQ1NjldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NTY5KSBbQCYjODIwMztremFudG93XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20va3phbnRvdyldCgojIyMjIyBCdWcgRml4ZXMKCi0gY29ycmVjdGx5IHJlcG9ydCBzdXBwb3J0aW5nIGV2aWRlbmNlIGZvciBiaW5hcnkgcGFja2FnZXMgXFtbIyYjODIwMzs0NTU4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDU1OCkgW0AmIzgyMDM7a3phbnRvd10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2t6YW50b3cpXQoKKipbKEZ1bGwgQ2hhbmdlbG9nKV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9jb21wYXJlL3YxLjQwLjEuLi52MS40MS4wKSoqCgojIyMgW2B2MS40MC4xYF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9yZWxlYXNlcy90YWcvdjEuNDAuMSkKCltDb21wYXJlIFNvdXJjZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9jb21wYXJlL3YxLjQwLjAuLi52MS40MC4xKQoKPiBcWyFJbXBvcnRhbnRdCj4gVGhpcyByZWxlYXNlIGJ1bXBzIGdpdGh1Yi5jb20vY29udGFpbmVyZC9jb250YWluZXJkIHRvIHYyLCB3aGljaCB3aWxsIGNhdXNlIGNvbXBpbGVyIGVycm9ycyBpZiB1c2VkIGFsb25nc2lkZSBvdGhlciBkZXBlbmRlbmNpZXMgdGhhdCB1c2UgdjEgb2YgY29udGFpbmVyZC4gU2VlIFthbmNob3JlL3N0ZXJlb3Njb3BlIzQ5NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3RlcmVvc2NvcGUvcHVsbC80OTUpIGZvciBhIGRldGFpbGVkIGRpc2N1c3Npb24uCgojIyMjIyBCdWcgRml4ZXMKCi0gbW9uZ29kYiBiaW5hcnkgbm90IGRldGVjdGVkIG1hbnVhbC9zb3VyY2UgaW5zdGFsbCBcW1sjJiM4MjAzOzQ1NDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ1NDApIFsjJiM4MjAzOzQ1NDFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NTQxKSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCgoqKlsoRnVsbCBDaGFuZ2Vsb2cpXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuNDAuMC4uLnYxLjQwLjEpKioKCiMjIyBbYHYxLjQwLjBgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3JlbGVhc2VzL3RhZy92MS40MC4wKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuMzkuMC4uLnYxLjQwLjApCgojIyMjIyBBZGRlZCBGZWF0dXJlcwoKLSBFeGNsdWRlIGRldmVsb3BtZW50IG9yIHRlc3QgZGVwZW5kZW5jaWVzIGZvciBQTlBNIFBhY2thZ2UgdHlwZSBcW1sjJiM4MjAzOzQ0MzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ0MzApIFsjJiM4MjAzOzQ0ODddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDg3KSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCi0gQ2F0YWxvZyBpc3RpbyBiaW5hcnkgKHBpbG90LWRpc2NvdmVyeSwgcGlsb3QtYWdlbnQpIFxbWyMmIzgyMDM7NDUwOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9pc3N1ZXMvNDUwOCkgWyMmIzgyMDM7NDUyMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQ1MjEpIFtAJiM4MjAzO3dpdGNoY3JhemVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93aXRjaGNyYXplKV0KLSBDYXRhbG9nIGVudm95IGJpbmFyeSBcW1sjJiM4MjAzOzQ1MDZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ1MDYpIFsjJiM4MjAzOzQ1MzBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NTMwKSBbQCYjODIwMzt3aXRjaGNyYXplXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2l0Y2hjcmF6ZSldCi0gQ2F0YWxvZyBncmFmYW5hIGJpbmFyeSBcW1sjJiM4MjAzOzQ1MDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ1MDUpIFsjJiM4MjAzOzQ1MTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NTE2KSBbQCYjODIwMzt3aXRjaGNyYXplXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2l0Y2hjcmF6ZSldCi0gQWRkIGEgYmluYXJ5IGNsYXNzaWZpZXIgZm9yIHZhbGtleSBcW1sjJiM4MjAzOzM0MDBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzM0MDApIFsjJiM4MjAzOzQ1MDldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NTA5KSBbQCYjODIwMzt3aXRjaGNyYXplXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2l0Y2hjcmF6ZSldCgojIyMjIyBCdWcgRml4ZXMKCi0gb2xkIGJpdG5hbWkgaW1hZ2VzIHdpdGhvdXQgc3BkeCBmaWxlcyBhcmVudCBnZXR0aW5nIHBpY2tlZCB1cCBjb3JyZWN0bHkgaW4gdGhlIGNhdGFsb2cgXFtbIyYjODIwMzs0NTI5XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy80NTI5KSBbIyYjODIwMzs0NTMyXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDUzMikgW0AmIzgyMDM7cmV6bW9zc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3Jlem1vc3MpXQotIHdyb25nIHRyYWVmaWsgcmMgdmVyc2lvbnMgYXQgYmluYXJ5IGRldGVjdGlvbiBcW1sjJiM4MjAzOzM1MzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzM1MzUpIFsjJiM4MjAzOzQ0OTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDk5KSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCi0gRnJvbVBPU0lYKCkgaW4gaW50ZXJuYWxzXHdpbmRvd3NccGF0aC5nbyBhc3N1bWVzIHRoYXQgYWxsIFdpbmRvd3Mgcm9vdCBwYXRocyBtdXN0IGhhdmUgYSBjb2xvbiB0ZXJtaW5hdG9yIFxbWyMmIzgyMDM7NDA3MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9pc3N1ZXMvNDA3MCkgWyMmIzgyMDM7NDA3NV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQwNzUpIFtAJiM4MjAzO2x1aXNzYW50b3NIQ0lUXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vbHVpc3NhbnRvc0hDSVQpXQotIGJpbmFyeSBjYXRhbG9nZXIgaXMgcGlja2luZyB1cCB0aGUgZ28gdmVyc2lvbiBpbnN0ZWFkIG9mIHRoZSBhY3R1YWwgYmluYXJ5IHZlcnNpb24gaW4gdHJhZWZpayBleHBlcmltZW50YWwgaW1hZ2VzIFxbWyMmIzgyMDM7NDQ5OF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9pc3N1ZXMvNDQ5OCkgWyMmIzgyMDM7NDQ5OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQ0OTkpIFtAJiM4MjAzO3Jlem1vc3NdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9yZXptb3NzKV0KCioqWyhGdWxsIENoYW5nZWxvZyldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvY29tcGFyZS92MS4zOS4wLi4udjEuNDAuMCkqKgoKIyMjIFtgdjEuMzkuMGBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcmVsZWFzZXMvdGFnL3YxLjM5LjApCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvY29tcGFyZS92MS4zOC4yLi4udjEuMzkuMCkKCiMjIyMjIEFkZGVkIEZlYXR1cmVzCgotIGFkZCBzdXBwb3J0IGZvciBHZW1maWxlLm5leHQubG9jayBcW1sjJiM4MjAzOzQ0NTddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDU3KSBbQCYjODIwMztIYXRpQ29kZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL0hhdGlDb2RlKV0KLSBDb21tYW5kIG91dHB1dCB0byBnaXZlIG1vcmUgaW5mb3JtYXRpb24gb24gd2hhdCBjYXRhbG9nZXJzIGxvb2sgZm9yIGFuZCB3aGF0IHRoZXkgY2FuIGZpbmQgXFtbIyYjODIwMzs0MTU1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy80MTU1KSBbIyYjODIwMzs0MzE3XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDMxNykgW0AmIzgyMDM7d2Fnb29kbWFuXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2Fnb29kbWFuKV0KLSBTdXBwb3J0IHJlYWRpbmcgbHptYSBjb21wcmVzc2VkIGAuZ28uYnVpbGRpbmZvYCBzZWN0aW9ucyB3aXRoIHVweCBcW1sjJiM4MjAzOzQ0MTFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ0MTEpIFsjJiM4MjAzOzQ0ODBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDgwKSBbQCYjODIwMzt3YWdvb2RtYW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWdvb2RtYW4pXQotIFNwZWNpZnkgc3BlY2lmaWMgc25hcCByZXZpc2lvbiB0byBwdWxsIFxbWyMmIzgyMDM7NDM4OV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9pc3N1ZXMvNDM4OSkgWyMmIzgyMDM7NDQzOV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQ0MzkpIFtAJiM4MjAzO1ZpY3Rvckh1dV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL1ZpY3Rvckh1dSldCi0gQ2Fubm90IGRldGVjdCBlbWJlZGRlZCBkZXBzLmpzb24gbWV0YWRhdGEgaW4gc2luZ2xlLWZpbGUgLk5FVCBiaW5hcmllcyBcW1sjJiM4MjAzOzQzNDRdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQzNDQpIFsjJiM4MjAzOzQzNzVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80Mzc1KSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCi0gRUxGIG5vdGUgY2F0YWxvZ2VyIGRvZXMgbm90IHBpY2sgdXAgT1MgZmllbGQsIGJ1dCBzaG91bGQgXFtbIyYjODIwMzs0Mzg0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy80Mzg0KSBbIyYjODIwMzs0NDM4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDQzOCkgW0AmIzgyMDM7VmljdG9ySHV1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vVmljdG9ySHV1KV0KCiMjIyMjIEJ1ZyBGaXhlcwoKLSByZW1vdmUgZGVidWcgcHJpbnQgc3RhdGVtZW50IGluIGRlcGVuZGVuY3kgcGFyc2VyIFxbWyMmIzgyMDM7NDQxMl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQ0MTIpIFtAJiM4MjAzO2NncmVlbm9dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jZ3JlZW5vKV0KLSBkb3RuZXQtZGVwcyBjYXRhbG9nZXIgc2hvdWxkIHNraXAgcHJvamVjdCByZWZlcmVuY2VzIHdpdGggdHlwZSAicHJvamVjdCIgd2hlbiBidWlsZGluZyB0aGUgc2JvbSBcW1sjJiM4MjAzOzQ0MjNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ0MjMpIFsjJiM4MjAzOzQ0MzZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDM2KSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCi0gRmlsZSBkaWdlc3RzIG5vdCBjb21wdXRlZCB3aGVuIHVzaW5nIGAtLWJhc2UtcGF0aGAgXFtbIyYjODIwMzs0NDEwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy80NDEwKSBbIyYjODIwMzs0NDc4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDQ3OCkgW0AmIzgyMDM7d2Fnb29kbWFuXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2Fnb29kbWFuKV0KLSBTeWZ0IHNob3VsZCBub3QgZGVmaW5lIHN1YnBhdGhzIGJ5IGRlZmF1bHQgaW4gUFVSTHMgXFtbIyYjODIwMzs0Mzk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy80Mzk0KSBbIyYjODIwMzs0Mzk1XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDM5NSkgW0AmIzgyMDM7cmV6bW9zc10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3Jlem1vc3MpXQotIGdvOiB2YWxpZCBwdXJsIGJ1dCBpbmNvcnJlY3QgbmFtZSBcW1sjJiM4MjAzOzE3MzddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzE3MzcpIFsjJiM4MjAzOzQzOTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80Mzk1KSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCi0gSW5jb3JyZWN0IEdvIG1vZHVsZSBQVVJMIGdlbmVyYXRpb24gd2hlbiBtb2R1bGUgcGF0aCBjb250YWlucyAvdk4gKGUuZy4gL3Y1KSBcW1sjJiM4MjAzOzQzMTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQzMTYpIFsjJiM4MjAzOzQzOTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80Mzk1KSBbQCYjODIwMztyZXptb3NzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vcmV6bW9zcyldCi0gRmFpbGluZyB0byBjb252ZXJ0IG5wbSByZXBvc2l0b3J5IGluZm9ybWF0aW9uIGNvcnJlY3RseSB0byBTUERYIFxbWyMmIzgyMDM7NDM2Ml0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9pc3N1ZXMvNDM2MikgWyMmIzgyMDM7NDM5MF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQzOTApIFtAJiM4MjAzO2tlbmRyaWNrbV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2tlbmRyaWNrbSldCgoqKlsoRnVsbCBDaGFuZ2Vsb2cpXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuMzguMi4uLnYxLjM5LjApKioKCiMjIyBbYHYxLjM4LjJgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3JlbGVhc2VzL3RhZy92MS4zOC4yKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuMzguMS4uLnYxLjM4LjIpCgojIyMjIyBCdWcgRml4ZXMKCi0gZHJvcCBjcGUgZnJvbSBnZ3VmIFxbWyMmIzgyMDM7NDM4M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQzODMpIFtAJiM4MjAzO3NwaWZmY3NdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9zcGlmZmNzKV0KLSBlbWl0IGx1YSByb2Nrc3BlYyBkZXBlbmRlbmNpZXMgaW4gbWV0YWRhdGEgXFtbIyYjODIwMzs0Mzc2XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDM3NikgW0AmIzgyMDM7d2lsbG11cnBoeXNjb2RlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2lsbG11cnBoeXNjb2RlKV0KLSBJbnZhbGlkIFNCT01zIGFyZSBjcmVhdGVkIHdoZW4gR08gcmVwbGFjZSBkaXJlY3RpdmUgaXMgdXNlZCBcW1sjJiM4MjAzOzQ0MTVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ0MTUpIFsjJiM4MjAzOzQ0MTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDE5KSBbQCYjODIwMztWaWN0b3JIdXVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9WaWN0b3JIdXUpXQotIEluY29ycmVjdCBDUEUgZm9yIFZlcmNlbCdzIE5leHQganMgXFtbIyYjODIwMzs0NDQzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy80NDQzKSBbIyYjODIwMzs0NDUwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNDQ1MCkgW0AmIzgyMDM7d2lsbG11cnBoeXNjb2RlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vd2lsbG11cnBoeXNjb2RlKV0KLSB2MS4zOC4wIGdlbmVyYXRlcyBlbXB0eSBzYm9tIGZvciB0Z3ogc291cmNlcyBcW1sjJiM4MjAzOzQ0MTZdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvaXNzdWVzLzQ0MTYpIFsjJiM4MjAzOzQ0MjFdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC80NDIxKSBbQCYjODIwMztWaWN0b3JIdXVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9WaWN0b3JIdXUpXQotIFN5ZnQ6IFRoZSBkZXBlbmRlbmN5IGdyYXBoIGRvZXMgbm90IGluY2x1ZGUgYWxsIFJlcXVpcmVzLURpc3QgcmVsYXRpb25zaGlwcyBkZWZpbmVkIGluIHRoZSBwYWNrYWdl4oCZcyBNRVRBREFUQSBmaWxlIFxbWyMmIzgyMDM7NDQwMV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9pc3N1ZXMvNDQwMSkgWyMmIzgyMDM7NDQwOF0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzQ0MDgpIFtAJiM4MjAzO3dpbGxtdXJwaHlzY29kZV0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL3dpbGxtdXJwaHlzY29kZSldCgoqKlsoRnVsbCBDaGFuZ2Vsb2cpXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuMzguMC4uLnYxLjM4LjIpKioKCiMjIyBbYHYxLjM4LjFgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuMzguMC4uLnYxLjM4LjEpCgpbQ29tcGFyZSBTb3VyY2VdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvY29tcGFyZS92MS4zOC4wLi4udjEuMzguMSkKCjwvZGV0YWlscz4KCi0tLQoKIyMjIENvbmZpZ3VyYXRpb24KCvCfk4UgKipTY2hlZHVsZSoqOiBCcmFuY2ggY3JlYXRpb24gLSBBdCBhbnkgdGltZSAobm8gc2NoZWR1bGUgZGVmaW5lZCksIEF1dG9tZXJnZSAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKS4KCvCfmqYgKipBdXRvbWVyZ2UqKjogRGlzYWJsZWQgYnkgY29uZmlnLiBQbGVhc2UgbWVyZ2UgdGhpcyBtYW51YWxseSBvbmNlIHlvdSBhcmUgc2F0aXNmaWVkLgoK4pm7ICoqUmViYXNpbmcqKjogV2hlbmV2ZXIgUFIgYmVjb21lcyBjb25mbGljdGVkLCBvciB5b3UgdGljayB0aGUgcmViYXNlL3JldHJ5IGNoZWNrYm94LgoK8J+UlSAqKklnbm9yZSoqOiBDbG9zZSB0aGlzIFBSIGFuZCB5b3Ugd29uJ3QgYmUgcmVtaW5kZWQgYWJvdXQgdGhpcyB1cGRhdGUgYWdhaW4uCgotLS0KCiAtIFsgXSA8IS0tIHJlYmFzZS1jaGVjayAtLT5JZiB5b3Ugd2FudCB0byByZWJhc2UvcmV0cnkgdGhpcyBQUiwgY2hlY2sgdGhpcyBib3gKCi0tLQoKVGhpcyBQUiB3YXMgZ2VuZXJhdGVkIGJ5IFtNZW5kIFJlbm92YXRlXShodHRwczovL21lbmQuaW8vcmVub3ZhdGUvKS4gVmlldyB0aGUgW3JlcG9zaXRvcnkgam9iIGxvZ10oaHR0cHM6Ly9kZXZlbG9wZXIubWVuZC5pby9naXRodWIvb3Npc20vcmVsZWFzZSkuCjwhLS1yZW5vdmF0ZS1kZWJ1ZzpleUpqY21WaGRHVmtTVzVXWlhJaU9pSTBNaTQ1TWk0eElpd2lkWEJrWVhSbFpFbHVWbVZ5SWpvaU5ESXVPVEl1TVNJc0luUmhjbWRsZEVKeVlXNWphQ0k2SW0xaGFXNGlMQ0pzWVdKbGJITWlPbHNpY21WdWIzWmhkR1VpWFgwPS0tPgo=
      patchset: 9ac72384993e50a23d88610112bb2c94ae8f4348
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: a01eed06dffe368c1d01819193bfadccb137414d
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 4f450aa36c28b035ce97359a888edbd7599eaf31
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 397240f42127868e42e86e6aeb120c2cb092d117
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_0/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_0/zuul-jobs/roles
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_1/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_1/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_2/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_2/openinfra-zuul-jobs/roles
      post_review: false
      post_timeout: null
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: 06ce3e9faee9d837a1fc76e4bb62aac77cdc0ae8
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2368/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
