chore(deps): update dependency aqua:anchore/grype to v0.119.0

[renovate]

This PR contains the following updates:

Package	Type	Update	Change
aqua:anchore/grype	tools	minor	0.118.0 → 0.119.0

---

Release Notes

anchore/grype (aqua:anchore/grype)

v0.119.0

Compare Source

Added Features

• Expose distro-fixed dropped matches via ignoredMatches so --show-suppressed can surface them [Issue #​3450] [PR #​3705 @​philroche]
• Licensing: copyright owner missing, needed for Debian packaging [Issue #​3501]

Bug Fixes

• fixes typo in cpe example input for cpe-direct scan [PR #​3679 @​zhill]
• --by-cve: which advisory record survives the merge varies between runs [Issue #​3630]

Additional Changes

• OpenVEX transformer drops the namespace from Go module PURLs [Issue #​3680] [PR #​3683 @​arpitjain099]
• Docs missing for include-aliases [Issue #​3663] [PR #​3671 @​dev-rehaann]

Dependencies

54 dependency changes (54 updated). 6 vulnerabilities remediated.

🟢 Remediated (6)

• GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc
• GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2
• GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc
• GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc
• GO-2026-6354 (High) — golang.org/x/crypto
• GO-2026-6355 (High) — golang.org/x/crypto

Updated (54 packages)

• cloud.google.com/go/auth v0.22.0 → v0.23.2
• cloud.google.com/go/iam v1.11.0 → v1.12.0
• cloud.google.com/go/logging v1.18.0 → v1.19.0
• cloud.google.com/go/monitoring v1.29.0 → v1.30.0
• cloud.google.com/go/storage v1.64.0 → v1.65.1
• github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0
• github.com/anchore/go-sync v0.1.1 → v0.1.2
• github.com/anchore/stereoscope v0.3.1 → v0.3.2
• github.com/anchore/syft v1.51.1 → v1.52.0
• github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0
• github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20
• github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40
• github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39
• github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40
• github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40
• github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40
• github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41
• github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19
• github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0
• github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40
• github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41
• github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0
• github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0
• github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0
• github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0
• github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0
• github.com/aws/smithy-go v1.27.6 → v1.28.1
• github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv)
• github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible
• github.com/google/go-containerregistry v0.21.9 → v0.22.1
• github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20
• github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0
• github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3
• github.com/hashicorp/go-getter v1.8.8 → v1.8.9
• github.com/klauspost/compress v1.19.2 → v1.20.0
• github.com/moby/moby/api v1.55.0 → v1.56.0
• github.com/moby/moby/client v0.5.1 → v0.6.0
• github.com/pandatix/go-cvss v0.6.2 → v0.6.4
• github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8
• golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355)
• golang.org/x/mod v0.40.0 → v0.41.0
• golang.org/x/time v0.15.0 → v0.16.0
• google.golang.org/api v0.292.0 → v0.294.0
• google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1
• google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1
• google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42
• google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc)
• google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12
• modernc.org/cc/v4 v4.29.1 → v4.29.2
• modernc.org/ccgo/v4 v4.34.6 → v4.35.0
• modernc.org/gc/v3 v3.1.4 → v3.1.5
• modernc.org/libc v1.74.4 → v1.75.6
• modernc.org/memory v1.11.0 → v1.12.1
• modernc.org/sqlite v1.56.0 → v1.58.0

(Full Changelog)

---

Configuration

📅 Schedule: (UTC)

• Branch creation
  • "before 9am on monday"
• Automerge
  • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.