all:
  children:
    zuul_unreachable:
      hosts: {}
  hosts:
    debian-bookworm:
      ansible_connection: ssh
      ansible_host: 2a13:1a81:8000:3124:f816:3eff:fe66:d6f6
      ansible_port: 22
      ansible_python_interpreter: auto
      ansible_user: zuul
      nodepool:
        az: nova
        cloud: regiocloud-a-ci
        external_id: 7bbe567b-2201-4447-8c4a-c7fcb2ea6838
        host_id: d2c528664e1bd332192bb574345deb0c6c7158061222e4a6c036b5ef
        interface_ip: 2a13:1a81:8000:3124:f816:3eff:fe66:d6f6
        label: debian-bookworm
        node_properties: {}
        private_ipv4: 10.128.0.108
        private_ipv6: null
        provider: regiocloud-a
        public_ipv4: 81.163.192.196
        public_ipv6: 2a13:1a81:8000:3124:f816:3eff:fe66:d6f6
        region: null
        slot: null
  vars:
    zuul:
      _inheritance_path:
      - '<Job base explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-config/zuul.d/jobs.yaml@main#2>'
      - '<Job flake8 explicit: None implied: {MatchAny:{ImpliedBranchMatcher:main}}
        source: osism/zuul-jobs/.zuul.yaml@main#32>'
      - '<Job flake8 explicit: None implied: None source: osism/release/.zuul.yaml@main#14>'
      ansible_version: '9'
      attempts: 1
      branch: main
      build: 9442c1a2eeca4ea5b791eede44488114
      build_refs:
      - branch: main
        change: '2641'
        change_message: "chore(deps): update anchore/syft docker tag to v1.50.0\n\nThis
          PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.49.0`
          \u2192 `v1.50.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
          (anchore/syft)</summary>\n\n### [`v1.50.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.50.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)\n\n#####
          Added Features\n\n- Add bun binary classifier \\[PR [#&#8203;5103](https://redirect.github.com/anchore/syft/pull/5103)
          [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n##### Bug Fixes\n\n-
          Fix Cargo PURLs for local workspace packages \\[PR [#&#8203;5105](https://redirect.github.com/anchore/syft/pull/5105)
          [@&#8203;3nesdeniz](https://redirect.github.com/3nesdeniz)]\n- Decode golang
          symbols \\[PR [#&#8203;5089](https://redirect.github.com/anchore/syft/pull/5089)
          [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n- CPE vendor
          field incorrectly includes publisher URL for SUSE RPM packages \\[Issue
          [#&#8203;5073](https://redirect.github.com/anchore/syft/issues/5073)] \\[PR
          [#&#8203;5081](https://redirect.github.com/anchore/syft/pull/5081) [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n-
          apk-db-cataloger silently drops the entire APK catalog when one installed-DB
          field exceeds 64 KB \\[Issue [#&#8203;5094](https://redirect.github.com/anchore/syft/issues/5094)]
          \\[PR [#&#8203;5100](https://redirect.github.com/anchore/syft/pull/5100)
          [@&#8203;cyphercodes](https://redirect.github.com/cyphercodes)]\n\n#####
          Additional Changes\n\n- package-lock.json v1: nested dependencies entries
          are never cataloged (flat top-level iteration only) \\[Issue [#&#8203;5101](https://redirect.github.com/anchore/syft/issues/5101)]
          \\[PR [#&#8203;5108](https://redirect.github.com/anchore/syft/pull/5108)
          [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n- consider vendored
          golang packages in module attribution \\[PR [#&#8203;5093](https://redirect.github.com/anchore/syft/pull/5093)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n- Fix inverted
          bounds check dropping every Erlang string with a backslash \\[PR [#&#8203;5110](https://redirect.github.com/anchore/syft/pull/5110)
          [@&#8203;arpitjain099](https://redirect.github.com/arpitjain099)]\n\n#####
          Dependencies\n\n14 dependency changes (14 updated). 1 vulnerability remediated.\n\n**\U0001F7E2
          Remediated (1)**\n\n- [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf)
          (High) \u2014 google.golang.org/grpc\n\n<details>\n<summary>Updated (14
          packages)</summary>\n\n- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
          `v1.31.0` \u2192 `v1.32.0`\n- github.com/cncf/xds/go `v0.0.0-ee656c7` \u2192
          `v0.0.0-dba9d58`\n- github.com/envoyproxy/go-control-plane/envoy `v1.36.0`
          \u2192 `v1.37.0`\n- github.com/envoyproxy/protoc-gen-validate `v1.3.0` \u2192
          `v1.3.3`\n- github.com/gpustack/gguf-parser-go `v0.24.1` \u2192 `v0.25.0`\n-
          go.opentelemetry.io/contrib/detectors/gcp `v1.39.0` \u2192 `v1.43.0`\n-
          google.golang.org/genproto/googleapis/api `v0.0.0-9d38bb4` \u2192 `v0.0.0-afd174a`\n-
          google.golang.org/genproto/googleapis/rpc `v0.0.0-6f92a3b` \u2192 `v0.0.0-afd174a`\n-
          google.golang.org/grpc `v1.80.0` \u2192 `v1.82.1` **(\U0001F7E2 remediated
          [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf))**\n-
          modernc.org/cc/v4 `v4.28.4` \u2192 `v4.29.0`\n- modernc.org/ccgo/v4 `v4.34.4`
          \u2192 `v4.34.6`\n- modernc.org/gc/v3 `v3.1.3` \u2192 `v3.1.4`\n- modernc.org/libc
          `v1.73.4` \u2192 `v1.74.1`\n- modernc.org/sqlite `v1.53.0` \u2192 `v1.54.0`\n\n</details>\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)**\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
        change_url: https://github.com/osism/release/pull/2641
        commit_id: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
        patchset: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      buildset: 391ac2cd2c694fddb6f356382bbb08a8
      buildset_refs:
      - branch: main
        change: '2641'
        change_message: "chore(deps): update anchore/syft docker tag to v1.50.0\n\nThis
          PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.49.0`
          \u2192 `v1.50.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
          (anchore/syft)</summary>\n\n### [`v1.50.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.50.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)\n\n#####
          Added Features\n\n- Add bun binary classifier \\[PR [#&#8203;5103](https://redirect.github.com/anchore/syft/pull/5103)
          [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n##### Bug Fixes\n\n-
          Fix Cargo PURLs for local workspace packages \\[PR [#&#8203;5105](https://redirect.github.com/anchore/syft/pull/5105)
          [@&#8203;3nesdeniz](https://redirect.github.com/3nesdeniz)]\n- Decode golang
          symbols \\[PR [#&#8203;5089](https://redirect.github.com/anchore/syft/pull/5089)
          [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n- CPE vendor
          field incorrectly includes publisher URL for SUSE RPM packages \\[Issue
          [#&#8203;5073](https://redirect.github.com/anchore/syft/issues/5073)] \\[PR
          [#&#8203;5081](https://redirect.github.com/anchore/syft/pull/5081) [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n-
          apk-db-cataloger silently drops the entire APK catalog when one installed-DB
          field exceeds 64 KB \\[Issue [#&#8203;5094](https://redirect.github.com/anchore/syft/issues/5094)]
          \\[PR [#&#8203;5100](https://redirect.github.com/anchore/syft/pull/5100)
          [@&#8203;cyphercodes](https://redirect.github.com/cyphercodes)]\n\n#####
          Additional Changes\n\n- package-lock.json v1: nested dependencies entries
          are never cataloged (flat top-level iteration only) \\[Issue [#&#8203;5101](https://redirect.github.com/anchore/syft/issues/5101)]
          \\[PR [#&#8203;5108](https://redirect.github.com/anchore/syft/pull/5108)
          [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n- consider vendored
          golang packages in module attribution \\[PR [#&#8203;5093](https://redirect.github.com/anchore/syft/pull/5093)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n- Fix inverted
          bounds check dropping every Erlang string with a backslash \\[PR [#&#8203;5110](https://redirect.github.com/anchore/syft/pull/5110)
          [@&#8203;arpitjain099](https://redirect.github.com/arpitjain099)]\n\n#####
          Dependencies\n\n14 dependency changes (14 updated). 1 vulnerability remediated.\n\n**\U0001F7E2
          Remediated (1)**\n\n- [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf)
          (High) \u2014 google.golang.org/grpc\n\n<details>\n<summary>Updated (14
          packages)</summary>\n\n- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
          `v1.31.0` \u2192 `v1.32.0`\n- github.com/cncf/xds/go `v0.0.0-ee656c7` \u2192
          `v0.0.0-dba9d58`\n- github.com/envoyproxy/go-control-plane/envoy `v1.36.0`
          \u2192 `v1.37.0`\n- github.com/envoyproxy/protoc-gen-validate `v1.3.0` \u2192
          `v1.3.3`\n- github.com/gpustack/gguf-parser-go `v0.24.1` \u2192 `v0.25.0`\n-
          go.opentelemetry.io/contrib/detectors/gcp `v1.39.0` \u2192 `v1.43.0`\n-
          google.golang.org/genproto/googleapis/api `v0.0.0-9d38bb4` \u2192 `v0.0.0-afd174a`\n-
          google.golang.org/genproto/googleapis/rpc `v0.0.0-6f92a3b` \u2192 `v0.0.0-afd174a`\n-
          google.golang.org/grpc `v1.80.0` \u2192 `v1.82.1` **(\U0001F7E2 remediated
          [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf))**\n-
          modernc.org/cc/v4 `v4.28.4` \u2192 `v4.29.0`\n- modernc.org/ccgo/v4 `v4.34.4`
          \u2192 `v4.34.6`\n- modernc.org/gc/v3 `v3.1.3` \u2192 `v3.1.4`\n- modernc.org/libc
          `v1.73.4` \u2192 `v1.74.1`\n- modernc.org/sqlite `v1.53.0` \u2192 `v1.54.0`\n\n</details>\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)**\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
        change_url: https://github.com/osism/release/pull/2641
        commit_id: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
        patchset: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
        src_dir: src/github.com/osism/release
        topic: null
      change: '2641'
      change_message: "chore(deps): update anchore/syft docker tag to v1.50.0\n\nThis
        PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
        [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.49.0`
        \u2192 `v1.50.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
        (anchore/syft)</summary>\n\n### [`v1.50.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.50.0)\n\n[Compare
        Source](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)\n\n#####
        Added Features\n\n- Add bun binary classifier \\[PR [#&#8203;5103](https://redirect.github.com/anchore/syft/pull/5103)
        [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n##### Bug Fixes\n\n-
        Fix Cargo PURLs for local workspace packages \\[PR [#&#8203;5105](https://redirect.github.com/anchore/syft/pull/5105)
        [@&#8203;3nesdeniz](https://redirect.github.com/3nesdeniz)]\n- Decode golang
        symbols \\[PR [#&#8203;5089](https://redirect.github.com/anchore/syft/pull/5089)
        [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n- CPE vendor
        field incorrectly includes publisher URL for SUSE RPM packages \\[Issue [#&#8203;5073](https://redirect.github.com/anchore/syft/issues/5073)]
        \\[PR [#&#8203;5081](https://redirect.github.com/anchore/syft/pull/5081) [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n-
        apk-db-cataloger silently drops the entire APK catalog when one installed-DB
        field exceeds 64 KB \\[Issue [#&#8203;5094](https://redirect.github.com/anchore/syft/issues/5094)]
        \\[PR [#&#8203;5100](https://redirect.github.com/anchore/syft/pull/5100) [@&#8203;cyphercodes](https://redirect.github.com/cyphercodes)]\n\n#####
        Additional Changes\n\n- package-lock.json v1: nested dependencies entries
        are never cataloged (flat top-level iteration only) \\[Issue [#&#8203;5101](https://redirect.github.com/anchore/syft/issues/5101)]
        \\[PR [#&#8203;5108](https://redirect.github.com/anchore/syft/pull/5108) [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n-
        consider vendored golang packages in module attribution \\[PR [#&#8203;5093](https://redirect.github.com/anchore/syft/pull/5093)
        [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n- Fix inverted bounds
        check dropping every Erlang string with a backslash \\[PR [#&#8203;5110](https://redirect.github.com/anchore/syft/pull/5110)
        [@&#8203;arpitjain099](https://redirect.github.com/arpitjain099)]\n\n#####
        Dependencies\n\n14 dependency changes (14 updated). 1 vulnerability remediated.\n\n**\U0001F7E2
        Remediated (1)**\n\n- [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf)
        (High) \u2014 google.golang.org/grpc\n\n<details>\n<summary>Updated (14 packages)</summary>\n\n-
        github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp `v1.31.0`
        \u2192 `v1.32.0`\n- github.com/cncf/xds/go `v0.0.0-ee656c7` \u2192 `v0.0.0-dba9d58`\n-
        github.com/envoyproxy/go-control-plane/envoy `v1.36.0` \u2192 `v1.37.0`\n-
        github.com/envoyproxy/protoc-gen-validate `v1.3.0` \u2192 `v1.3.3`\n- github.com/gpustack/gguf-parser-go
        `v0.24.1` \u2192 `v0.25.0`\n- go.opentelemetry.io/contrib/detectors/gcp `v1.39.0`
        \u2192 `v1.43.0`\n- google.golang.org/genproto/googleapis/api `v0.0.0-9d38bb4`
        \u2192 `v0.0.0-afd174a`\n- google.golang.org/genproto/googleapis/rpc `v0.0.0-6f92a3b`
        \u2192 `v0.0.0-afd174a`\n- google.golang.org/grpc `v1.80.0` \u2192 `v1.82.1`
        **(\U0001F7E2 remediated [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf))**\n-
        modernc.org/cc/v4 `v4.28.4` \u2192 `v4.29.0`\n- modernc.org/ccgo/v4 `v4.34.4`
        \u2192 `v4.34.6`\n- modernc.org/gc/v3 `v3.1.3` \u2192 `v3.1.4`\n- modernc.org/libc
        `v1.73.4` \u2192 `v1.74.1`\n- modernc.org/sqlite `v1.53.0` \u2192 `v1.54.0`\n\n</details>\n\n**[(Full
        Changelog)](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)**\n\n</details>\n\n---\n\n###
        Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
        At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
        defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
        manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
        conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
        Close this PR and you won't be reminded about this update again.\n\n---\n\n
        - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
        box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
        View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
      change_url: https://github.com/osism/release/pull/2641
      child_jobs: []
      commit_id: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
      event_id: c5bd2810-8d0f-11f1-9048-fcc952d6164e
      executor:
        hostname: 521e9411259a
        inventory_file: /var/lib/zuul/builds/9442c1a2eeca4ea5b791eede44488114/ansible/inventory.yaml
        log_root: /var/lib/zuul/builds/9442c1a2eeca4ea5b791eede44488114/work/logs
        result_data_file: /var/lib/zuul/builds/9442c1a2eeca4ea5b791eede44488114/work/results.json
        src_root: /var/lib/zuul/builds/9442c1a2eeca4ea5b791eede44488114/work/src
        work_root: /var/lib/zuul/builds/9442c1a2eeca4ea5b791eede44488114/work
      include_vars: []
      items:
      - branch: main
        change: '2641'
        change_message: "chore(deps): update anchore/syft docker tag to v1.50.0\n\nThis
          PR contains the following updates:\n\n| Package | Update | Change |\n|---|---|---|\n|
          [anchore/syft](https://redirect.github.com/anchore/syft) | minor | `v1.49.0`
          \u2192 `v1.50.0` |\n\n---\n\n### Release Notes\n\n<details>\n<summary>anchore/syft
          (anchore/syft)</summary>\n\n### [`v1.50.0`](https://redirect.github.com/anchore/syft/releases/tag/v1.50.0)\n\n[Compare
          Source](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)\n\n#####
          Added Features\n\n- Add bun binary classifier \\[PR [#&#8203;5103](https://redirect.github.com/anchore/syft/pull/5103)
          [@&#8203;rezmoss](https://redirect.github.com/rezmoss)]\n\n##### Bug Fixes\n\n-
          Fix Cargo PURLs for local workspace packages \\[PR [#&#8203;5105](https://redirect.github.com/anchore/syft/pull/5105)
          [@&#8203;3nesdeniz](https://redirect.github.com/3nesdeniz)]\n- Decode golang
          symbols \\[PR [#&#8203;5089](https://redirect.github.com/anchore/syft/pull/5089)
          [@&#8203;wagoodman](https://redirect.github.com/wagoodman)]\n- CPE vendor
          field incorrectly includes publisher URL for SUSE RPM packages \\[Issue
          [#&#8203;5073](https://redirect.github.com/anchore/syft/issues/5073)] \\[PR
          [#&#8203;5081](https://redirect.github.com/anchore/syft/pull/5081) [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n-
          apk-db-cataloger silently drops the entire APK catalog when one installed-DB
          field exceeds 64 KB \\[Issue [#&#8203;5094](https://redirect.github.com/anchore/syft/issues/5094)]
          \\[PR [#&#8203;5100](https://redirect.github.com/anchore/syft/pull/5100)
          [@&#8203;cyphercodes](https://redirect.github.com/cyphercodes)]\n\n#####
          Additional Changes\n\n- package-lock.json v1: nested dependencies entries
          are never cataloged (flat top-level iteration only) \\[Issue [#&#8203;5101](https://redirect.github.com/anchore/syft/issues/5101)]
          \\[PR [#&#8203;5108](https://redirect.github.com/anchore/syft/pull/5108)
          [@&#8203;Eljees](https://redirect.github.com/Eljees)]\n- consider vendored
          golang packages in module attribution \\[PR [#&#8203;5093](https://redirect.github.com/anchore/syft/pull/5093)
          [@&#8203;kzantow](https://redirect.github.com/kzantow)]\n- Fix inverted
          bounds check dropping every Erlang string with a backslash \\[PR [#&#8203;5110](https://redirect.github.com/anchore/syft/pull/5110)
          [@&#8203;arpitjain099](https://redirect.github.com/arpitjain099)]\n\n#####
          Dependencies\n\n14 dependency changes (14 updated). 1 vulnerability remediated.\n\n**\U0001F7E2
          Remediated (1)**\n\n- [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf)
          (High) \u2014 google.golang.org/grpc\n\n<details>\n<summary>Updated (14
          packages)</summary>\n\n- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
          `v1.31.0` \u2192 `v1.32.0`\n- github.com/cncf/xds/go `v0.0.0-ee656c7` \u2192
          `v0.0.0-dba9d58`\n- github.com/envoyproxy/go-control-plane/envoy `v1.36.0`
          \u2192 `v1.37.0`\n- github.com/envoyproxy/protoc-gen-validate `v1.3.0` \u2192
          `v1.3.3`\n- github.com/gpustack/gguf-parser-go `v0.24.1` \u2192 `v0.25.0`\n-
          go.opentelemetry.io/contrib/detectors/gcp `v1.39.0` \u2192 `v1.43.0`\n-
          google.golang.org/genproto/googleapis/api `v0.0.0-9d38bb4` \u2192 `v0.0.0-afd174a`\n-
          google.golang.org/genproto/googleapis/rpc `v0.0.0-6f92a3b` \u2192 `v0.0.0-afd174a`\n-
          google.golang.org/grpc `v1.80.0` \u2192 `v1.82.1` **(\U0001F7E2 remediated
          [GHSA-hrxh-6v49-42gf](https://redirect.github.com/advisories/GHSA-hrxh-6v49-42gf))**\n-
          modernc.org/cc/v4 `v4.28.4` \u2192 `v4.29.0`\n- modernc.org/ccgo/v4 `v4.34.4`
          \u2192 `v4.34.6`\n- modernc.org/gc/v3 `v3.1.3` \u2192 `v3.1.4`\n- modernc.org/libc
          `v1.73.4` \u2192 `v1.74.1`\n- modernc.org/sqlite `v1.53.0` \u2192 `v1.54.0`\n\n</details>\n\n**[(Full
          Changelog)](https://redirect.github.com/anchore/syft/compare/v1.49.0...v1.50.0)**\n\n</details>\n\n---\n\n###
          Configuration\n\n\U0001F4C5 **Schedule**: (UTC)\n\n- Branch creation\n  -
          At any time (no schedule defined)\n- Automerge\n  - At any time (no schedule
          defined)\n\n\U0001F6A6 **Automerge**: Disabled by config. Please merge this
          manually once you are satisfied.\n\n\u267B **Rebasing**: Whenever PR becomes
          conflicted, or you tick the rebase/retry checkbox.\n\n\U0001F515 **Ignore**:
          Close this PR and you won't be reminded about this update again.\n\n---\n\n
          - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this
          box\n\n---\n\nThis PR was generated by [Mend Renovate](https://mend.io/renovate/).
          View the [repository job log](https://developer.mend.io/github/osism/release).\n<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC4zLjIiLCJ1cGRhdGVkSW5WZXIiOiI0NC4zLjIiLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbInJlbm92YXRlIl19-->\n"
        change_url: https://github.com/osism/release/pull/2641
        commit_id: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
        patchset: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
        project:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          name: osism/release
          short_name: release
          src_dir: src/github.com/osism/release
        topic: null
      job: flake8
      jobtags: []
      max_attempts: 3
      message: Y2hvcmUoZGVwcyk6IHVwZGF0ZSBhbmNob3JlL3N5ZnQgZG9ja2VyIHRhZyB0byB2MS41MC4wCgpUaGlzIFBSIGNvbnRhaW5zIHRoZSBmb2xsb3dpbmcgdXBkYXRlczoKCnwgUGFja2FnZSB8IFVwZGF0ZSB8IENoYW5nZSB8CnwtLS18LS0tfC0tLXwKfCBbYW5jaG9yZS9zeWZ0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0KSB8IG1pbm9yIHwgYHYxLjQ5LjBgIOKGkiBgdjEuNTAuMGAgfAoKLS0tCgojIyMgUmVsZWFzZSBOb3RlcwoKPGRldGFpbHM+CjxzdW1tYXJ5PmFuY2hvcmUvc3lmdCAoYW5jaG9yZS9zeWZ0KTwvc3VtbWFyeT4KCiMjIyBbYHYxLjUwLjBgXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3JlbGVhc2VzL3RhZy92MS41MC4wKQoKW0NvbXBhcmUgU291cmNlXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuNDkuMC4uLnYxLjUwLjApCgojIyMjIyBBZGRlZCBGZWF0dXJlcwoKLSBBZGQgYnVuIGJpbmFyeSBjbGFzc2lmaWVyIFxbUFIgWyMmIzgyMDM7NTEwM10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzUxMDMpIFtAJiM4MjAzO3Jlem1vc3NdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9yZXptb3NzKV0KCiMjIyMjIEJ1ZyBGaXhlcwoKLSBGaXggQ2FyZ28gUFVSTHMgZm9yIGxvY2FsIHdvcmtzcGFjZSBwYWNrYWdlcyBcW1BSIFsjJiM4MjAzOzUxMDVdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC81MTA1KSBbQCYjODIwMzszbmVzZGVuaXpdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS8zbmVzZGVuaXopXQotIERlY29kZSBnb2xhbmcgc3ltYm9scyBcW1BSIFsjJiM4MjAzOzUwODldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC81MDg5KSBbQCYjODIwMzt3YWdvb2RtYW5dKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS93YWdvb2RtYW4pXQotIENQRSB2ZW5kb3IgZmllbGQgaW5jb3JyZWN0bHkgaW5jbHVkZXMgcHVibGlzaGVyIFVSTCBmb3IgU1VTRSBSUE0gcGFja2FnZXMgXFtJc3N1ZSBbIyYjODIwMzs1MDczXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy81MDczKV0gXFtQUiBbIyYjODIwMzs1MDgxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNTA4MSkgW0AmIzgyMDM7RWxqZWVzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vRWxqZWVzKV0KLSBhcGstZGItY2F0YWxvZ2VyIHNpbGVudGx5IGRyb3BzIHRoZSBlbnRpcmUgQVBLIGNhdGFsb2cgd2hlbiBvbmUgaW5zdGFsbGVkLURCIGZpZWxkIGV4Y2VlZHMgNjQgS0IgXFtJc3N1ZSBbIyYjODIwMzs1MDk0XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy81MDk0KV0gXFtQUiBbIyYjODIwMzs1MTAwXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNTEwMCkgW0AmIzgyMDM7Y3lwaGVyY29kZXNdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9jeXBoZXJjb2RlcyldCgojIyMjIyBBZGRpdGlvbmFsIENoYW5nZXMKCi0gcGFja2FnZS1sb2NrLmpzb24gdjE6IG5lc3RlZCBkZXBlbmRlbmNpZXMgZW50cmllcyBhcmUgbmV2ZXIgY2F0YWxvZ2VkIChmbGF0IHRvcC1sZXZlbCBpdGVyYXRpb24gb25seSkgXFtJc3N1ZSBbIyYjODIwMzs1MTAxXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2lzc3Vlcy81MTAxKV0gXFtQUiBbIyYjODIwMzs1MTA4XShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L3B1bGwvNTEwOCkgW0AmIzgyMDM7RWxqZWVzXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vRWxqZWVzKV0KLSBjb25zaWRlciB2ZW5kb3JlZCBnb2xhbmcgcGFja2FnZXMgaW4gbW9kdWxlIGF0dHJpYnV0aW9uIFxbUFIgWyMmIzgyMDM7NTA5M10oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2FuY2hvcmUvc3lmdC9wdWxsLzUwOTMpIFtAJiM4MjAzO2t6YW50b3ddKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9remFudG93KV0KLSBGaXggaW52ZXJ0ZWQgYm91bmRzIGNoZWNrIGRyb3BwaW5nIGV2ZXJ5IEVybGFuZyBzdHJpbmcgd2l0aCBhIGJhY2tzbGFzaCBcW1BSIFsjJiM4MjAzOzUxMTBdKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hbmNob3JlL3N5ZnQvcHVsbC81MTEwKSBbQCYjODIwMzthcnBpdGphaW4wOTldKGh0dHBzOi8vcmVkaXJlY3QuZ2l0aHViLmNvbS9hcnBpdGphaW4wOTkpXQoKIyMjIyMgRGVwZW5kZW5jaWVzCgoxNCBkZXBlbmRlbmN5IGNoYW5nZXMgKDE0IHVwZGF0ZWQpLiAxIHZ1bG5lcmFiaWxpdHkgcmVtZWRpYXRlZC4KCioq8J+foiBSZW1lZGlhdGVkICgxKSoqCgotIFtHSFNBLWhyeGgtNnY0OS00MmdmXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYWR2aXNvcmllcy9HSFNBLWhyeGgtNnY0OS00MmdmKSAoSGlnaCkg4oCUIGdvb2dsZS5nb2xhbmcub3JnL2dycGMKCjxkZXRhaWxzPgo8c3VtbWFyeT5VcGRhdGVkICgxNCBwYWNrYWdlcyk8L3N1bW1hcnk+CgotIGdpdGh1Yi5jb20vR29vZ2xlQ2xvdWRQbGF0Zm9ybS9vcGVudGVsZW1ldHJ5LW9wZXJhdGlvbnMtZ28vZGV0ZWN0b3JzL2djcCBgdjEuMzEuMGAg4oaSIGB2MS4zMi4wYAotIGdpdGh1Yi5jb20vY25jZi94ZHMvZ28gYHYwLjAuMC1lZTY1NmM3YCDihpIgYHYwLjAuMC1kYmE5ZDU4YAotIGdpdGh1Yi5jb20vZW52b3lwcm94eS9nby1jb250cm9sLXBsYW5lL2Vudm95IGB2MS4zNi4wYCDihpIgYHYxLjM3LjBgCi0gZ2l0aHViLmNvbS9lbnZveXByb3h5L3Byb3RvYy1nZW4tdmFsaWRhdGUgYHYxLjMuMGAg4oaSIGB2MS4zLjNgCi0gZ2l0aHViLmNvbS9ncHVzdGFjay9nZ3VmLXBhcnNlci1nbyBgdjAuMjQuMWAg4oaSIGB2MC4yNS4wYAotIGdvLm9wZW50ZWxlbWV0cnkuaW8vY29udHJpYi9kZXRlY3RvcnMvZ2NwIGB2MS4zOS4wYCDihpIgYHYxLjQzLjBgCi0gZ29vZ2xlLmdvbGFuZy5vcmcvZ2VucHJvdG8vZ29vZ2xlYXBpcy9hcGkgYHYwLjAuMC05ZDM4YmI0YCDihpIgYHYwLjAuMC1hZmQxNzRhYAotIGdvb2dsZS5nb2xhbmcub3JnL2dlbnByb3RvL2dvb2dsZWFwaXMvcnBjIGB2MC4wLjAtNmY5MmEzYmAg4oaSIGB2MC4wLjAtYWZkMTc0YWAKLSBnb29nbGUuZ29sYW5nLm9yZy9ncnBjIGB2MS44MC4wYCDihpIgYHYxLjgyLjFgICoqKPCfn6IgcmVtZWRpYXRlZCBbR0hTQS1ocnhoLTZ2NDktNDJnZl0oaHR0cHM6Ly9yZWRpcmVjdC5naXRodWIuY29tL2Fkdmlzb3JpZXMvR0hTQS1ocnhoLTZ2NDktNDJnZikpKioKLSBtb2Rlcm5jLm9yZy9jYy92NCBgdjQuMjguNGAg4oaSIGB2NC4yOS4wYAotIG1vZGVybmMub3JnL2NjZ28vdjQgYHY0LjM0LjRgIOKGkiBgdjQuMzQuNmAKLSBtb2Rlcm5jLm9yZy9nYy92MyBgdjMuMS4zYCDihpIgYHYzLjEuNGAKLSBtb2Rlcm5jLm9yZy9saWJjIGB2MS43My40YCDihpIgYHYxLjc0LjFgCi0gbW9kZXJuYy5vcmcvc3FsaXRlIGB2MS41My4wYCDihpIgYHYxLjU0LjBgCgo8L2RldGFpbHM+CgoqKlsoRnVsbCBDaGFuZ2Vsb2cpXShodHRwczovL3JlZGlyZWN0LmdpdGh1Yi5jb20vYW5jaG9yZS9zeWZ0L2NvbXBhcmUvdjEuNDkuMC4uLnYxLjUwLjApKioKCjwvZGV0YWlscz4KCi0tLQoKIyMjIENvbmZpZ3VyYXRpb24KCvCfk4UgKipTY2hlZHVsZSoqOiAoVVRDKQoKLSBCcmFuY2ggY3JlYXRpb24KICAtIEF0IGFueSB0aW1lIChubyBzY2hlZHVsZSBkZWZpbmVkKQotIEF1dG9tZXJnZQogIC0gQXQgYW55IHRpbWUgKG5vIHNjaGVkdWxlIGRlZmluZWQpCgrwn5qmICoqQXV0b21lcmdlKio6IERpc2FibGVkIGJ5IGNvbmZpZy4gUGxlYXNlIG1lcmdlIHRoaXMgbWFudWFsbHkgb25jZSB5b3UgYXJlIHNhdGlzZmllZC4KCuKZuyAqKlJlYmFzaW5nKio6IFdoZW5ldmVyIFBSIGJlY29tZXMgY29uZmxpY3RlZCwgb3IgeW91IHRpY2sgdGhlIHJlYmFzZS9yZXRyeSBjaGVja2JveC4KCvCflJUgKipJZ25vcmUqKjogQ2xvc2UgdGhpcyBQUiBhbmQgeW91IHdvbid0IGJlIHJlbWluZGVkIGFib3V0IHRoaXMgdXBkYXRlIGFnYWluLgoKLS0tCgogLSBbIF0gPCEtLSByZWJhc2UtY2hlY2sgLS0+SWYgeW91IHdhbnQgdG8gcmViYXNlL3JldHJ5IHRoaXMgUFIsIGNoZWNrIHRoaXMgYm94CgotLS0KClRoaXMgUFIgd2FzIGdlbmVyYXRlZCBieSBbTWVuZCBSZW5vdmF0ZV0oaHR0cHM6Ly9tZW5kLmlvL3Jlbm92YXRlLykuIFZpZXcgdGhlIFtyZXBvc2l0b3J5IGpvYiBsb2ddKGh0dHBzOi8vZGV2ZWxvcGVyLm1lbmQuaW8vZ2l0aHViL29zaXNtL3JlbGVhc2UpLgo8IS0tcmVub3ZhdGUtZGVidWc6ZXlKamNtVmhkR1ZrU1c1V1pYSWlPaUkwTkM0ekxqSWlMQ0oxY0dSaGRHVmtTVzVXWlhJaU9pSTBOQzR6TGpJaUxDSjBZWEpuWlhSQ2NtRnVZMmdpT2lKdFlXbHVJaXdpYkdGaVpXeHpJanBiSW5KbGJtOTJZWFJsSWwxOS0tPgo=
      patchset: b7813fb62309d63160ae54a50d8fae4be8dcd6e8
      pipeline: check
      playbook_context:
        playbook_projects:
          trusted/project_0/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          trusted/project_1/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
          trusted/project_2/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_0/github.com/osism/zuul-jobs:
            canonical_name: github.com/osism/zuul-jobs
            checkout: main
            commit: dcb06ea8a3ad422cc9d98b376216617b2daa6a02
          untrusted/project_1/github.com/osism/zuul-config:
            canonical_name: github.com/osism/zuul-config
            checkout: main
            commit: 71b711c422c10c242a8f785dc6d41ed9d12e9cd3
          untrusted/project_2/github.com/osism/openinfra-zuul-jobs:
            canonical_name: github.com/osism/openinfra-zuul-jobs
            checkout: master
            commit: 242732586e2cba04d04867d3e302888c766bc231
        playbooks:
        - path: untrusted/project_0/github.com/osism/zuul-jobs/playbooks/flake8/run.yaml
          roles:
          - checkout: main
            checkout_description: zuul branch
            link_name: ansible/playbook_0/role_0/zuul-config
            link_target: untrusted/project_1/github.com/osism/zuul-config
            role_path: ansible/playbook_0/role_0/zuul-config/roles
          - checkout: master
            checkout_description: project default branch
            link_name: ansible/playbook_0/role_1/openinfra-zuul-jobs
            link_target: untrusted/project_2/github.com/osism/openinfra-zuul-jobs
            role_path: ansible/playbook_0/role_1/openinfra-zuul-jobs/roles
          - checkout: main
            checkout_description: playbook branch
            link_name: ansible/playbook_0/role_2/zuul-jobs
            link_target: untrusted/project_0/github.com/osism/zuul-jobs
            role_path: ansible/playbook_0/role_2/zuul-jobs/roles
      post_review: false
      post_timeout: 1800
      pre_timeout: null
      project:
        canonical_hostname: github.com
        canonical_name: github.com/osism/release
        name: osism/release
        short_name: release
        src_dir: src/github.com/osism/release
      projects:
        github.com/osism/release:
          canonical_hostname: github.com
          canonical_name: github.com/osism/release
          checkout: main
          checkout_description: zuul branch
          commit: ef0b77eff12a1c91e5657e2a3224b467d20c8ae1
          name: osism/release
          required: false
          short_name: release
          src_dir: src/github.com/osism/release
      ref: refs/pull/2641/head
      resources: {}
      tenant: osism
      timeout: 1800
      topic: null
      voting: true
