build(deps): bump github.com/anchore/syft from 1.51.0 to 1.51.1 in the syft group across 1 directory

[dependabot]

Bumps the syft group with 1 update in the / directory: github.com/anchore/syft.

Updates github.com/anchore/syft from 1.51.0 to 1.51.1

Release notes

Sourced from github.com/anchore/syft's releases.

v1.51.1

Bug Fixes

• detect multi-arch ingress-nginx [PR #5179 @​CAOShurong]
• keep the epoch when parsing RPM manifest packages [PR #5201 @​sueun-dev]
• correct Apache Derby group ID in purl generation [PR #5090 @​Ankush-Pathak]
• move image hardlink handling upstream during image indexing [PR #5196 @​wagoodman]
• keep epoch-pinned requirements in the SBOM [PR #5161 @​sueun-dev]
• Prevent unnecessary allocations when parsing compressed ELF sections [PR #5187 @​wagoodman]
• honor the io.ReaderAt contract in readerAtAdapter [PR #5186 @​wagoodman]
• Support grafana binary various version [Issue #5059] [PR #5213 @​pujitha24]
• Excluded paths are still scanned and cause syft to crash [Issue #3258]
• Dotnet: Incorrect relationship graph in case of using package locks [Issue #5125] [PR #5143 @​pujitha24]
• Survive indexing not accessible files [Issue #3286] [PR #5170 @​addielaruee]
• CPE target_sw not being set consistency for Rust crates [Issue #3956] [PR #5167 @​Xenira]
• panic: nil pointer dereference in squashfs.(*File).Read when scanning snap (regression from 1.44.0) [Issue #4989] [PR #5119 @​kzantow]
• golang remote license search attempts to resolve stdlib modules [Issue #3149] [PR #5192 @​luantaraschi]

Additional Changes

• gzip binary classifier reports false-positive GNU gzip from BusyBox multicall binary via applet symlink [Issue #5171] [PR #5202 @​spiffcs]
• pnpm v5 lockfile: underscore peer-dep suffixes are not stripped from package versions [Issue #5174] [PR #5175 @​codeAnqiang-ma]
• pnpm cataloger reads only the first YAML document: SBOM contains pnpm's own binaries and no project dependencies [Issue #5168] [PR #5188 @​hamodywe]

Dependencies

72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.

🟢 Remediated (3)

• GO-2026-5158 (Medium) — go.opentelemetry.io/otel
• GO-2026-6179 (High) — golang.org/x/mod
• GO-2026-6180 (High) — golang.org/x/mod

• cel.dev/expr v0.25.1 → v0.25.2
• cloud.google.com/go/auth v0.18.2 → v0.22.0
• cloud.google.com/go/iam v1.5.3 → v1.11.0
• cloud.google.com/go/logging v1.13.1 → v1.18.0
• cloud.google.com/go/longrunning v0.8.0 → v1.2.0
• cloud.google.com/go/monitoring v1.24.3 → v1.29.0
• cloud.google.com/go/storage v1.61.3 → v1.64.0
• cloud.google.com/go/trace v1.11.7 → v1.16.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 → v1.33.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 → v0.57.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 → v0.57.0
• github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 → v0.57.0
• github.com/anchore/stereoscope v0.3.0 → v0.3.1

... (truncated)

Commits

• 91a0032 chore(deps): update anchore dependencies (#5085)
• f91bf45 fix: correct Apache Derby group ID in purl generation (#5090)
• c5fc699 chore(deps): update CPE dictionary index (#5221)
• d3734dd fix(binary): detect grafana security-patch release versions (#5213)
• bf82010 fix(lua): skip rockspec with no package name (#4825)
• 7ca1f22 fix(dotnet): correct inverted dependency-of relationship direction in package...
• 93cf893 fix(rpm): keep the epoch when parsing RPM manifest packages (#5201)
• 34ef7dc chore(deps): bump golang.org/x/mod from 0.39.0 to 0.40.0 (#5208)
• 29edf90 chore(deps): bump github.com/hashicorp/go-getter from 1.8.6 to 1.8.8 (#5207)
• 766907e chore(deps): bump github.com/stretchr/testify from 1.11.1 to 1.12.0 (#5206)
• Additional commits viewable in compare view