fix(deps): update module github.com/anchore/syft to v1.20.0

[netic-renovate-bot]

This PR contains the following updates:

Package	Type	Update	Change
github.com/anchore/syft	require	minor	v1.19.0 -> v1.20.0

---

Release Notes

anchore/syft (github.com/anchore/syft)

v1.20.0

Compare Source

Added Features

• Add file catalogers to selection configuration [#​3505 @​wagoodman]
• Configuration for including license contents in SBOM [#​3626 #​3631 @​spiffcs]
• Support Bitnami embedded SBOMs [#​3065 #​3341 @​juan131]

Bug Fixes

• Version parse caused by line breaks on different platforms [#​3672 @​idhyt]
• find bitnami files even when no relationships [#​3676 @​willmurphyscode]
• License files which do not match an SPDX expression are erroneously handled as 'unlicensed' [#​3412 #​3366 @​HeyeOpenSource]
• Incorrect URL encoding of package url (purl) [#​3533 #​3678 @​kzantow]
• syft should not warn on known bad package.json [#​3470 #​3645 @​kzantow]
• Scanning a project with many DLLs is slow [#​3455 #​3677 @​rogueai]
• cyclone-dx presenter drops files, includes only packages [#​3435 #​3539 @​spiffcs]
• "syft config" output swaps comments for search-indexed-archives / search-unindexed-archives [#​3624 #​3630 @​spiffcs]
• dpkg license improvement for non SPDX licenses [#​3090 #​3366 @​HeyeOpenSource]
• RPM-based PURLs sometimes have incorrect namespace (specifically OpenSUSE) [#​3534 #​3615 @​mprpic]

Additional Changes

• update to go 1.24.x [#​3660 @​westonsteimel]
• replace all shorthand tags of mapstruct -> mapstructure [#​3633 @​spiffcs]

(Full Changelog)

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[netic-renovate-bot]

ℹ Artifact update notice

File name: go.mod

In order to perform the update(s) described in the table above, Renovate ran the go get command, which resulted in the following additional change(s):

• 2 additional dependencies were updated
• The go directive was updated for compatibility reasons

Details:

Package	Change
go	1.24.0 -> 1.24.0
github.com/anchore/packageurl-go	v0.1.1-0.20250117185454-edf36a908b10 -> v0.1.1-0.20250220190351-d62adb6e1115
github.com/docker/docker	v27.5.1+incompatible -> v28.0.0+incompatible