- vendor: github.com/andybalholm/brotli v1.2.7 by @crazy-max in #225
Important
This release updates the scanner's indirect dependency github.com/andybalholm/brotli to v1.2.7 to address CVE-2026-111497.
The vulnerability affects Brotli decoding of crafted compressed data. The updated dependency is included in the scanner image through its archive-processing libraries.
Update your SBOM generator image to docker/buildkit-syft-scanner:1.12.1. If you pin the image by digest, update that digest as well.
Full Changelog: v1.12.0...v1.12.1