chore(deps): update all non-major dependencies

[renovate]

This PR contains the following updates:

Package	Type	Update	Change	Age	Confidence
alpine	final	minor	3.21 -> 3.22
anchore/sbom-action	action	minor	v0.18.0 -> v0.20.2
github.com/lestrrat-go/jwx/v2	require	patch	v2.1.4 -> v2.1.6

---

Release Notes

anchore/sbom-action (anchore/sbom-action)

v0.20.2

Compare Source

Changes in v0.20.2

• Update Syft to v1.28.0 (#​526)

v0.20.1

Compare Source

Changes in v0.20.1

• Update Syft to v1.27.1 (#​525)

v0.20.0

Compare Source

Changes in v0.20.0

• chore(deps): update Syft to v1.24.0 (#​522)

v0.19.0

Compare Source

Changes in v0.19.0

• chore(deps): update Syft to v1.23.0 (#​521)
• chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.8 (#​519)
• chore(deps): bump cross-spawn (#​514)

lestrrat-go/jwx (github.com/lestrrat-go/jwx/v2)

v2.1.6

Compare Source

What's Changed

Please read the Changes file and upgrade accordingly, especially if you are using the following combinations for JWE:

• DIRECT mode content encryption
• Using A256CBC_HS512
• With an erroneously created CEK of exactly 32-bytes.

---

• jws: backport jws parsing ehancements by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/1363
• [v2] Backport #​1367 by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/1368

Full Changelog: lestrrat-go/jwx@v2.1.5...v2.1.6

v2.1.5

Compare Source

What's Changed

• jws/jwe: split token into fixed number of parts (#​1308) by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/1309
• Bump golangci/golangci-lint-action from 6.5.0 to 6.5.1 by @​dependabot in https://github.com/lestrrat-go/jwx/pull/1317
• Bump golangci/golangci-lint-action from 6.5.1 to 6.5.2 by @​dependabot in https://github.com/lestrrat-go/jwx/pull/1319
• Bump golangci/golangci-lint-action from 6.5.2 to 7.0.0 by @​dependabot in https://github.com/lestrrat-go/jwx/pull/1327
• Remove use of go1.22 in CI by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/1356
• v2: jws/jwe: split token into fixed number of parts (#​1308) by @​lestrrat in https://github.com/lestrrat-go/jwx/pull/1355
• Bump github.com/lestrrat-go/blackmagic from 1.0.2 to 1.0.3 by @​dependabot in https://github.com/lestrrat-go/jwx/pull/1354
• autodoc updates by @​github-actions in https://github.com/lestrrat-go/jwx/pull/1359

Full Changelog: lestrrat-go/jwx@v2.1.4...v2.1.5

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Enabled.

♻ Rebasing: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

This PR was generated by Mend Renovate. View the repository job log.

[renovate]

⚠️ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

• any of the package files in this branch needs updating, or
• the branch becomes conflicted, or
• you click the rebase/retry checkbox if found above, or
• you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum

Command failed: go get -d -t ./...
go: module github.com/lestrrat-go/jwx/[email protected] requires go >= 1.23.0; switching to go1.23.10
go: downloading go1.23.10 (linux/amd64)
go: download go1.23.10: golang.org/[email protected]: verifying module: checksum database disabled by GOSUMDB=off