chore(deps): update dependency owasp-dep-scan/dep-scan to v6

[mms-renovate-ce]

This PR contains the following updates:

Package	Update	Change
owasp-dep-scan/dep-scan	major	v5.5.0 -> v6.0.0

---

Release Notes

owasp-dep-scan/dep-scan (owasp-dep-scan/dep-scan)

v6.0.0

Compare Source

depscan v6 is a major release that is powered by the next generation of abcd (atom, blint, cdxgen, and dosai) tools.

What's Changed

• Sync master from 5.x by @​prabhu in #​232
• Let's make 6.x the default by @​prabhu in #​265
• Add compatibility for future oras releases by @​Quince-Pie in #​271
• Tweaks by @​prabhu in #​273
• Add nix flake using pyproject.nix by @​Quince-Pie in #​277
• Consider deprecated packages as more risky. Ported to v6 by @​prabhu in #​285
• Port various false positives fixes from v5 by @​prabhu in #​291
• Added generic cdxgen_args that can be passed as an environment variable or argument to depscan itself. by @​deleterepo in #​293
• Aliases for dotnet runtime by @​prabhu in #​295
• Update cdxgen to bring go purl compatibility fixes by @​prabhu in #​298
• pypi redis:redis bug fixed in v6 by @​prabhu in #​303
• [Fix] Dockerfile - almalinux build is broken and make python version an argument by @​aryan-rajoria in #​305
• Update container packages by @​prabhu in #​309
• Risk audit improvements by @​prabhu in #​313
• Use the bin block and name suffixes to report possible binary by @​prabhu in #​319
• npm binary research by @​prabhu in #​321
• Fix for generic packages false positives for v6 by @​prabhu in #​323
• FIX: ensure python3.12 in docker image by @​aryan-rajoria in #​325
• Generate sbom with research profile by @​prabhu in #​328
• FEAT: Add support audit cargo by @​aryan-rajoria in #​329
• Feat: add package can include binaries by @​aryan-rajoria in #​333
• Feature/vdb6 by @​cerrussell in #​335
• Removed project alias for pypi which was resulting in FP by @​prabhu in #​343
• fix: add reachable label when a purl does not have a vendor by @​harshit-kochar in #​344
• Do not suffix s for all pypi packages. Fixes #​341 by @​prabhu in #​347
• Removes aliasing for namespaces that affected maven by @​prabhu in #​350
• Add two jinja templates for SARIF (all and only critical) by @​dmarushkin in #​351
• Cache vdb for consistence in snapshot tests. by @​cerrussell in #​356
• Adds alias for dompdf. Support for search by cpe and url by @​prabhu in #​359
• New contrib script to track direct and indirect vulns in npm packages by @​prabhu in #​363
• Use cjd libs for io. by @​cerrussell in #​364
• Post-vdb6 integration enhancements by @​cerrussell in #​355
• Added count column by @​prabhu in #​367
• Fix: quart fix by @​aryan-rajoria in #​370
• Fix issue #​371 cli args. by @​cerrussell in #​376
• Update metrics for cvss v4 by @​cerrussell in #​374
• Doc: Adding documentation website by @​aryan-rajoria in #​377
• Docs: add .readthedocs.yaml by @​aryan-rajoria in #​378
• Docs: add NLNET funding by @​aryan-rajoria in #​379
• Docs: relocate documentation images to new directory by @​aryan-rajoria in #​381
• Use uv by @​prabhu in #​392
• issue-390: Fixed the editURL of docusaurus by @​gnittala in #​391
• Trim cli args by @​prabhu in #​394
• Integrate blint as an extension by @​prabhu in #​399
• Support for config file by @​prabhu in #​400
• Refactored bom generation with the new xbom-lib package by @​prabhu in #​401
• analysis_lib package by @​prabhu in #​404
• vulnerability analysis algos by @​prabhu in #​405
• container bom analysis by @​prabhu in #​406
• Reachability analyzer algorithms by @​prabhu in #​408
• Refactor explainer logic by @​prabhu in #​409
• Semantic analysis improvements by @​prabhu in #​411
• Test: Adding dontet, golang and c tests by @​aryan-rajoria in #​410
• semantics dotnet by @​prabhu in #​412
• Tweaks to table output and explanations by @​prabhu in #​413
• Python semantic analysis tweaks by @​prabhu in #​414
• go semantics by @​prabhu in #​415
• semantics php by @​prabhu in #​416
• c semantics by @​prabhu in #​421
• Customizable explanation modes by @​prabhu in #​422
• explainer js simplified by @​prabhu in #​423
• Track identity evidences in VDR by @​prabhu in #​424
• Improved fix version matching by @​prabhu in #​425
• self semantics test by @​prabhu in #​426
• dejacode scan test by @​prabhu in #​427
• Setup devenv.sh by @​prabhu in #​428
• Doc: add dotnet-podcast tutorial by @​aryan-rajoria in #​429
• cdxgen sane defaults by @​prabhu in #​430
• Trim duplicate explanations with id match by @​prabhu in #​431
• Upgrade to almalinux 10 by @​prabhu in #​432
• Docs: fix typo in quick start docker command by @​jasonlhills in #​434
• html reporting - part 1 by @​prabhu in #​437
• Various bugfixes of reporting_lib by @​lucacapacci in #​438
• Added recommendations in reachable flows and other fixes by @​lucacapacci in #​439
• minor bugfixes by @​lucacapacci in #​440
• Annotate_vdr: fix reading metadata.get("tools", {}).get("components", {}), create vdr file in report folder in #​441
• Server hardening with allowlisting for path and ip addresses. by @​prabhu in #​452
• Make blintdb opt-in by @​prabhu in #​453
• Few security improvements by @​prabhu in #​455
• LLM prompt generation in explanation by @​prabhu in #​456

New Contributors

• @​dmarushkin made their first contribution in #​351
• @​gnittala made their first contribution in #​391
• @​jasonlhills made their first contribution in #​434
• @​lucacapacci made their first contribution in #​438

Full Changelog: owasp-dep-scan/dep-scan@v5.5.0...v6.0.0

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Renovate Bot.

[mms-renovate-ce]

Edited/Blocked Notification

Renovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR.

You can manually request rebase by checking the rebase/retry box above.

⚠️ Warning: custom changes will be lost.