Bump github.com/anchore/grype from 0.119.0 to 0.120.0 in the anchore group

[dependabot]

Bumps the anchore group with 1 update: github.com/anchore/grype.

Updates github.com/anchore/grype from 0.119.0 to 0.120.0

Release notes

Sourced from github.com/anchore/grype's releases.

v0.120.0

Added Features

• Mark SLES as a comprehensive distro [PR #3732 @​willmurphyscode]
• Store NVD SSVC decision points in a new v6 decorator table [PR #3725 @​wagoodman]
• Adding Locations column to html template which help with triaging [PR #3092 @​santrancisco]

Bug Fixes

• sign release checksums with a sigstore bundle [PR #3759 @​wagoodman]
• chainguard osv package ecosystem should be package type [PR #3758 @​kzantow]
• include qualifiers for unaffected packages [PR #3734 @​kzantow]
• render TUI log lines on their own rows, with colors and a small header [PR #3735 @​wagoodman]
• match.dpkg.using-cpes (and match.rpm.using-cpes) is accepted but has no effect [Issue #3746] [PR #3747 @​amitschendel]
• embedded spaces in bin location breaks install.sh [Issue #2809] [PR #3738 @​bIackr0se]
• False positives: --add-cpes-if-none maps tomcat-embed-el to apache:tomcat CPE [Issue #3730]
• match.rpm.using-cpes has no effect [Issue #3752] [PR #3753 @​amitschendel]
• Import metadata digest is not in the expected format [Issue #3388]
• Issue Pulling DB update [Issue #3586]

Dependencies

88 dependency changes (59 updated, 27 added, 2 removed). 2 vulnerabilities remediated.

🟢 Remediated (2)

• GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/sdk
• GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2

Toolchains (1)

• Go minimum version: 1.26.3 → 1.26.8

• github.com/Microsoft/hcsshim v0.15.0-rc.1 → v0.15.0-rc.4
• github.com/anchore/bubbly v0.2.1 → v0.2.2
• github.com/anchore/go-logger v0.1.1 → v0.2.0
• github.com/anchore/go-rpmdb v0.2.0 → v0.2.1
• github.com/anchore/stereoscope v0.3.2 → v0.3.3
• github.com/anchore/syft v1.52.0 → v1.54.0
• github.com/bmatcuk/doublestar/v4 v4.10.0 → v4.10.2
• github.com/containerd/containerd/api v1.11.1 → v1.12.0
• github.com/containerd/containerd/v2 v2.3.5 → v2.4.1 (🟢 remediated GHSA-pg57-6jwg-q645)
• github.com/containerd/log v0.1.0 → v0.2.0
• github.com/containerd/ttrpc v1.2.8 → v1.2.9
• github.com/containerd/typeurl/v2 v2.2.3 → v2.3.0
• github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
• github.com/docker/cli v29.8.0+incompatible → v29.8.1+incompatible

... (truncated)

Commits

• 10fbc04 chore: have dependabot ignore major bumps of hashstructure (#3762)
• 2756979 chore(deps): update anchore dependencies (#3714)
• 2dca577 fix: sign release checksums with a sigstore bundle (#3759)
• 8ba5f69 fix: chainguard osv package ecosystem should be package type (#3758)
• 1e8fd22 Preserve quoted paths when running tagged installer scripts (#3738)
• aa8ae6e chore(deps): update quality gate database (#3756)
• 21d0716 Store NVD SSVC decision points in a new v6 decorator table (#3725)
• af8a988 chore(deps): bump syft to pick up CPAN package types (#3755)
• 1112002 fix: make match.rpm.using-cpes enable CPE matching (#3753)
• 7e26098 fix: find the repo root without git in test helpers (#3744)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[dependabot]

Looks like github.com/anchore/grype is updatable in another way, so this is no longer needed.