chore(deps): bump docker/scout-action from 1.24.0 to 1.26.0 in the github-actions group

[dependabot]

Bumps the github-actions group with 1 update: docker/scout-action.

Updates docker/scout-action from 1.24.0 to 1.26.0

Release notes

Sourced from docker/scout-action's releases.

v1.26.0

What's Changed

• Fixes docker scout watch failing with 401 Unauthorized about 15 minutes after it starts. The Docker token is now refreshed before it expires, and an image that fails to process no longer stops the watcher; it is retried on the next check. @​aubm
• Fixes docker scout attest list and docker scout attest get so they find attestations attached as OCI referrers on Docker Hub and other registries. Previously only attestations served by the Scout registry were listed. @​benja-M-1
• Fixes docker scout quickview showing VEX-suppressed CVEs in the Target row when VEX suppresses every CVE in the image. @​whostolebenfrog
• Fixes DHI base-image VEX statements not being applied to multistage builds that use a mirrored DHI base image (<org>/dhi-<name> naming). @​flyingmachine
• Fixes CycloneDX SBOM output to keep the original creation timestamp and generator tool names and versions. @​brianru
• Updates the embedded Trivy (0.72.0) and Syft (1.46.0) scanning engines. @​brianru

v1.25.0

What's Changed

• Adds discovery of software inside Debian and Alpine package archives, preserving package containment and separate package occurrences in SPDX SBOMs. Archive scanning is enabled by default and can be disabled with SCOUT_SBOM_EXPAND_ARCHIVES=false. @​brianru
• Fixes manual vulnerability exception handling so image scans correctly mark suppressed vulnerabilities and filter them with --ignore-suppressed, while reducing network requests. @​whostolebenfrog
• Moves exception details in --format sbom output from the top-level inventory to each vulnerability’s exceptions array. Consumers counting manual suppressions must filter for MANUAL_EXCEPTION. @​whostolebenfrog
• Adds warnings when manual exceptions cannot be applied in local mode or when loading older native SBOMs with legacy exception inventories. Older SBOMs require rescanning to restore manual-exception suppression. @​whostolebenfrog
• Updates the native Scout SBOM format to version 12 to support the expanded package inventory and SPDX relationships. @​brianru

Commits

• 221e7f4 Merge pull request #113 from docker/release/v1.25.0
• 8045d85 [BOT] Update assets for v1.25.0 release
• See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore <dependency name> major version will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself)
• @dependabot ignore <dependency name> minor version will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself)
• @dependabot ignore <dependency name> will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself)
• @dependabot unignore <dependency name> will remove all of the ignore conditions of the specified dependency
• @dependabot unignore <dependency name> <ignore condition> will remove the ignore condition of the specified dependency and ignore conditions

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: defaults
• Review profile: CHILL
• Plan: Advanced
• Run ID: f204d74c-9dff-4fd6-bcf7-fcd6ba08096c

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}