v0.23.6

What's Changed

• build(deps): bump chainguard.dev/melange from 0.11.5 to 0.11.6 by @dependabot in #1168
• build(deps): bump github.com/charmbracelet/bubbles from 0.19.0 to 0.20.0 by @dependabot in #1167
• go 1.23.1 by @k4leung4 in #1169
• Consider subpackage runtime deps for graph by @jonjohnsonjr in #1150
• build(deps): bump step-security/harden-runner from 2.9.1 to 2.10.1 by @dependabot in #1170
• build(deps): bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace from 1.29.0 to 1.30.0 by @dependabot in #1171
• build(deps): bump github.com/google/osv-scanner from 1.8.4 to 1.8.5 by @dependabot in #1174
• scan: Set auth for remote packages sometimes by @jonjohnsonjr in #1176
• Improve error message for duplicate package names by @jonjohnsonjr in #1177
• Bump apko, fix breaking change by @jonjohnsonjr in #1178
• build(deps): bump github.com/charmbracelet/bubbletea from 1.1.0 to 1.1.1 by @dependabot in #1180
• pin dep for grype by @k4leung4 in #1182
• Upgrade melange by @xnox in #1183
• build(deps): bump github.com/anchore/grype from 0.80.0 to 0.80.1 by @dependabot in #1179

Full Changelog: v0.23.5...v0.23.6