Bug Fixes detect multi-arch ingress-nginx [PR #5179 @CAOShurong] keep the epoch when parsing RPM manifest packages [PR #5201 @sueun-dev] correct Apache Derby group ID in purl generation [PR #5090 @Ankush-Pathak] move image hardlink handling upstream during image indexing [PR #5196 @wagoodman] keep epoch-pinned requirements in the SBOM [PR #5161 @sueun-dev] Prevent unnecessary allocations when pars…
Added Features detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel] add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman] Bug Fixes Cleanup snap temporary directories [PR #5117 @spiffcs] add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel] javascript-package-cataloger creates phantom <name>@unknown packages…
Added Features Add bun binary classifier [PR #5103 @rezmoss] Bug Fixes Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz] Decode golang symbols [PR #5089 @wagoodman] CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees] apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094]…
Added Features Support for application/vnd.oci.image.index.v1+json manifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos] Bug Fixes Misinterpretation of Multiple replace Directives in Golang [Issue #2721] [PR #5069 @ychampion] Dependencies 16 dependency changes (16 updated). Updated (16 packages) github.com/anchore/go-rpmdb v0.1.0 → v0.2.0 github.com/anchore/stereoscope v0.2.2 → v0.3.0…
Added Features emit dependency relationships from mix.lock [PR #4985 @cgreeno] add safe tensor model type to SBOM output [PR #4844 @spiffcs] Capture golang binary symbols [PR #4988 @spiffcs] Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman] Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404] Support for vcpkg [Issue #2110] [PR #4081 @gabetrau] Add macOS .app cataloger […
Release v1.47.0
Added Features Add purl types to cataloger info cmd [PR #4984 @wagoodman] Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu] Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss] SPDX 3 Support [Issue #4250] [PR #4269 @kzantow] Add Deno support [Issue #4417] [PR #4523 @rezmoss] Catalog Elastic Beats binary [Issue #4961] [PR #4969 @r…
Bug Fixes bump stereoscope to pull in fix for registry client hanging [#4934 @anchore-oss-update-bot] (Full Changelog)
Added Features Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke] MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze] Catalog ingress-nginx binary [#4818 #4857 @witchcraze] Bug Fixes Support helm binary various versions [#4820 #4922 @witchcraze] Support julia binary various versions [#4867 #4945 @witchcraze] Support deno binar…
Added Features Add support for linux-riscv64 [#4757 @luhenry] Bug Fixes Yarn lockfile cataloguing does not handle aliases [#4833 #4836 @cyphercodes] Some snippet files are saved in the previous test directory [#4829 #4830 @witchcraze] empty rockspec causes index out of range [#4824 #4827 @aki1770-del] PE cataloger shows asp.net core ref assemblies using fileversion build stamp instead of productve…
Added Features added deno bin classifiers [#4677 @rezmoss] Support haskell old versions [#3237 #4793 @witchcraze] Add support for OpenLDAP binary detection [#4768 #4755 @nadimz] Support erlang ols versions [#3235 #4766 @witchcraze] Bug Fixes improve redhat-release parsing fallback for RHEL clones [#4808 @westonsteimel] fix format string in search results struct [#4775 @willmurphyscode] prevent inf…
Bug Fixes Similar Packages Should Be Aggregated [#1162] Support arangodb binary recent version [#4571 #4662 @witchcraze] Support go binary various versions [#4687 #4694 @kzantow] Additional Changes update CPE dictionary index [#4745 @anchore-oss-update-bot] update CPE dictionary index [#4726 @anchore-oss-update-bot] Add a trust boundary section [#4716 @joshbressers] (Full Changelog)
Bug Fixes Missing secondary evidence for .NET dependency in ghcr.io/open-telemetry/demo:2.0.0-accounting image [#4652] Additional Changes bump github.com/buger/jsonsparser to v1.1.2 [#4680 @willmurphyscode] centralize temp files and prefer streaming IO [#4668 @willmurphyscode] (Full Changelog)
Bug Fixes [BUG] Incorrect Maven PURL generation: Automatic-Module-Name should not be used as Maven groupId [#4611 #4642 @xnox] Checksum is 0 for spdx files [#2307 #4620 @ppalucha] Support grafana binary various versions [#4559 #4635 @witchcraze] Additional Changes migrate fixtures to testdata [#4651 @wagoodman] (Full Changelog)
Bug Fixes Use redhat as namespace for hummingbird rpms [#4615 @scoheb] False Positive: Emacs snap package version CVE-2024-39331 [#4485] Additional Changes call cleanup on tmpfile and replace some io.ReadAlls with streams [#4629 @willmurphyscode] bumps go mod version to 1.25; ci takes latest patch [#4628 @spiffcs] (Full Changelog)
Added Features Add support for scanning GGUF models from OCI registries [#4335 @spiffcs] yarn lockfile scan doesnt catch dev dependencies [#4548 #4549 @rezmoss] Additional Changes CPE detection for APK libavif to use aomedia vendor [#4597 @naag] (Full Changelog)