Added Features tighten source-distribution external refs [PR #5493 @wagoodman] output source PURL as external reference [PR #5246 @swadaptive] Full cataloging of archive contents [Issue #246] [PR #5260 @kzantow] Bug Fixes hash each file once in the file digest cataloger [PR #5491 @wagoodman] Support envoy binary various versions [Issue #5470] [PR #5476 @pujitha24] Support istio binary various vers…
Added Features Add support for scanning IPK packages using the deb-archive-cataloger [PR #5111 @skyhisi] Bug Fixes Pin Gguff lib to prevent dropping packages [PR #5447 @spiffcs] Licensing: copyright holder missing, needed for Debian packaging [Issue #5394] [PR #5414 @wagoodman] Syft cli.Command() panics when invoked multiple times [Issue #2285] [PR #5386 @JasonMetal] Additional Changes bump go-mak…
Bug Fixes resolve packages.lock dependencies deterministically [PR #5210 @spiffcs] Cannot produce attestation file from local podman image [Issue #1664] [PR #5368 @Bru456] Dependencies 9 dependency changes (9 updated). Updated (9 packages) github.com/anchore/go-rpmdb v0.2.0 → v0.2.2 github.com/anchore/stereoscope v0.3.3 → v0.3.4 github.com/docker/cli v29.8.1+incompatible → v29.8.2+incompatible git…
Added Features report the perl interpreter as a cpan package [PR #5132 @wagoodman] Add package cataloger for perl ecosystem [Issue #1906] [PR #5131 @wagoodman] Analyze with Non-Daemon podman [Issue #1173] Bug Fixes write a name for the root package when the source has none [PR #5349 @DrVelvetFog] match opensource.org license URLs across SPDX URL forms [PR #5361 @willmurphyscode] Account for malfor…
Release v1.53.0
Added Features passthrough-exact-format copies matching syft-json input unchanged [PR #5279 @juanjsebgarcia] Bug Fixes bound what a compressed kernel module expands to [PR #5294 @wagoodman] bound the decompressed members of a .deb archive [PR #5293 @wagoodman] alpm mtree gzip unbounded processing [PR #5292 @wagoodman] graalvm unbounded allocation [PR #5291 @wagoodman] harden .NET PE/ELF parsing ag…
Bug Fixes detect multi-arch ingress-nginx [PR #5179 @CAOShurong] keep the epoch when parsing RPM manifest packages [PR #5201 @sueun-dev] correct Apache Derby group ID in purl generation [PR #5090 @Ankush-Pathak] move image hardlink handling upstream during image indexing [PR #5196 @wagoodman] keep epoch-pinned requirements in the SBOM [PR #5161 @sueun-dev] Prevent unnecessary allocations when pars…
Added Features detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel] add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman] Bug Fixes Cleanup snap temporary directories [PR #5117 @spiffcs] add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel] javascript-package-cataloger creates phantom <name>@unknown packages…
Added Features Add bun binary classifier [PR #5103 @rezmoss] Bug Fixes Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz] Decode golang symbols [PR #5089 @wagoodman] CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees] apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094]…
Added Features Support for application/vnd.oci.image.index.v1+json manifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos] Bug Fixes Misinterpretation of Multiple replace Directives in Golang [Issue #2721] [PR #5069 @ychampion] Dependencies 16 dependency changes (16 updated). Updated (16 packages) github.com/anchore/go-rpmdb v0.1.0 → v0.2.0 github.com/anchore/stereoscope v0.2.2 → v0.3.0…
Added Features emit dependency relationships from mix.lock [PR #4985 @cgreeno] add safe tensor model type to SBOM output [PR #4844 @spiffcs] Capture golang binary symbols [PR #4988 @spiffcs] Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman] Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404] Support for vcpkg [Issue #2110] [PR #4081 @gabetrau] Add macOS .app cataloger […
Release v1.47.0
Added Features Add purl types to cataloger info cmd [PR #4984 @wagoodman] Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu] Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss] SPDX 3 Support [Issue #4250] [PR #4269 @kzantow] Add Deno support [Issue #4417] [PR #4523 @rezmoss] Catalog Elastic Beats binary [Issue #4961] [PR #4969 @r…
Bug Fixes bump stereoscope to pull in fix for registry client hanging [#4934 @anchore-oss-update-bot] (Full Changelog)
Added Features Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke] MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze] Catalog ingress-nginx binary [#4818 #4857 @witchcraze] Bug Fixes Support helm binary various versions [#4820 #4922 @witchcraze] Support julia binary various versions [#4867 #4945 @witchcraze] Support deno binar…
Added Features Add support for linux-riscv64 [#4757 @luhenry] Bug Fixes Yarn lockfile cataloguing does not handle aliases [#4833 #4836 @cyphercodes] Some snippet files are saved in the previous test directory [#4829 #4830 @witchcraze] empty rockspec causes index out of range [#4824 #4827 @aki1770-del] PE cataloger shows asp.net core ref assemblies using fileversion build stamp instead of productve…
Added Features added deno bin classifiers [#4677 @rezmoss] Support haskell old versions [#3237 #4793 @witchcraze] Add support for OpenLDAP binary detection [#4768 #4755 @nadimz] Support erlang ols versions [#3235 #4766 @witchcraze] Bug Fixes improve redhat-release parsing fallback for RHEL clones [#4808 @westonsteimel] fix format string in search results struct [#4775 @willmurphyscode] prevent inf…
Bug Fixes Similar Packages Should Be Aggregated [#1162] Support arangodb binary recent version [#4571 #4662 @witchcraze] Support go binary various versions [#4687 #4694 @kzantow] Additional Changes update CPE dictionary index [#4745 @anchore-oss-update-bot] update CPE dictionary index [#4726 @anchore-oss-update-bot] Add a trust boundary section [#4716 @joshbressers] (Full Changelog)
Bug Fixes Missing secondary evidence for .NET dependency in ghcr.io/open-telemetry/demo:2.0.0-accounting image [#4652] Additional Changes bump github.com/buger/jsonsparser to v1.1.2 [#4680 @willmurphyscode] centralize temp files and prefer streaming IO [#4668 @willmurphyscode] (Full Changelog)
Bug Fixes [BUG] Incorrect Maven PURL generation: Automatic-Module-Name should not be used as Maven groupId [#4611 #4642 @xnox] Checksum is 0 for spdx files [#2307 #4620 @ppalucha] Support grafana binary various versions [#4559 #4635 @witchcraze] Additional Changes migrate fixtures to testdata [#4651 @wagoodman] (Full Changelog)
Bug Fixes Use redhat as namespace for hummingbird rpms [#4615 @scoheb] False Positive: Emacs snap package version CVE-2024-39331 [#4485] Additional Changes call cleanup on tmpfile and replace some io.ReadAlls with streams [#4629 @willmurphyscode] bumps go mod version to 1.25; ci takes latest patch [#4628 @spiffcs] (Full Changelog)
Added Features Add support for scanning GGUF models from OCI registries [#4335 @spiffcs] yarn lockfile scan doesnt catch dev dependencies [#4548 #4549 @rezmoss] Additional Changes CPE detection for APK libavif to use aomedia vendor [#4597 @naag] (Full Changelog)