Syft: baixar versions anteriors

Bug Fixes
- resolve packages.lock dependencies deterministically [PR #5210 @spiffcs]
- Cannot produce attestation file from local podman image [Issue #1664] [PR #5368 @Bru456]

Dependencies
9 dependency changes (9 updated).
Updated (9 packages)
- github.com/anchore/go-rpmdb v0.2.0 → v0.2.2
- github.com/anchore/stereoscope v0.3.3 → v0.3.4
- github.com/docker/cli v29.8.1+incompatible → v29.8.2+incompatible
- github.com/glebarez/go-sqlite v1.20.3 → v1.23.0
- github.com/klauspost/compress v1.20.0 → v1.20.1
- github.com/secure-systems-lab/go-securesystemslib v0.11.0 → v0.11.1
- github.com/sigstore/protobuf-specs v0.5.1 → v0.5.2
- github.com/sigstore/sigstore v1.10.8 → v1.10.11
- github.com/sylabs/sif/v2 v2.24.1 → v2.24.2
(Full Changelog)

Added Features
- report the perl interpreter as a cpan package [PR #5132 @wagoodman]
- Add package cataloger for perl ecosystem [Issue #1906] [PR #5131 @wagoodman]
- Analyze with Non-Daemon podman [Issue #1173]

Bug Fixes
- write a name for the root package when the source has none [PR #5349 @DrVelvetFog]
- match opensource.org license URLs across SPDX URL forms [PR #5361 @willmurphyscode]
- Account for malformed GGUF and safetensors parameter counts [PR #5343 @wagoodman]
- don't panic on a root file without a supplier or null entries [PR #5326 @DrVelvetFog]
- do not panic on a stack.yaml rev pin [PR #5310 @arpitjain099]
- report scanner errors and raise the line cap in metadata parsers [PR #5353 @wagoodman]
- Harden cataloger parsers against truncated input (do not panic) [PR #5355 @wagoodman]
- bound CPE candidate generation for pathological package metadata [PR #5356 @wagoodman]
- account for UPX's loader padding when unpacking Go binaries [PR #5347 @huuyafwww]
- handle malformed GGUF headers without panicking [PR #5345 @wagoodman]
- bound model companion file reads and validate their contents [PR #5344 @wagoodman]
- don't fail the whole SBOM when a cataloger panics on one file [PR #5342 @wagoodman]
- release package collection lock in Ubuntu ESM detection [PR #5336 @sverrirsig]
- render TUI log lines on their own rows, with colors and a small header [PR #5324 @wagoodman]
- uv.lock: dependents are linked to every locked version of a dependency [Issue #5340] [PR #5351 @devtechedge]
- java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy [Issue #5311] [PR #5313 @texasich]
- Support traefik binary various versions [Issue #4980] [PR #5281 @mayanksekhar]
- File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support [Issue #5325] [PR #5341 @wagoodman]
- not showing expat CVEs from syft generated sbom [Issue #4771] [PR #5259 @KR-Ravindra]
- PHP extensions are cataloged as upstream products using the PHP version [Issue #5014] [PR #5102 @pujitha24]
- Panic during scanning with gguf-cataloger/safetensors-cataloger [Issue #5327] [PR #5328 @tk1475]
- github-actions cataloger emits an invalid PURL for docker:// use statements [Issue #5299] [PR #5302 @yunaremaia]
- Crash when running syft on a directory that is the root file system of a Yocto build [Issue #5320] [PR #5321 @somaz94]
- Invalid PURLs when cataloging instrumentation classes/jars [Issue #2596]

Dependencies
79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/sdk
- GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2
Toolchains (1)
- Go minimum version: 1.26.3 → 1.26.8
Updated (48 packages)
- github.com/Microsoft/hcsshim v0.15.0-rc.1 → v0.15.0-rc.4
- github.com/anchore/bubbly v0.2.1 → v0.2.2
- github.com/anchore/go-logger v0.1.1 → v0.2.0
- github.com/anchore/stereoscope v0.3.2 → v0.3.3
- github.com/bmatcuk/doublestar/v4 v4.10.0 → v4.10.2
- github.com/containerd/containerd/api v1.11.1 → v1.12.0
- github.com/containerd/containerd/v2 v2.3.5 → v2.4.1 (🟢 remediated GHSA-pg57-6jwg-q645)
- github.com/containerd/log v0.1.0 → v0.2.0
- github.com/containerd/ttrpc v1.2.8 → v1.2.9
- github.com/containerd/typeurl/v2 v2.2.3 → v2.3.0
- github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
- github.com/docker/cli v29.8.0+incompatible → v29.8.1+incompatible
- github.com/docker/docker-credential-helpers v0.9.5 → v0.9.8
- github.com/dustin/go-humanize v1.0.1 → v1.1.0
- github.com/erofs/go-erofs v0.3.0 → v0.3.1
- github.com/felixge/httpsnoop v1.0.4 → v1.1.0
- github.com/fsnotify/fsnotify v1.9.0 → v1.10.1
- github.com/go-jose/go-jose/v4 v4.1.4 → v4.1.5
- github.com/go-logr/logr v1.4.3 → v1.4.4
- github.com/hashicorp/hcl/v2 v2.24.0 → v2.25.0
- github.com/magiconair/properties v1.18.11 → v1.18.12
- github.com/mattn/go-runewidth v0.0.21 → v0.0.27
- github.com/moby/sys/user v0.4.0 → v0.4.1
- github.com/moby

Added Features
- passthrough-exact-format copies matching syft-json input unchanged [PR #5279 @juanjsebgarcia]

Bug Fixes
- bound what a compressed kernel module expands to [PR #5294 @wagoodman]
- bound the decompressed members of a .deb archive [PR #5293 @wagoodman]
- alpm mtree gzip unbounded processing [PR #5292 @wagoodman]
- graalvm unbounded allocation [PR #5291 @wagoodman]
- harden .NET PE/ELF parsing against malformed binaries [PR #5267 @wagoodman]
- bound allocations from UPX-packed binary headers [PR #5195 @wagoodman]
- Syft rpm-db-cataloger reports stale libssh version from a single-layer Rocky Linux 10 image [Issue #5247]
- java-archive-cataloger returns unknown ver for uber-jars [Issue #5163] [PR #5164 @rezmoss]

Dependencies
52 dependency changes (52 updated). 6 vulnerabilities remediated.
🟢 Remediated (6)
- GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc
- GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2
- GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc
- GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc
- GO-2026-6354 (High) — golang.org/x/crypto
- GO-2026-6355 (High) — golang.org/x/crypto
Updated (52 packages)
- cloud.google.com/go/auth v0.22.0 → v0.23.2
- cloud.google.com/go/iam v1.11.0 → v1.12.0
- cloud.google.com/go/logging v1.18.0 → v1.19.0
- cloud.google.com/go/monitoring v1.29.0 → v1.30.0
- cloud.google.com/go/storage v1.64.0 → v1.65.1
- github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0
- github.com/anchore/go-sync v0.1.1 → v0.1.2
- github.com/anchore/stereoscope v0.3.1 → v0.3.2
- github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20
- github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40
- github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41
- github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0
- github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0
- github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0
- github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0
- github.com/aws/smithy-go v1.27.6 → v1.28.1
- github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv)
- github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible
- github.com/google/go-containerregistry v0.21.9 → v0.22.1
- github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20
- github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0
- github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3
- github.com/hashicorp/go-getter v1.8.8 → v1.8.9
- github.com/klauspost/compress v1.19.2 → v1.20.0
- github.com/moby/moby/api v1.55.0 → v1.56.0
- github.com/moby/moby/client v0.5.1 → v0.6.0
- github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8
- golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355)
- golang.org/x/mod v0.40.0 → v0.41.0
- golang.org/x/time v0.15.0 → v0.16.0
- google.golang.org/api v0.292.0 → v0.294.0
- google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1
- google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1
- google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42
- google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc)
- google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12
- modernc.

Bug Fixes
- detect multi-arch ingress-nginx [PR #5179 @CAOShurong]
- keep the epoch when parsing RPM manifest packages [PR #5201 @sueun-dev]
- correct Apache Derby group ID in purl generation [PR #5090 @Ankush-Pathak]
- move image hardlink handling upstream during image indexing [PR #5196 @wagoodman]
- keep epoch-pinned requirements in the SBOM [PR #5161 @sueun-dev]
- Prevent unnecessary allocations when parsing compressed ELF sections [PR #5187 @wagoodman]
- honor the io.ReaderAt contract in readerAtAdapter [PR #5186 @wagoodman]
- Support grafana binary various version [Issue #5059] [PR #5213 @pujitha24]
- Excluded paths are still scanned and cause syft to crash [Issue #3258]
- Dotnet: Incorrect relationship graph in case of using package locks [Issue #5125] [PR #5143 @pujitha24]
- Survive indexing not accessible files [Issue #3286] [PR #5170 @addielaruee]
- CPE target_sw not being set consistency for Rust crates [Issue #3956] [PR #5167 @Xenira]
- panic: nil pointer dereference in squashfs.(*File).Read when scanning snap (regression from 1.44.0) [Issue #4989] [PR #5119 @kzantow]
- golang remote license search attempts to resolve stdlib modules [Issue #3149] [PR #5192 @luantaraschi]

Additional Changes
- gzip binary classifier reports false-positive GNU gzip from BusyBox multicall binary via applet symlink [Issue #5171] [PR #5202 @spiffcs]
- pnpm v5 lockfile: underscore peer-dep suffixes are not stripped from package versions [Issue #5174] [PR #5175 @codeAnqiang-ma]
- pnpm cataloger reads only the first YAML document: SBOM contains pnpm's own binaries and no project dependencies [Issue #5168] [PR #5188 @hamodywe]

Dependencies
72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.
🟢 Remediated (3)
- GO-2026-5158 (Medium) — go.opentelemetry.io/otel
- GO-2026-6179 (High) — golang.org/x/mod
- GO-2026-6180 (High) — golang.org/x/mod
Updated (70 packages)
- cel.dev/expr v0.25.1 → v0.25.2
- cloud.google.com/go/auth v0.18.2 → v0.22.0
- cloud.google.com/go/iam v1.5.3 → v1.11.0
- cloud.google.com/go/logging v1.13.1 → v1.18.0
- cloud.google.com/go/longrunning v0.8.0 → v1.2.0
- cloud.google.com/go/monitoring v1.24.3 → v1.29.0
- cloud.google.com/go/storage v1.61.3 → v1.64.0
- cloud.google.com/go/trace v1.11.7 → v1.16.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 → v1.33.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 → v0.57.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 → v0.57.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 → v0.57.0
- github.com/anchore/stereoscope v0.3.0 → v0.3.1
- github.com/aws/aws-sdk-go-v2 v1.41.5 → v1.43.4
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 → v1.7.16
- github.com/aws/aws-sdk-go-v2/config v1.32.12 → v1.32.35
- github.com/aws/aws-sdk-go-v2/credentials v1.19.12 → v1.19.34
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 → v1.18.35
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 → v1.4.35
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 → v2.7.35
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 → v1.4.36
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 → v1.13.15
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 → v1.9.28
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 → v1.13.35
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 → v1.19.36
- github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 → v1.106.5
- github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 → v1.5.4
- github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 → v1.33.4
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 → v1.38.4
- github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 → v1.45.4
- github.com/aws/smithy-go v1.24.2 → v1.27.6
- github.com/containerd/containerd/v2 v2.3.3 → v2.3.4
- github.com/containerd/platforms v1.0.

Added Features
- detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel]
- add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman]

Bug Fixes
- Cleanup snap temporary directories [PR #5117 @spiffcs]
- add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel]
- javascript-package-cataloger creates phantom <name>@unknown packages for subpath or export-map stub package.json files [Issue #5118]
- Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #4598] [PR #5146 @ankit090701]
- When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #5019] [PR #5029 @wagoodman]
- Support deno binary latest and some old versions [Issue #5057] [PR #5084 @ychampion]
- Update install methods in README.md [Issue #3198]

Dependencies
9 dependency changes (9 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
- GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5
Updated (9 packages)
- github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
- github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
- github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)
- github.com/jedib0t/go-pretty/v6 v6.8.1 → v6.8.3
- github.com/klauspost/compress v1.19.0 → v1.19.1
- github.com/magiconair/properties v1.8.10 → v1.18.11
- github.com/ulikunitz/xz v0.5.15 → v0.5.16
- go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
- modernc.org/sqlite v1.54.0 → v1.55.0
(Full Changelog)

Added Features
- Add bun binary classifier [PR #5103 @rezmoss]

Bug Fixes
- Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz]
- Decode golang symbols [PR #5089 @wagoodman]
- CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees]
- apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094] [PR #5100 @cyphercodes]

Additional Changes
- package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #5101] [PR #5108 @Eljees]
- consider vendored golang packages in module attribution [PR #5093 @kzantow]
- Fix inverted bounds check dropping every Erlang string with a backslash [PR #5110 @arpitjain099]

Dependencies
14 dependency changes (14 updated). 1 vulnerability remediated.
🟢 Remediated (1)
- GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc
Updated (14 packages)
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
- github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
- github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
- github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
- github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
- go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
- google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
- google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
- google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
- modernc.org/cc/v4 v4.28.4 → v4.29.0
- modernc.org/ccgo/v4 v4.34.4 → v4.34.6
- modernc.org/gc/v3 v3.1.3 → v3.1.4
- modernc.org/libc v1.73.4 → v1.74.1
- modernc.org/sqlite v1.53.0 → v1.54.0
(Full Changelog)

Added Features
- Support for application/vnd.oci.image.index.v1+json manifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos]

Bug Fixes
- Misinterpretation of Multiple replace Directives in Golang [Issue #2721] [PR #5069 @ychampion]

Dependencies
16 dependency changes (16 updated).
Updated (16 packages)
- github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
- github.com/anchore/stereoscope v0.2.2 → v0.3.0
- github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
- github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
- github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
- github.com/moby/moby/api v1.54.2 → v1.55.0
- github.com/moby/moby/client v0.4.1 → v0.5.0
- github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
- golang.org/x/crypto v0.53.0 → v0.54.0
- golang.org/x/mod v0.37.0 → v0.38.0
- golang.org/x/net v0.56.0 → v0.57.0
- golang.org/x/sync v0.21.0 → v0.22.0
- golang.org/x/sys v0.46.0 → v0.47.0
- golang.org/x/term v0.44.0 → v0.45.0
- golang.org/x/text v0.38.0 → v0.40.0
- golang.org/x/tools v0.47.0 → v0.48.0
(Full Changelog)

Added Features
- emit dependency relationships from mix.lock [PR #4985 @cgreeno]
- add safe tensor model type to SBOM output [PR #4844 @spiffcs]
- Capture golang binary symbols [PR #4988 @spiffcs]
- Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman]
- Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404]
- Support for vcpkg [Issue #2110] [PR #4081 @gabetrau]
- Add macOS .app cataloger [Issue #4010] [PR #4490 @rezmoss]
- Add support for Kerberos 5 library cataloging [Issue #4780] [PR #4781 @nadimz]
- Include date of scan in results [Issue #3910]

Bug Fixes
- use printf instead of echo to fix ANSI color output [PR #4978 @Jouini-Mohamed-Chaker]
- Strip peer-dep suffix from deno.lock npm keys [PR #5055 @Synvoya]
- Allow more PEP440-compliant characters in python versions [PR #4964 @kzantow]
- PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #4996 @activeobd]
- Fix panic parsing a rockspec comment that ends at EOF [PR #5053 @arpitjain099]
- Fix Debian point release detection [PR #4997 @OsamaSE]
- Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #5041 @Synvoya]
- npm redis client generates no CPE [Issue #5011] [PR #5012 @rezmoss]
- Debug Docker images are running as nonroot user [Issue #4113] [PR #4608 @spiffcs]
- libxml2 gets the wrong cpe vendor [Issue #5015] [PR #5016 @rezmoss]
- wrong purl for spring-ldap-core dependency [Issue #4030] [PR #4908 @jonasboos]
- Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #3961] [PR #4785 @SAY-5]
- conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #5017] [PR #5020 @jfjrh2014]
- dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #4514] [PR #4517 @rezmoss]
- Go template sprig date functions not defined [Issue #2372] [PR #4644 @sputnik-mac]
- CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #4720] [PR #4782 @SAY-5]

Dependencies
9 dependency changes (8 updated, 1 added).
Updated (8 packages)
- github.com/bmatcuk/doublestar v1.3.1 → v8.8.8
- github.com/klauspost/compress v1.18.6 → v1.19.0
- golang.org/x/tools v0.46.0 → v0.47.0
- modernc.org/cc/v4 v4.28.2 → v4.28.4
- modernc.org/ccgo/v4 v4.34.0 → v4.34.4
- modernc.org/gc/v3 v3.1.2 → v3.1.3
- modernc.org/libc v1.72.3 → v1.73.4
- modernc.org/sqlite v1.51.0 → v1.53.0
Added (1 package)
- howett.net/plist v1.0.1
(Full Changelog)

Added Features
- Add purl types to cataloger info cmd [PR #4984 @wagoodman]
- Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu]
- Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss]
- SPDX 3 Support [Issue #4250] [PR #4269 @kzantow]
- Add Deno support [Issue #4417] [PR #4523 @rezmoss]
- Catalog Elastic Beats binary [Issue #4961] [PR #4969 @rezmoss]
- Add binary classifiers for Elastic Beats [Issue #4972] [PR #4969 @rezmoss]
- Catalog elastic-agent binary [Issue #4962]
- Add support for Bun lockfile (bun.lock) [Issue #4617] [PR #4625 @hnnynh]
- Add .bpl file support to the PE / DLL cataloger [Issue #4664] [PR #4954 @jfjrh2014]

Bug Fixes
- respect arch qualifier [PR #4987 @willmurphyscode]
- Preserve dependency edges when a compliance stub changes a package ID [PR #4993 @wagoodman]
- Support envoy binary various versions [Issue #4590] [PR #4605 @rezmoss]
- .net deps.json cataloger shows phantom pkgs for reference assembly library entries [Issue #4970] [PR #4971 @rezmoss]
- Syft does not extract package licenses from opkg manager [Issue #4940] [PR #4963 @Dashtid]
- squashfs breaks with godisk-fs 1.8.0 [Issue #4718]
- requirements.txt cataloger silently drops PEP 440 local version identifiers, producing incorrect PURL [Issue #4958] [PR #4959 @kzantow]

Dependencies
34 dependency changes (31 updated, 3 added). 5 vulnerabilities remediated.
🟢 Remediated (5)
- GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
- GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
- GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
- GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
- GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2
Updated (31 packages)
- github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
- github.com/anchore/bubbly v0.2.0 → v0.2.1
- github.com/anchore/clio v0.1.0 → v0.1.1
- github.com/anchore/fangs v0.1.0 → v0.1.1
- github.com/anchore/go-collections v0.1.0 → v0.1.1
- github.com/anchore/go-homedir v0.1.0 → v0.1.1
- github.com/anchore/go-logger v0.1.0 → v0.1.1
- github.com/anchore/go-lzo v0.1.0 → v0.1.1
- github.com/anchore/go-macholibre v0.1.0 → v0.1.1
- github.com/anchore/go-make v0.5.0 → v0.8.0
- github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
- github.com/anchore/go-sync v0.1.0 → v0.1.1
- github.com/anchore/stereoscope v0.2.1 → v0.2.2
- github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
- github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
- github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
- github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
- github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
- github.com/google/go-containerregistry v0.21.6 → v0.21.7
- github.com/jedib0t/go-pretty/v6 v6.7.10 → v6.8.1
- github.com/mattn/go-runewidth v0.0.19 → v0.0.21
- github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
- github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
- golang.org/x/crypto v0.52.0 → v0.53.0
- golang.org/x/mod v0.36.0 → v0.37.0
- golang.org/x/net v0.55.0 → v0.56.0
- golang.org/x/sync v0.20.0 → v0.21.0
- golang.org/x/sys v0.45.0 → v0.46.0
- golang.org/x/term v0.43.0 → v0.44.0
- golang.org/x/text v0.37.0 → v0.38.0
- golang.org/x/tools v0.45.0 → v0.46.0
Added (3 packages)
- github.com/piprate/json-gold v0.7.0
- github.com/pquerna/cachecontrol v0.0.0-1555304
- github.com/tailscale/hujson v0.0.0-ecc657c
(Full Changelog)

Bug Fixes
- bump stereoscope to pull in fix for registry client hanging [#4934 @anchore-oss-update-bot]
(Full Changelog)

Added Features
- Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke]
- MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
- Catalog ingress-nginx binary [#4818 #4857 @witchcraze]

Bug Fixes
- Support helm binary various versions [#4820 #4922 @witchcraze]
- Support julia binary various versions [#4867 #4945 @witchcraze]
- Support deno binary old versions [#4865 #4939 @witchcraze]
- Compressed kernel modules are not scanned by the linux-kernel-cataloger [#4721 #4740 @will-bates11]
- Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#4691 #4838 @calumleslie]
- Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882 @witchcraze]
- Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
- Exclude path ending with a slash are discarded [#4839 #4892 @ChrisJr404]
- Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
- fix parsing of debian/copyright files [#4708 #4754 @Bahtya]
- Grype ignores python requirements in arbitrary equality (===) format [#4834 #4835 @cyphercodes]
- valkey is detected as both of valkey and redis [#4591 #4619 @witchcraze]
- TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#4837 #4848 @ChrisJr404]

Additional Changes
- hoist name normalization regexp to package level [#4926 @matiasinsaurralde]
- bump the actions-minor-patch group across 1 directory with 6 updates [#4946 @dependabot]
- bump the actions-minor-patch group across 2 directories with 2 updates [#4936 @dependabot]
- bump the actions-minor-patch group across 1 directory with 4 updates [#4927 @dependabot]
- bump the actions-minor-patch group across 1 directory with 2 updates [#4920 @dependabot]
- bump the actions-minor-patch group across 1 directory with 2 updates [#4897 @dependabot]
- update CPE dictionary index [#4831 @anchore-oss-update-bot]
(Full Changelog)

Added Features
- Add support for linux-riscv64 [#4757 @luhenry]

Bug Fixes
- Yarn lockfile cataloguing does not handle aliases [#4833 #4836 @cyphercodes]
- Some snippet files are saved in the previous test directory [#4829 #4830 @witchcraze]
- empty rockspec causes index out of range [#4824 #4827 @aki1770-del]
- PE cataloger shows asp.net core ref assemblies using fileversion build stamp instead of productversion [#4813 #4814 @rezmoss]
- Syft safeCopy silently swallows archive decompression errors [#4806 #4807 @SAY-5]
(Full Changelog)

Added Features
- added deno bin classifiers [#4677 @rezmoss]
- Support haskell old versions [#3237 #4793 @witchcraze]
- Add support for OpenLDAP binary detection [#4768 #4755 @nadimz]
- Support erlang ols versions [#3235 #4766 @witchcraze]

Bug Fixes
- improve redhat-release parsing fallback for RHEL clones [#4808 @westonsteimel]
- fix format string in search results struct [#4775 @willmurphyscode]
- prevent infinite recursion in Document.UnmarshalJSON with encoding/json/v2 [#4748 @benja-M-1]
- Syft can not complete scanning golang image [#4686]
- javascript-package-cataloger drops entire package.json when authors/contributors/maintainers is a single string [#4778 #4779 @yoav-orca]
- pnpm lock file cataloger produces unstable output [#4648 #4765 @lawrence3699]
- Linux Kernel bzImage and zImage not cataloged by linux-kernel-cataloger [#4769 #4751 @nadimz]
- Support istio binary (pilot-discovery, pilot-agent) alpha,beta,rc,dev version [#4546 #4645 @witchcraze]
- Scanning mounted ISO: duplicate entries [#4759]

Additional Changes
- update CPE dictionary index [#4767 @anchore-oss-update-bot]
(Full Changelog)

Bug Fixes
- Similar Packages Should Be Aggregated [#1162]
- Support arangodb binary recent version [#4571 #4662 @witchcraze]
- Support go binary various versions [#4687 #4694 @kzantow]

Additional Changes
- update CPE dictionary index [#4745 @anchore-oss-update-bot]
- update CPE dictionary index [#4726 @anchore-oss-update-bot]
- Add a trust boundary section [#4716 @joshbressers]
(Full Changelog)

Bug Fixes
- Missing secondary evidence for .NET dependency in ghcr.io/open-telemetry/demo:2.0.0-accounting image [#4652]

Additional Changes
- bump github.com/buger/jsonsparser to v1.1.2 [#4680 @willmurphyscode]
- centralize temp files and prefer streaming IO [#4668 @willmurphyscode]

(Full Changelog)

Bug Fixes
- [BUG] Incorrect Maven PURL generation: Automatic-Module-Name should not be used as Maven groupId [#4611 #4642 @xnox]
- Checksum is 0 for spdx files [#2307 #4620 @ppalucha]
- Support grafana binary various versions [#4559 #4635 @witchcraze]
Additional Changes
- migrate fixtures to testdata [#4651 @wagoodman]
(Full Changelog)

Bug Fixes
- Use redhat as namespace for hummingbird rpms [#4615 @scoheb]
- False Positive: Emacs snap package version CVE-2024-39331 [#4485]
Additional Changes
- call cleanup on tmpfile and replace some io.ReadAlls with streams [#4629 @willmurphyscode]
- bumps go mod version to 1.25; ci takes latest patch [#4628 @spiffcs]
(Full Changelog)

Added Features
- Add support for scanning GGUF models from OCI registries [#4335 @spiffcs]
- yarn lockfile scan doesnt catch dev dependencies [#4548 #4549 @rezmoss]
Additional Changes
- CPE detection for APK libavif to use aomedia vendor [#4597 @naag]
(Full Changelog)

Bug Fixes
- further improve go binary classifier, including windows [#4593 @kzantow]
- Wrong format in license [#4233 #4588 @spiffcs]
- Cannot detect installation of Qt6 [#4467 #4550 @rezmoss]
- bug: Syft mis-identifies binary as deb inside a snap [#4486 #4500 @popey]
(Full Changelog)

Bug Fixes
- [Bug Report] Missing some dependencies on cyclonedx formatted SBOM using syft [#4562 #4573 @spiffcs]
(Full Changelog)

Added Features
- detect Debian version from /etc/debian_version [#4569 @kzantow]
Bug Fixes
- correctly report supporting evidence for binary packages [#4558 @kzantow]
(Full Changelog)

Important
This release bumps github.com/containerd/containerd to v2, which will cause compiler errors if used alongside other dependencies that use v1 of containerd. See anchore/stereoscope#495 for a detailed discussion.
Bug Fixes
- mongodb binary not detected manual/source install [#4540 #4541 @rezmoss]
(Full Changelog)

Added Features
- Exclude development or test dependencies for PNPM Package type [#4430 #4487 @rezmoss]
- Catalog istio binary (pilot-discovery, pilot-agent) [#4508 #4521 @witchcraze]
- Catalog envoy binary [#4506 #4530 @witchcraze]
- Catalog grafana binary [#4505 #4516 @witchcraze]
- Add a binary classifier for valkey [#3400 #4509 @witchcraze]
Bug Fixes
- old bitnami images without spdx files arent getting picked up correctly in the catalog [#4529 #4532 @rezmoss]
- wrong traefik rc versions at binary detection [#3535 #4499 @rezmoss]
- FromPOSIX() in internals\windows\path.go assumes that all Windows root paths must have a colon terminator [#4070 #4075 @luissantosHCIT]
- binary cataloger is picking up the go version instead of the actual binary version in traefik experimental images [#4498 #4499 @rezmoss]
(Full Changelog)

Added Features
- add support for Gemfile.next.lock [#4457 @HatiCode]
- Command output to give more information on what catalogers look for and what they can find [#4155 #4317 @wagoodman]
- Support reading lzma compressed .go.buildinfo sections with upx [#4411 #4480 @wagoodman]
- Specify specific snap revision to pull [#4389 #4439 @VictorHuu]
- Cannot detect embedded deps.json metadata in single-file .NET binaries [#4344 #4375 @rezmoss]
- ELF note cataloger does not pick up OS field, but should [#4384 #4438 @VictorHuu]
Bug Fixes
- remove debug print statement in dependency parser [#4412 @cgreeno]
- dotnet-deps cataloger should skip project references with type "project" when building the sbom [#4423 #4436 @rezmoss]
- File digests not computed when using --base-path [#4410 #4478 @wagoodman]
- Syft should not define subpaths by default in PURLs [#4394 #4395 @rezmoss]
- go: valid purl but incorrect name [#1737 #4395 @rezmoss]
- Incorrect Go module PURL generation when module path contains /vN (e.g. /v5) [#4316 #4395 @rezmoss]
- Failing to convert npm repository information correctly to SPDX [#4362 #4390 @kendrickm]
(Full Changelog)

Bug Fixes
- drop cpe from gguf [#4383 @spiffcs]
- emit lua rockspec dependencies in metadata [#4376 @willmurphyscode]
- Invalid SBOMs are created when GO replace directive is used [#4415 #4419 @VictorHuu]
- Incorrect CPE for Vercel's Next js [#4443 #4450 @willmurphyscode]
- v1.38.0 generates empty sbom for tgz sources [#4416 #4421 @VictorHuu]
- Syft: The dependency graph does not include all Requires-Dist relationships defined in the package’s METADATA file [#4401 #4408 @willmurphyscode]
(Full Changelog)

Added Features
- add support for cataloging GGUF models [#4184 #4279 @spiffcs]
- Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
- Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]
Bug Fixes
- Support extras statements in Python PDM cataloger [#4352 @wagoodman]
- Preserve --from argument order [#4350 @wagoodman]
- SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
- empty PURL output in dependency snapshot format breaks sbom-action [#4311]
- Interface includes constraint elements, can only be used in type parameters [#4346]
- Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
- Upgrade to Golang 1.25.4 [#4341]
Additional Changes
- migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
- Add license enrichment from pypi to python packages [#4295 @timols]
- license file search [#4327 @kzantow]
(Full Changelog)

Added Features
- Refactor fileresolver to not require base path [#4298 @Rupikz]
- Describe cataloger capabilities via test observations [#4318 @wagoodman]
- Support Java resource adapter extension .far as a Java archive [#4183 #4193 @kyounghunJang]
- Add Java resource adapter extension ".rar" as supported Java archive [#4136 #4137 @thomassui]
Bug Fixes
- fix empty PURL Github format [#4312 @rezmoss]
- Canonicalize Ghostscript CPE/PURL for ghostscript packages from PE Binaries [#4308 @kdt523]
- Respect "rpmmod" PURL qualifier [#4314 @willmurphyscode]
- fix dpkg packages that are in deinstalled state should not be in SBOM [#3063 #4231 @rkirk-nos]
(Full Changelog)

Added Features
- Add the ability to fetch remote licenses for pnpm-lock.yaml files [#4286 @timols]
- support universal (fat) mach-o binary files [#4278 @JoeyShapiro]
- pdm support [#2709 #4234 @paulslaby]
Bug Fixes
- Remove duplicate image source providers [#4289 @Rupikz]
- syft can't extract go module information from executables on Windows [#4271 #4285 @JoeyShapiro]
(Full Changelog)

Bug Fixes
- Extract zip archive with multiple entries [#4283 @Rupikz]
- panic while resolving maven properties in archive parser [#4288 #4290 @kzantow]
(Full Changelog)

Added Features
- enhance setup.py parser to handle unquoted dependencies [#4255 @HalaAli198]
- Add support for identifying ffmpeg/libav libraries [#4227 @popey]
- PNPM latest lockfile (version 9.0) [#3927 #4256 @bernardoamc]
- Add Windows ARM64 releases [#4179 #4237 @compnerd]
Bug Fixes
- SBOM CPE mismatch for Qt5 causes Grype to miss CVE matches [#4036 #4093 @hawkaii]
- syft doesn't take advantage of the manifest files present in Snap packages when generating SBOMs [#4147 #4151 @popey]
Additional Changes
- update cosign args to not use new config functionality [#4287 @spiffcs]
- Pom xml only archive parser [#4272 @douglasclarke]
(Full Changelog)

Added Features
- Modify RpmDBEntry to include modularityLabel for cyclonedx [#4212 @sfc-gh-rmaj]
- Add locations onto packages read from Java native image SBOMs [#4186 @rudsberg]
(Full Changelog)

Added Features
- Catalog entire build list for Go projects, not just packages listed in go.mod [#432 #4127 @spiffcs]
- package.json authors keyword parsing [#2250 #4003 @popey]
- Conda ecosystem support (basic) [#4002@SimeonStoykovQC]
Bug Fixes
- When scanning the FFmpeg binary with Syft a new package is now added [#3988 #3994 @popey]
- Warn loudly if SQLite driver is not present when needed [#3234 #4150 @kzantow]
Additional Changes
- Update dependencies to use go.yaml.in/yaml [#4157 @n-bes]
(Full Changelog)

Added Features
- Option to set PackageSupplier in root of SPDX document generated by CLI [#3098 #4131 @spiffcs]
Bug Fixes
- closed reader during java binary detection [#4129 @kzantow]
- support multiple letters in openssl patch version [#4106 @honigbot]
- Can not have license ID [#1964 #4132 @spiffcs]
- Syft sometimes reports URL for license value when scanning JARs with a URL in Bundle-License field of manifest [#3186]
(Full Changelog)

Added Features
- add binary classifier for hashicorp vault [#4121 @willmurphyscode]
Bug Fixes
- fix: update nondeterministic Java archive cataloging and improve groupID [#3521 #4118 @kzantow]
(Full Changelog)

Bug Fixes
- Missing license information for tzdata [#4102]
- Improve JVM Scan Accuracy for JDK and JRE Detection [#4071 #4046 @kzantow]
- Azul JDK classified as Oracle JRE [#3893 #4046 @kzantow]
(Full Changelog)

Added Features
- Catalog python uv.lock files [#3268 #3763 @jkugler]
Additional Changes
- Pkg Metadata type unmarshal bug [#4043 @houdini91]
(Full Changelog)

Added Features
- add native support for snap packages [#1088 #3929 @wagoodman]
Additional Changes
- upgrade tablewriter dependency to use new API [#3990 @cpanato]
(Full Changelog)

Bug Fixes
- Allow decoding of enterprise-modified anchorectl json files [#3997 @wagoodman]
- Allow decoding of anchorectl json files [#3973 @wagoodman]
Additional Changes
- provide separate nonroot image [#3998 @kzantow]
(Full Changelog)

Added Features
- add syft schema version to version command [#3949 @spiffcs]
Bug Fixes
- Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#3967 @jayvdb]
- Remove CPE product candidates for opentelemetry and redis Rust crates [#3962 @jayvdb]
- Harden Container Runtime with Non-Root User [#3941 @MikeTheCyberGuy]
- terraform provider lock entries should not require constraints [#3934 @ghouscht]
- sbom cataloger returning upstream package [#3662 #3981 @kzantow]
- Syft missing md5 sums and list data for dpkg packages under status.d/ [#3912]
- Failure to detect dependency relationships between Python packages [#3958 #3965 @christoph-blessing]
- Heavy memory consumption when directory scanning deb source [#3928 #3953 @kzantow]
- In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#3942 #3944 @kzantow]
- Syft incorrectly reports multiple APKs as parents of symlinked files [#3847 #3923 @luhring]
(Full Changelog)

Bug Fixes
- Dotnet deps binary cataloger hangs [#3919 #3930 @kzantow]
(Full Changelog)

Added Features
- Read version resources from non-.NET DLLs and executables [#3842 #3911 @wagoodman]
Bug Fixes
- pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#3922 @wagoodman]
- syft 1.24.0 debug container - wget fails TLS [#3891 #3915 @spiffcs]
(Full Changelog)

Additional Changes
- remove go-rpmdb replace directive [#3908 @wagoodman]
(Full Changelog)

Added Features
- Add cataloger for Dart pubspec [#3292 @LaurentGoderre]
- Translate Portage license strings to SPDX expressions [#1763 @wagoodman]
- Use package ID from decoded SBOMs when provided [#1872 @jneate]
- Annotate visible/hidden paths when all-layers scope [#3855 @wagoodman]
- Add support for PHP Pear [#2775 @LaurentGoderre]
- Detect whether full license text or a license name has been provided [#3088 #3876 @spiffcs #3450 @spiffcs]
- Add Cataloger for Homebrew on macOS [#3632 #3724 @rezmoss]
- Provide a way to get the LayerID the package was first found in [#435 #3858 @wagoodman #3138 @tomersein]
- Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#3324 #3873 @wagoodman]
- Upgrade base Docker image to gcr.io/distroless/static-debian12 [#3840 #3862 @bgoareguer]
- Return full license string instead of SHA256 hash when license string exceeds 64 characters [#3780 #3844 @spiffcs]
- Detect nix dependencies [#3814 #3837 @wagoodman]
Bug Fixes
- update license sort to be stable with contents field [#3860 @spiffcs]
- Improve detection of erlang binary in alpine Linux [#3839 @avodotiiets]
- Do not search for main module versions within binary contents by default [#3874 @wagoodman]
- dpkg license improvement for non SPDX licenses [#3090 #3888 @spiffcs]
- CycloneDX group field not symmetrically handled by encoder/decoders [#2981 #3853 @kzantow]
- Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#3872 #3875 @wagoodman]
- Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#3864]
- .NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#3866 #3869 @wagoodman]
- Propagate error in FileSourceProvider instead of warn log [#3831 #3845 @Rupikz]
- Update github.com/Masterminds/semver package [#3829 #3836 @popey]
- go-module-file-cataloger fails if symlinks in path [#3614 #3783 @VictorHuu]
- Support fluent-bit some versions of arm/s390x images [#3793 #3817 @VictorHuu]
Additional Changes
- update rust test fixtures to latest [#3852 @spiffcs]
(Full Changelog)

Additional Changes
- Resolve owned file paths when searching for overlaps [#3828 @wagoodman]
(Full Changelog)

Added Features
- Support skipping archive extraction with file source [#3795 @adammcclenaghan]
- Use the R cataloger in directory scans [#3774 @spiffcs]
- Add support for detecting javascript assets in .NET projects using libman [#3825 @wagoodman]
- Parse GitHub actions comments [#3776 @wagoodman]
- Support chrome binary detection [#3174 #3136 @lem-onade]
- Add support for detecting undeclared license files scanning from python installations [#2624 #3779 @wagoodman]
Bug Fixes
- .NET cataloger should consider compile target paths from deps.json [#3821 @wagoodman]
- Skip license scanner injection [#3796 @adammcclenaghan]
- Delete collection name/type key entries when empty [#3797 @adammcclenaghan]
- Use module name over relative paths in go.mod replace directives [#3812 @VictorHuu]
- Correct variable names for Conan lock parsing version handling [#3802 @musangk]
- Consider DLL claims for dependencies of .NET packages from deps.json [#3822 @wagoodman]
- Empty source during decoding an SBOM document should not be fatal [#3791 @wagoodman]
- Dpkg are not detected when scanning a directory [#3726 #3820 @VictorHuu]
- Support golang tip image [#3681 #3757 @VictorHuu]
- syft cataloger list should flatten options [#3801 #3804 @kzantow]
- Unable to generate a correct SBOM for C++ project [#3755]
(Full Changelog)

Added Features
- Improve .NET package CPE generation [#3764 @wagoodman]
- Catalog deb archives directly [#3315 #3704 @popey]
Bug Fixes
- Dotnet-Portable-Executable-Cataloger uses wrong component version for dotnet runtime libraries [#3282 #3768 @wagoodman]
- Dotnet deps cataloger returns "wrong" dotnet-framework dependencies and misses out on the runtime (for applications) [#2347 #3768 @wagoodman]
- .NET deps.json should be considered as installation evidence [#3570 #3563 @wagoodman]
- Dotnet PE binary cataloger is detecting false positives [#3469 #3563 @wagoodman]
- Long Processing Time in dpkg-db-cataloger with all-layers Option (Syft 1.20.0) [#3683 #3636 @kzantow]
(Full Changelog)

Added Features
- Support extracting symbols in .dynsym section for GraalVM Native Images [#3647 @rudsberg]
- Support fluent-bit 1.7.0 dev, rc [#3133 #3701 @popey]
Bug Fixes
- Suppress "file already closed" errors [#3695 @wagoodman]
- Add set ID to dotnet (lock) packages [#3719 @houdini91]
- Location order on packages should consider evidence annotations when sorting [#3720 @wagoodman]
- Fix /etc/redhat-release file parsing when resolving distro details [#3688 @wagoodman]
- Syft fileresolver.containsPath allocates unnecessarily [#3729 #3730 @yoav-orca]
- Dart: Syft incorrectly generates SBOM with version 0.0.0 for SDK dependencies [#3158 #3572 @sgreg]
- Download location is not a valid URI [#3696 #3697 @stgrace]
Additional Changes
- Update rustaudit module name [#3689 @tofay]
- bump golang.org/x/net from 0.35.0 to 0.36.0 [#3709 @dependabot]
(Full Changelog)

Added Features
- Add file catalogers to selection configuration [#3505 @wagoodman]
- Configuration for including license contents in SBOM [#3626 #3631 @spiffcs]
- Support Bitnami embedded SBOMs [#3065 #3341 @juan131]
Bug Fixes
- Version parse caused by line breaks on different platforms [#3672 @idhyt]
- find bitnami files even when no relationships [#3676 @willmurphyscode]
- License files which do not match an SPDX expression are erroneously handled as 'unlicensed' [#3412 #3366 @HeyeOpenSource]
- Incorrect URL encoding of package url (purl) [#3533 #3678 @kzantow]
- syft should not warn on known bad package.json [#3470 #3645 @kzantow]
- Scanning a project with many DLLs is slow [#3455 #3677 @rogueai]
- cyclone-dx presenter drops files, includes only packages [#3435 #3539 @spiffcs]
- "syft config" output swaps comments for search-indexed-archives / search-unindexed-archives [#3624 #3630 @spiffcs]
- dpkg license improvement for non SPDX licenses [#3090 #3366 @HeyeOpenSource]
- RPM-based PURLs sometimes have incorrect namespace (specifically OpenSUSE) [#3534 #3615 @mprpic]
Additional Changes
- update to go 1.24.x [#3660 @westonsteimel]
- replace all shorthand tags of mapstruct -> mapstructure [#3633 @spiffcs]
(Full Changelog)

Added Features
- add license parsing from vendor dirs [#3522 @dschmidt]
- Support cataloging NuGet packages [#373 #3484 @Kemosabert]
Bug Fixes
- Syft generates invalid PURLs when name contains : [#3577 #3596 @spiffcs @jkugler]
- warn instead of error if zero package catalogers are select - user might still run file metadata cataloger, for example [#3128 #3468 @tomersein]
- sbom report: missing licenses [#3527 #3549 @kzantow]
Additional Changes
- bump stereoscope to v0.0.13 [#3601 @spiffcs]
(Full Changelog)

Bug Fixes
- Runtime Error with Syft on Singularity .sif file (panic: index out of range) [#3390]
- SPDX expressions are lost from CycloneDX if they contain extra parenthesis [#3441 #3517 @willmurphyscode]
Additional Changes
- migrate syft to use anchore fork of archiver without replace [#3516 @spiffcs]
(Full Changelog)

Added Features
- Surface Rust dependency relationships [#2353 #3443 @willmurphyscode]
- Support node 6.x versions [#3404 #3419 @witchcraze]
Bug Fixes
- Restore log on UI teardown [#3427 @wagoodman]
- Syft should log warnings even when no TTY is present [#3081 #3466 @willmurphyscode]
- Special characters (tab, newline) in license URL [#3122 #3449 @spiffcs]
- LicenseDeclared not as per SPDX License List [#3030 #3461 @spiffcs]
Additional Changes
- doc: Add official Syft logo license information [#3421 @popey]
(Full Changelog)

Added Features
- omit devDependencies for package-lock.json files by default [#2348 #3371 @njv299]

Bug Fixes
- add support for dependencies and purl for Native Image SBOMs [#3399 @rudsberg]
- stop bubbling fileResolver errors from binary cataloger [#3410 @spiffcs]
- malformed pom.xml may cause recursive loop [#3391 @kzantow]
- syft convert: broken link in help - documentation no longer existing [#3143 #3407 @Makefolder]
(Full Changelog)