github.com/anchore/syft
v1.51.0
anchore/syft
What this package is like to depend on
Last release 2 days ago
21 Aug 2026
Ships on a steady schedule
a new release about every 8 days
Rarely documented
notes for 9 of 262 stable releases
3 versions withdrawn
withdrawn after publishing
6 years old
1152 releases · first in 2020
228 releases in the last 12 months
see the full history below
Release timeline
1152 releases · Jul 2020 to Aug 2026
2021
2022
2023
2024
2025
2026
Releases
latest 60 of 1152-
v1.51.1-0.20260821213647-bf82010f3c3821 Aug 2026 pre-releaseNothing published for this version
-
v1.51.1-0.20260820201741-39c9c690df9020 Aug 2026 pre-releaseNothing published for this version
-
v1.51.1-0.20260819181515-5c6cf08a8c8219 Aug 2026 pre-releaseNothing published for this version
-
v1.51.1-0.20260819141110-ab508169e6d319 Aug 2026 pre-releaseNothing published for this version
-
v1.51.1-0.20260818154400-360dbc04aa2018 Aug 2026 pre-releaseNothing published for this version
-
v1.51.1-0.20260814200858-58a033f9240914 Aug 2026 pre-releaseNothing published for this version
-
v1.51.010 Aug 2026Release notes
Open source →Added Features
- detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel]
- add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman]
Bug Fixes
- Cleanup snap temporary directories [PR #5117 @spiffcs]
- add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel]
- javascript-package-cataloger creates phantom
<name>@unknownpackages for subpath or export-map stub package.json files [Issue #5118] - Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #4598] [PR #5146 @ankit090701]
- When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #5019] [PR #5029 @wagoodman]
- Support deno binary latest and some old versions [Issue #5057] [PR #5084 @ychampion]
- Update install methods in README.md [Issue #3198]
Dependencies
9 dependency changes (9 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
- GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5
- github.com/diskfs/go-diskfs
v1.9.3→v1.9.4 - github.com/go-git/go-billy/v5
v5.9.0→v5.9.1 - github.com/go-git/go-git/v5
v5.19.1→v5.19.2(🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j) - github.com/jedib0t/go-pretty/v6
v6.8.1→v6.8.3 - github.com/klauspost/compress
v1.19.0→v1.19.1 - github.com/magiconair/properties
v1.8.10→v1.18.11 - github.com/ulikunitz/xz
v0.5.15→v0.5.16 - go.yaml.in/yaml/v3
v3.0.4→v3.0.5 - modernc.org/sqlite
v1.54.0→v1.55.0
-
v1.50.1-0.20260807143814-949ac703694907 Aug 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260805140017-68da404bd7c805 Aug 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260804144635-35bf33bcf05504 Aug 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260803172036-7f73d6a6038a03 Aug 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260731135021-ef40eec38d0331 Jul 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260730105936-dd639c09b28530 Jul 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260729185020-31a352d0305029 Jul 2026 pre-releaseNothing published for this version
-
v1.50.1-0.20260729175043-08e913a2cec329 Jul 2026 pre-releaseNothing published for this version
-
v1.50.027 Jul 2026Release notes
Open source →Added Features
Bug Fixes
- Fix Cargo PURLs for local workspace packages [PR #5105 @3nesdeniz]
- Decode golang symbols [PR #5089 @wagoodman]
- CPE vendor field incorrectly includes publisher URL for SUSE RPM packages [Issue #5073] [PR #5081 @Eljees]
- apk-db-cataloger silently drops the entire APK catalog when one installed-DB field exceeds 64 KB [Issue #5094] [PR #5100 @cyphercodes]
Additional Changes
- package-lock.json v1: nested dependencies entries are never cataloged (flat top-level iteration only) [Issue #5101] [PR #5108 @Eljees]
- consider vendored golang packages in module attribution [PR #5093 @kzantow]
- Fix inverted bounds check dropping every Erlang string with a backslash [PR #5110 @arpitjain099]
Dependencies
14 dependency changes (14 updated). 1 vulnerability remediated.
🟢 Remediated (1)
- GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
v1.31.0→v1.32.0 - github.com/cncf/xds/go
v0.0.0-ee656c7→v0.0.0-dba9d58 - github.com/envoyproxy/go-control-plane/envoy
v1.36.0→v1.37.0 - github.com/envoyproxy/protoc-gen-validate
v1.3.0→v1.3.3 - github.com/gpustack/gguf-parser-go
v0.24.1→v0.25.0 - go.opentelemetry.io/contrib/detectors/gcp
v1.39.0→v1.43.0 - google.golang.org/genproto/googleapis/api
v0.0.0-9d38bb4→v0.0.0-afd174a - google.golang.org/genproto/googleapis/rpc
v0.0.0-6f92a3b→v0.0.0-afd174a - google.golang.org/grpc
v1.80.0→v1.82.1(🟢 remediated GHSA-hrxh-6v49-42gf) - modernc.org/cc/v4
v4.28.4→v4.29.0 - modernc.org/ccgo/v4
v4.34.4→v4.34.6 - modernc.org/gc/v3
v3.1.3→v3.1.4 - modernc.org/libc
v1.73.4→v1.74.1 - modernc.org/sqlite
v1.53.0→v1.54.0
-
v1.49.1-0.20260727192049-16223e6dd78927 Jul 2026 pre-releaseNothing published for this version
-
v1.49.1-0.20260727145013-86baeeb481ce27 Jul 2026 pre-releaseNothing published for this version
-
v1.49.1-0.20260724134824-9af0098a684724 Jul 2026 pre-releaseNothing published for this version
-
v1.49.1-0.20260723190336-c890e7f17f8d23 Jul 2026 pre-releaseNothing published for this version
-
v1.49.020 Jul 2026Release notes
Open source →Added Features
- Support for
application/vnd.oci.image.index.v1+jsonmanifests in root OCI layout [Issue #1545] [PR #5074 @jasonpaulos]
Bug Fixes
- Misinterpretation of Multiple replace Directives in Golang [Issue #2721] [PR #5069 @ychampion]
Dependencies
16 dependency changes (16 updated).
Updated (16 packages)- github.com/anchore/go-rpmdb
v0.1.0→v0.2.0 - github.com/anchore/stereoscope
v0.2.2→v0.3.0 - github.com/containerd/containerd/v2
v2.3.2→v2.3.3 - github.com/docker/cli
v29.5.3+incompatible→v29.6.1+incompatible - github.com/gkampitakis/go-snaps
v0.5.22→v0.5.23 - github.com/moby/moby/api
v1.54.2→v1.55.0 - github.com/moby/moby/client
v0.4.1→v0.5.0 - github.com/pelletier/go-toml/v2
v2.3.1→v2.4.3 - golang.org/x/crypto
v0.53.0→v0.54.0 - golang.org/x/mod
v0.37.0→v0.38.0 - golang.org/x/net
v0.56.0→v0.57.0 - golang.org/x/sync
v0.21.0→v0.22.0 - golang.org/x/sys
v0.46.0→v0.47.0 - golang.org/x/term
v0.44.0→v0.45.0 - golang.org/x/text
v0.38.0→v0.40.0 - golang.org/x/tools
v0.47.0→v0.48.0
- Support for
-
v1.48.1-0.20260720180457-29fd7d0dec8120 Jul 2026 pre-releaseNothing published for this version
-
v1.48.1-0.20260717135225-ae9534203d4a17 Jul 2026 pre-releaseNothing published for this version
-
v1.48.016 Jul 2026Release notes
Open source →Added Features
- emit dependency relationships from mix.lock [PR #4985 @cgreeno]
- add safe tensor model type to SBOM output [PR #4844 @spiffcs]
- Capture golang binary symbols [PR #4988 @spiffcs]
- Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman]
- Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404]
- Support for
vcpkg[Issue #2110] [PR #4081 @gabetrau] - Add macOS
.appcataloger [Issue #4010] [PR #4490 @rezmoss] - Add support for Kerberos 5 library cataloging [Issue #4780] [PR #4781 @nadimz]
- Include date of scan in results [Issue #3910]
Bug Fixes
- use printf instead of echo to fix ANSI color output [PR #4978 @Jouini-Mohamed-Chaker]
- Strip peer-dep suffix from deno.lock npm keys [PR #5055 @Synvoya]
- Allow more PEP440-compliant characters in python versions [PR #4964 @kzantow]
- PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #4996 @activeobd]
- Fix panic parsing a rockspec comment that ends at EOF [PR #5053 @arpitjain099]
- Fix Debian point release detection [PR #4997 @OsamaSE]
- Fix
mix.lockgit/path deps mislabeled as hex.pm packages with bogus PURLs [PR #5041 @Synvoya] - npm redis client generates no CPE [Issue #5011] [PR #5012 @rezmoss]
- Debug Docker images are running as nonroot user [Issue #4113] [PR #4608 @spiffcs]
- libxml2 gets the wrong cpe vendor [Issue #5015] [PR #5016 @rezmoss]
- wrong purl for spring-ldap-core dependency [Issue #4030] [PR #4908 @jonasboos]
- Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #3961] [PR #4785 @SAY-5]
- conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #5017] [PR #5020 @jfjrh2014]
- dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #4514] [PR #4517 @rezmoss]
- Go template sprig date functions not defined [Issue #2372] [PR #4644 @sputnik-mac]
- CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #4720] [PR #4782 @SAY-5]
Dependencies
9 dependency changes (8 updated, 1 added).
Updated (8 packages)- github.com/bmatcuk/doublestar
v1.3.1→v8.8.8 - github.com/klauspost/compress
v1.18.6→v1.19.0 - golang.org/x/tools
v0.46.0→v0.47.0 - modernc.org/cc/v4
v4.28.2→v4.28.4 - modernc.org/ccgo/v4
v4.34.0→v4.34.4 - modernc.org/gc/v3
v3.1.2→v3.1.3 - modernc.org/libc
v1.72.3→v1.73.4 - modernc.org/sqlite
v1.51.0→v1.53.0
- howett.net/plist
v1.0.1
-
v1.47.016 Jul 2026Nothing published for this version
-
v1.46.1-0.20260716020958-5e11775c8b7616 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260714124953-2805655ab04614 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713204334-552ddbfadb4813 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713204016-f6b5d3e736b813 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713173704-2a319babba8613 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713170820-80c3189b0e3013 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713151501-da77ea388a0113 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713143023-1dcac54b0e1013 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260713140126-0734b95ce40313 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260710133142-c4a0b6f6470e10 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260708165513-e8abab2e775f08 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260707141115-002a326c41e907 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260706151837-3e399256b3dc06 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260703134248-6f5c83a5585303 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260702183437-ba661e83a7e502 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260701131133-656a4d46d74101 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260701033749-a1831ce3b49901 Jul 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260630143257-148fe572bcd630 Jun 2026 pre-releaseNothing published for this version
-
v1.46.1-0.20260629192347-deee79411a1e29 Jun 2026 pre-releaseNothing published for this version
-
v1.46.025 Jun 2026Release notes
Open source →Added Features
- Add purl types to cataloger info cmd [PR #4984 @wagoodman]
- Python cataloger misses uv PEP 723 script lockfiles (
*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu] - Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss]
- SPDX 3 Support [Issue #4250] [PR #4269 @kzantow]
- Add Deno support [Issue #4417] [PR #4523 @rezmoss]
- Catalog Elastic Beats binary [Issue #4961] [PR #4969 @rezmoss]
- Add binary classifiers for Elastic Beats [Issue #4972] [PR #4969 @rezmoss]
- Catalog elastic-agent binary [Issue #4962]
- Add support for Bun lockfile (bun.lock) [Issue #4617] [PR #4625 @hnnynh]
- Add .bpl file support to the PE / DLL cataloger [Issue #4664] [PR #4954 @jfjrh2014]
Bug Fixes
- respect arch qualifier [PR #4987 @willmurphyscode]
- Preserve dependency edges when a compliance stub changes a package ID [PR #4993 @wagoodman]
- Support envoy binary various versions [Issue #4590] [PR #4605 @rezmoss]
- .net deps.json cataloger shows phantom pkgs for reference assembly library entries [Issue #4970] [PR #4971 @rezmoss]
- Syft does not extract package licenses from opkg manager [Issue #4940] [PR #4963 @Dashtid]
- squashfs breaks with godisk-fs 1.8.0 [Issue #4718]
- requirements.txt cataloger silently drops PEP 440 local version identifiers, producing incorrect PURL [Issue #4958] [PR #4959 @kzantow]
Dependencies
34 dependency changes (31 updated, 3 added). 5 vulnerabilities remediated.
🟢 Remediated (5)
- GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
- GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
- GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
- GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
- GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2
- github.com/ProtonMail/go-crypto
v1.4.0→v1.4.1 - github.com/anchore/bubbly
v0.2.0→v0.2.1 - github.com/anchore/clio
v0.1.0→v0.1.1 - github.com/anchore/fangs
v0.1.0→v0.1.1 - github.com/anchore/go-collections
v0.1.0→v0.1.1 - github.com/anchore/go-homedir
v0.1.0→v0.1.1 - github.com/anchore/go-logger
v0.1.0→v0.1.1 - github.com/anchore/go-lzo
v0.1.0→v0.1.1 - github.com/anchore/go-macholibre
v0.1.0→v0.1.1 - github.com/anchore/go-make
v0.5.0→v0.8.0 - github.com/anchore/go-struct-converter
v0.1.0→v0.2.0-rc2 - github.com/anchore/go-sync
v0.1.0→v0.1.1 - github.com/anchore/stereoscope
v0.2.1→v0.2.2 - github.com/charmbracelet/colorprofile
v0.4.1→v0.4.3 - github.com/clipperhouse/displaywidth
v0.10.0→v0.11.0 - github.com/clipperhouse/uax29/v2
v2.6.0→v2.7.0 - github.com/containerd/containerd/v2
v2.3.1→v2.3.2(🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp) - github.com/docker/cli
v29.4.3+incompatible→v29.5.3+incompatible - github.com/google/go-containerregistry
v0.21.6→v0.21.7 - github.com/jedib0t/go-pretty/v6
v6.7.10→v6.8.1 - github.com/mattn/go-runewidth
v0.0.19→v0.0.21 - github.com/spdx/tools-golang
v0.5.7→v0.6.0-rc4 - github.com/sylabs/sif/v2
v2.24.0→v2.24.1 - golang.org/x/crypto
v0.52.0→v0.53.0 - golang.org/x/mod
v0.36.0→v0.37.0 - golang.org/x/net
v0.55.0→v0.56.0 - golang.org/x/sync
v0.20.0→v0.21.0 - golang.org/x/sys
v0.45.0→v0.46.0 - golang.org/x/term
v0.43.0→v0.44.0 - golang.org/x/text
v0.37.0→v0.38.0 - golang.org/x/tools
v0.45.0→v0.46.0
- github.com/piprate/json-gold
v0.7.0 - github.com/pquerna/cachecontrol
v0.0.0-1555304 - github.com/tailscale/hujson
v0.0.0-ecc657c
-
v1.45.2-0.20260625192614-b15c5dbfe2bb25 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260624152216-abf6d78dfcab24 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260623192346-fe42bcec38f423 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260622185024-5eefd73ac7e022 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260622171633-1f4f9332c55822 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260619115105-b71afc87fcdd19 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260618235030-efe3174b5fc418 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260617152907-58e4dbbf016b17 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260616161334-951fbd454abd16 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260615201532-cff5a05681af15 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260615153402-00ca43d24aef15 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260612132923-6a276780365212 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260611134042-89773c0a126911 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260609172243-b08d3c29700009 Jun 2026 pre-releaseNothing published for this version
-
v1.45.2-0.20260608151247-63232bf7255e08 Jun 2026 pre-releaseNothing published for this version