github.com/anchore/syft

Added Features

• emit dependency relationships from mix.lock [PR #4985 @cgreeno]
• add safe tensor model type to SBOM output [PR #4844 @spiffcs]
• Capture golang binary symbols [PR #4988 @spiffcs]
• Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman]
• Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404]
• Support for vcpkg [Issue #2110] [PR #4081 @gabetrau]
• Add macOS .app cataloger [Issue #4010] [PR #4490 @rezmoss]
• Add support for Kerberos 5 library cataloging [Issue #4780] [PR #4781 @nadimz]
• Include date of scan in results [Issue #3910]

Bug Fixes

• use printf instead of echo to fix ANSI color output [PR #4978 @Jouini-Mohamed-Chaker]
• Strip peer-dep suffix from deno.lock npm keys [PR #5055 @Synvoya]
• Allow more PEP440-compliant characters in python versions [PR #4964 @kzantow]
• PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #4996 @activeobd]
• Fix panic parsing a rockspec comment that ends at EOF [PR #5053 @arpitjain099]
• Fix Debian point release detection [PR #4997 @OsamaSE]
• Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #5041 @Synvoya]
• npm redis client generates no CPE [Issue #5011] [PR #5012 @rezmoss]
• Debug Docker images are running as nonroot user [Issue #4113] [PR #4608 @spiffcs]
• libxml2 gets the wrong cpe vendor [Issue #5015] [PR #5016 @rezmoss]
• wrong purl for spring-ldap-core dependency [Issue #4030] [PR #4908 @jonasboos]
• Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #3961] [PR #4785 @SAY-5]
• conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #5017] [PR #5020 @jfjrh2014]
• dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #4514] [PR #4517 @rezmoss]
• Go template sprig date functions not defined [Issue #2372] [PR #4644 @sputnik-mac]
• CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #4720] [PR #4782 @SAY-5]

Dependencies

9 dependency changes (8 updated, 1 added).

Updated (8 packages)

• github.com/bmatcuk/doublestar v1.3.1 → v8.8.8
• github.com/klauspost/compress v1.18.6 → v1.19.0
• golang.org/x/tools v0.46.0 → v0.47.0
• modernc.org/cc/v4 v4.28.2 → v4.28.4
• modernc.org/ccgo/v4 v4.34.0 → v4.34.4
• modernc.org/gc/v3 v3.1.2 → v3.1.3
• modernc.org/libc v1.72.3 → v1.73.4
• modernc.org/sqlite v1.51.0 → v1.53.0

Added (1 package)

• howett.net/plist v1.0.1

(Full Changelog)

Added Features

• Add purl types to cataloger info cmd [PR #4984 @wagoodman]
• Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu]
• Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss]
• SPDX 3 Support [Issue #4250] [PR #4269 @kzantow]
• Add Deno support [Issue #4417] [PR #4523 @rezmoss]
• Catalog Elastic Beats binary [Issue #4961] [PR #4969 @rezmoss]
• Add binary classifiers for Elastic Beats [Issue #4972] [PR #4969 @rezmoss]
• Catalog elastic-agent binary [Issue #4962]
• Add support for Bun lockfile (bun.lock) [Issue #4617] [PR #4625 @hnnynh]
• Add .bpl file support to the PE / DLL cataloger [Issue #4664] [PR #4954 @jfjrh2014]

Bug Fixes

• respect arch qualifier [PR #4987 @willmurphyscode]
• Preserve dependency edges when a compliance stub changes a package ID [PR #4993 @wagoodman]
• Support envoy binary various versions [Issue #4590] [PR #4605 @rezmoss]
• .net deps.json cataloger shows phantom pkgs for reference assembly library entries [Issue #4970] [PR #4971 @rezmoss]
• Syft does not extract package licenses from opkg manager [Issue #4940] [PR #4963 @Dashtid]
• squashfs breaks with godisk-fs 1.8.0 [Issue #4718]
• requirements.txt cataloger silently drops PEP 440 local version identifiers, producing incorrect PURL [Issue #4958] [PR #4959 @kzantow]

Dependencies

34 dependency changes (31 updated, 3 added). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
• GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
• GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
• GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
• GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

Updated (31 packages)

• github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
• github.com/anchore/bubbly v0.2.0 → v0.2.1
• github.com/anchore/clio v0.1.0 → v0.1.1
• github.com/anchore/fangs v0.1.0 → v0.1.1
• github.com/anchore/go-collections v0.1.0 → v0.1.1
• github.com/anchore/go-homedir v0.1.0 → v0.1.1
• github.com/anchore/go-logger v0.1.0 → v0.1.1
• github.com/anchore/go-lzo v0.1.0 → v0.1.1
• github.com/anchore/go-macholibre v0.1.0 → v0.1.1
• github.com/anchore/go-make v0.5.0 → v0.8.0
• github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
• github.com/anchore/go-sync v0.1.0 → v0.1.1
• github.com/anchore/stereoscope v0.2.1 → v0.2.2
• github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
• github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
• github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
• github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
• github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
• github.com/google/go-containerregistry v0.21.6 → v0.21.7
• github.com/jedib0t/go-pretty/v6 v6.7.10 → v6.8.1
• github.com/mattn/go-runewidth v0.0.19 → v0.0.21
• github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
• github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
• golang.org/x/crypto v0.52.0 → v0.53.0
• golang.org/x/mod v0.36.0 → v0.37.0
• golang.org/x/net v0.55.0 → v0.56.0
• golang.org/x/sync v0.20.0 → v0.21.0
• golang.org/x/sys v0.45.0 → v0.46.0
• golang.org/x/term v0.43.0 → v0.44.0
• golang.org/x/text v0.37.0 → v0.38.0
• golang.org/x/tools v0.45.0 → v0.46.0

Added (3 packages)

• github.com/piprate/json-gold v0.7.0
• github.com/pquerna/cachecontrol v0.0.0-1555304
• github.com/tailscale/hujson v0.0.0-ecc657c

(Full Changelog)

Bug Fixes

• bump stereoscope to pull in fix for registry client hanging [#4934 @anchore-oss-update-bot]

(Full Changelog)

Added Features

• Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke]
• MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
• Catalog ingress-nginx binary [#4818 #4857 @witchcraze]

Bug Fixes

• Support helm binary various versions [#4820 #4922 @witchcraze]
• Support julia binary various versions [#4867 #4945 @witchcraze]
• Support deno binary old versions [#4865 #4939 @witchcraze]
• Compressed kernel modules are not scanned by the linux-kernel-cataloger [#4721 #4740 @will-bates11]
• Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#4691 #4838 @calumleslie]
• Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882 @witchcraze]
• Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
• Exclude path ending with a slash are discarded [#4839 #4892 @ChrisJr404]
• Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
• fix parsing of debian/copyright files [#4708 #4754 @Bahtya]
• Grype ignores python requirements in arbitrary equality (===) format [#4834 #4835 @cyphercodes]
• valkey is detected as both of valkey and redis [#4591 #4619 @witchcraze]
• TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#4837 #4848 @ChrisJr404]

Additional Changes

• hoist name normalization regexp to package level [#4926 @matiasinsaurralde]
• bump the actions-minor-patch group across 1 directory with 6 updates [#4946 @dependabot]
• bump the actions-minor-patch group across 2 directories with 2 updates [#4936 @dependabot]
• bump the actions-minor-patch group across 1 directory with 4 updates [#4927 @dependabot]
• bump the actions-minor-patch group across 1 directory with 2 updates [#4920 @dependabot]
• bump the actions-minor-patch group across 1 directory with 2 updates [#4897 @dependabot]
• update CPE dictionary index [#4831 @anchore-oss-update-bot]

(Full Changelog)