syft

No entries match these filters. Clear filters

1. v1.55.0 Oct 19, 2026 · issue 114
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.55.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.55.0

   • New supported platform IPK package scanning
2. v1.54.0 Oct 1, 2026 · issue 092

   syft v1.54.0 adds a Perl ecosystem cataloger, reports the Perl interpreter as a CPANCPANThe Comprehensive Perl Archive Network, a public repository of reusable Perl modules maintained by the Perl community, giving cyber tools instant access to thousands of tested libraries without reinventing common functionality. package, and supports non-daemon Podman analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.54.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.54.0

   • Adds a new package cataloger for the Perl ecosystem (CPAN), enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for Perl projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Reports the Perl interpreter itself as a CPAN package in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
   • Supports scanning container images via non-daemon Podman (daemonless mode).
   • Adds a new package cataloger for the Perl ecosystem (CPAN), enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for Perl projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports scanning container images via non-daemon Podman (daemonless mode).

   1 more in Everything

3. v1.52.0 Sep 17, 2026 · issue 078

   Syft v1.52.0 adds passthrough-exact-format to copy matching syft-json input to output unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.52.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.52.0

4. v1.51.0 Aug 10, 2026 · issue 042

   Syft v1.51.0 adds native Go FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. 140 mode detection in binaries and extended stdlib scope for symbol capture.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.51.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.51.0

   • Detects native Go FIPS 140 mode in scanned binaries, surfacing FIPS compliance status in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
   • Adds extended-stdlib scope and expanded module patterns for symbol capture, improving Go binary analysis coverage.

   2 details in Everything

5. v1.50.0 Jul 28, 2026 · issue 029

   Syft v1.50.0 adds a Bun binary classifier for detecting the Bun JavaScript runtime in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.50.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.50.0

6. v1.49.0 Jul 21, 2026 · issue 021

   Syft v1.49.0 adds support for OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image index manifests in root OCI layouts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.49.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.49.0

   • Supports application/vnd.oci.image.index.v1+json manifests in root OCI layout directories, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation from multi-platform OCI index artifacts.

   1 detail in Everything

7. v1.48.0 Jul 16, 2026 · issue 017

   Syft v1.48.0 adds vcpkg, macOS .app, KerberosKerberosA network authentication protocol that uses tickets issued by a trusted service. Users and services can prove their identities without sending a password to each application. 5, SafeTensor, and Ubuntu Pro/ESM cataloging plus Go binary symbol capture.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.48.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.48.0

   • Adds dependency relationship edges from mix.lock to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output.
   • Adds SafeTensor model type cataloging to SBOM output for ML model inventories.
   • Captures symbols from Go binaries for richer binary-level SBOM data.
   • Detects Ubuntu Pro/ESM extended support status on scanned systems.
   • Adds a scan duration timer to Syft output.

   +4 more show less

   • Adds support for vcpkg C/C++ package manager cataloging.
   • Adds a macOS .app bundle cataloger to inventory native macOS applications.
   • Adds support for Kerberos 5 library cataloging.
   • Includes the date of scan in SBOM results.

   9 details in Everything

8. v1.46.0 Jun 26, 2026 · release notes

   syft v1.46.0 adds SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format., Deno, Bun lockfile, Elastic agent/Beats support, uv PEP 723PEP 723A Python Enhancement Proposal that standardizes embedding dependency metadata directly in single-file scripts, letting tools automatically resolve and install requirements without a separate config file. lockfiles, and .bpl PE cataloging.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.46.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.46.0

   └──▷ TRY IT
   Inspect which catalogers are active and what PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. types they emit — now including PURL type info.
   copy

   $ syft cataloger info

   • Supports SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3 as an output format for SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
   • Adds Deno dependency cataloging support.
   • Adds support for Bun lockfile (bun.lock) in the JavaScript cataloger.
   • Catalogs Elastic Agent and Elastic Beats binaries with new binary classifiers.
   • Detects uv PEP 723 script lockfiles (*.py.lock) with the Python cataloger.

   +2 more show less

   • Adds .bpl file support to the PE / DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. cataloger.
   • Adds PURL types to the cataloger info command output.

   7 details in Everything

9. v1.46.0 Jun 26, 2026 · issue 001

   Syft v1.46.0 adds SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format., Deno, Bun lockfile, uv PEP 723PEP 723A Python Enhancement Proposal that standardizes embedding dependency metadata directly in single-file scripts, letting tools automatically resolve and install requirements without a separate config file., Elastic agent/Beats support, and purl types in cataloger info.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.46.0 https://github.com/anchore/syft.git
   # already have the repo? check out this version:
   $ git checkout v1.46.0

   └──▷ TRY IT
   Generate an SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 3-compliant SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from a container image for supply-chain tooling that requires the latest SPDX standard.
   copy

   $ syft alpine:latest -o spdx-json=./sbom-spdx3.json

   Catalog a Deno or Bun project directory to produce a full SBOM including its lockfile dependencies.
   copy

   $ syft ./my-deno-project -o cyclonedx-json=./sbom.json

   Inspect cataloger metadata including PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. types to understand what package identifiers each cataloger emits.
   copy

   $ syft cataloger info

   • Adds SPDX 3 output format support, enabling generation of SPDX 3-compliant SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
   • Adds Deno ecosystem support, cataloging Deno dependencies from projects.
   • Supports Bun lockfile (bun.lock) parsing for JavaScript/TypeScript projects using Bun.
   • Supports uv PEP 723 script lockfiles (*.py.lock) in the Python cataloger.
   • Adds binary classifiers and cataloging for Elastic Agent and Elastic Beats binaries.

   +2 more show less

   • Adds .bpl file support to the PE/DLLDLLA Windows file format containing compiled code and data that multiple programs can load and share at runtime, letting cyber tools inject functionality into other processes or hook system calls. cataloger for broader Windows binary coverage.
   • Adds PURL types to the cataloger info command output for richer cataloger metadata.

   7 details in Everything

10. v1.45.0 Jun 2, 2026 · release notes

    syft v1.45.0 adds ZapAddOn JAR support, ingress-nginx binary cataloging, and MySQL Cluster detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.45.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.45.0

    • Supports ZapAddOns packaged as JAR files for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. cataloging.
    • Catalogs the ingress-nginx binary as a distinct component.
    • Distinguishes between MySQL Cluster (ndb) and standard MySQL when classifying MySQL binaries.

    3 details in Everything

11. v1.45.0 Jun 2, 2026 · issue 001

    Syft v1.45.0 adds ZapAddOns JAR cataloging, ingress-nginx binary detection, and MySQL Cluster/MySQL distinction.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.45.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.45.0

    └──▷ TRY IT
    Generate an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from a container image running ingress-nginx to confirm the binary is now correctly cataloged.
    copy

    $ syft registry.k8s.io/ingress-nginx/controller:v1.10.0 -o cyclonedx-json

    • Supports ZapAddOns packaged as JAR files, enabling SBOM generation for OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. ZAP plugin artifacts.
    • Catalogs ingress-nginx binaries, adding the popular Kubernetes ingress controller to binary detection coverage.
    • Distinguishes MySQL Cluster (ndb) from standard MySQL in the binary classifier, reducing misidentification in SBOM output.

    3 details in Everything

12. v1.44.0 May 1, 2026 · release notes

    Syft v1.44.0 adds linux/riscv64 platform support for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.44.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.44.0

    • Supports linux-riscv64 as a new target platform for SBOM cataloging.

    1 detail in Everything

13. v1.43.0 Apr 22, 2026 · release notes

    syft v1.43.0 adds Deno binary classifiers, OpenLDAPOpenLDAPAn open-source implementation of the Lightweight Directory Access Protocol, maintained by the OpenLDAP Project, used to store and query structured identity data like users and groups over a network. detection, and expanded Haskell/Erlang version support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.43.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.43.0

    • Adds Deno binary classifiers for detecting Deno runtime packages.
    • Adds OpenLDAP binary detection support.
    • Supports cataloging older Haskell package versions.
    • Supports cataloging older Erlang package versions.

    4 details in Everything

14. advisory CVE-2026-33481 Mar 20, 2026 · issue 128
    • CVE-2026-33481: Syft improper temporary file cleanup (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 5.3, affects < v1.42.3)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
15. v1.42.0 Feb 10, 2026 · release notes

    syft v1.42.0 adds GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. model scanning from OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. registries and captures yarn dev dependencies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.42.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.42.0

    └──▷ TRY IT
    Generate an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for an AI model stored as a GGUF file in an OCI registry.
    copy

    $ syft registry:ghcr.io/example/my-gguf-model:latest

    • Supports scanning GGUF (AI model) files directly from OCI registries.
    • Detects dev dependencies in yarn lockfiles, which were previously missed.

    2 details in Everything

16. v1.41.0 Jan 27, 2026 · release notes

    Syft v1.41.0 detects Debian version from /etc/debian_version for more accurate OS identification.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.41.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.41.0

17. v1.40.0 Jan 8, 2026 · release notes

    syft v1.40.0 adds binary cataloging for Istio, Envoy, Grafana, and Valkey, plus PNPMPNPMA Node.js package manager that stores dependencies in a single content-addressable cache and links them into projects, saving disk space and speeding installs compared with npm or Yarn. dev-dependency filtering.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.40.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.40.0

    • Supports filtering out development and test dependencies for PNPM packages from the generated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Catalogs Istio binaries (pilot-discovery, pilot-agent) for version detection.
    • Catalogs Envoy binary for version detection.
    • Catalogs Grafana binary for version detection.
    • Adds a binary classifier for Valkey to detect its version.

    5 details in Everything

18. v1.39.0 Dec 22, 2025 · release notes

    syft v1.39.0 adds Gemfile.next.lock support, richer cataloger info output, UPX-compressed Go binary scanning, snap revision pinning, and .NET single-file dep detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.39.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.39.0

    └──▷ TRY IT
    Scan a UPX-packed Go binary — syft now decompresses the LZMA-compressed .go.buildinfo section automatically to recover full dependency metadata.
    copy

    $ syft <path-to-upx-packed-binary>

    • Supports Gemfile.next.lock as a dependency manifest source for Ruby projects.
    • Enriches syft catalogers command output with details on what each cataloger looks for and what it can find.
    • Supports reading LZMA-compressed .go.buildinfo sections in UPX-packed binaries.
    • Enables specifying a specific snap revision when pulling a snap for scanning.
    • Detects embedded deps.json metadata inside single-file .NET binaries.

    +1 more show less

    • ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. note cataloger now captures the OS field from ELF notes.

    6 details in Everything

19. v1.38.0 Nov 17, 2025 · release notes

    syft v1.38.0 adds GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. AI model cataloging, CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. list scanning, Elixir binary detection, PyPI license enrichment, and license file search.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.38.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.38.0

    └──▷ TRY IT
    Generate an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. that includes GGUF AI model files alongside traditional packages in a directory or container.
    copy

    $ syft scan ./models/llama-3.gguf -o syft-json

    • Catalogs GGUF model files, enabling SBOM generation for AI/ML models stored in the GGUF format.
    • Supports scanning a user-supplied list of CPEs, allowing targeted vulnerability surface analysis beyond auto-detected packages.
    • Detects Elixir binaries installed on the system, expanding language runtime coverage.
    • Enriches Python package license metadata by querying PyPI, improving license compliance accuracy.
    • Adds license file search capability to surface license artifacts during cataloging.

    5 details in Everything

20. v1.37.0 Nov 3, 2025 · release notes

    Syft v1.37.0 adds support for .far and .rar Java resource adapter archive formats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.37.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.37.0

    • Supports .far (Java resource adapter extension) as a recognized Java archive type for cataloging.
    • Supports .rar (Java resource adapter extension) as a recognized Java archive type for cataloging.

    2 details in Everything

21. v1.36.0 Oct 22, 2025 · release notes

    syft v1.36.0 adds remote license fetching for pnpm, universal macOS binary support, and PDM package manager support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.36.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.36.0

    • Fetches remote licenses for packages declared in pnpm-lock.yaml files.
    • Supports universal (fat) Mach-O binaries for multi-architecture macOS scanning.
    • Adds support for PDM (Python Dependency Manager) project files.

    3 details in Everything

22. v1.34.1 Oct 15, 2025 · release notes

    Syft v1.34.1 adds ffmpeg/libav detection, pnpm v9 lockfile support, and Windows ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. releases.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.34.1 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.34.1

    • Detects ffmpeg and libav libraries when generating SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Supports pnpm lockfile version 9.0 for JavaScript dependency scanning.
    • Publishes official Windows ARM64 release binaries.
    • Handles unquoted dependencies in setup.py when cataloging Python packages.

    4 details in Everything

23. v1.33.0 Sep 15, 2025 · release notes

    Syft v1.33.0 adds RPM modularityLabel to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output and file locations for Java native image SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.33.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.33.0

    • Adds modularityLabel field to RpmDBEntry in CycloneDX output, enabling accurate representation of modular RPM packages.
    • Adds file location data to packages sourced from Java native image SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., improving traceability for GraalVM-style artifacts.

    2 details in Everything

24. v1.32.0 Aug 26, 2025 · release notes

    Syft v1.32.0 adds full Go build list cataloging, package.json author parsing, and basic Conda ecosystem support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.32.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.32.0

    • Catalogs the entire Go build list (not just go.mod-listed packages), surfacing transitive dependencies in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Parses the authors keyword from package.json, enriching Node.js package metadata.
    • Adds basic Conda ecosystem support, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for Conda environments.

    3 details in Everything

25. v1.31.0 Aug 13, 2025 · release notes

    Syft v1.31.0 adds the ability to set a PackageSupplier field in the root of SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. documents.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.31.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.31.0

26. v1.30.0 Aug 8, 2025 · release notes

    Syft v1.30.0 adds a binary classifier for HashiCorp Vault.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.30.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.30.0

27. v1.29.0 Jul 21, 2025 · release notes

    Syft v1.29.0 adds support for cataloging Python uv.lock files.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.29.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.29.0

    • Catalogs Python uv.lock files, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for projects managed with the uv package manager.

    1 detail in Everything

28. v1.28.0 Jul 2, 2025 · release notes

    Syft v1.28.0 adds native support for cataloging Snap packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.28.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.28.0

29. v1.27.0 Jun 9, 2025 · release notes

    Syft v1.27.0 adds the current schema version to the syft version command output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.27.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.27.0

30. v1.26.0 May 20, 2025 · release notes

    Syft v1.26.0 extracts version resources from non-.NET DLLs and executables for broader Windows binary coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.26.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.26.0

    • Reads version resources from non-.NET Windows DLLs and executables, expanding package detection beyond .NET binaries.

    1 detail in Everything

31. v1.25.0 May 16, 2025 · release notes

    Syft v1.25.0 adds a PHP interpreter and extensions cataloger for richer PHP SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. coverage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.25.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.25.0

    • Adds PHP interpreter and extensions cataloger to enumerate PHP runtime and installed extensions in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    1 detail in Everything

32. v1.24.0 May 14, 2025 · release notes

    syft v1.24.0 adds Dart, PHP Pear, Homebrew, and Nix catalogers plus richer layer and license metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.24.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.24.0

    • New Dart pubspec cataloger for inventorying Dart/Flutter dependencies.
    • New PHP Pear cataloger for PHP PEAR package detection.
    • New Homebrew cataloger for macOS Homebrew-installed packages.
    • New Nix dependency detection cataloger.
    • Portage license strings are now translated to SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. expressions.

    +7 more show less

    • Detects whether a full license text or a license name was provided, improving license classification accuracy.
    • Returns full license string instead of a SHA256SHA256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. hash when the license string exceeds 64 characters.
    • Annotates visible/hidden paths when scanning with all-layers scope.
    • Exposes the LayerID in which a package was first found, enabling layer-level provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. tracking.
    • Go binaries that previously received (devel) as a version now report UNKNOWN per compliance policy.
    • Preserves original package IDs from decoded SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. when available, maintaining ID continuity in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. round-trips.
    • Base Docker image upgraded to gcr.io/distroless/static-debian12.

    12 details in Everything

33. v1.23.0 Apr 24, 2025 · release notes

    syft v1.23.0 adds Chrome binary detection, libman JS assets, R cataloger in dir scans, and undeclared Python license file detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.23.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.23.0

    • Supports skipping archive extraction when using a file source.
    • Enables the R cataloger during directory scans (previously limited to image scans).
    • Detects JavaScript assets in .NET projects via libman (library.json).
    • Parses GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow comments to surface action dependencies.
    • Detects Chrome browser binaries as catalogued packages.

    +1 more show less

    • Detects undeclared license files when scanning Python installations.

    6 details in Everything

34. v1.22.0 Apr 1, 2025 · release notes

    syft v1.22.0 adds direct .deb archive cataloging and improved .NET CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. generation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.22.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.22.0

    • Catalogs .deb archives directly, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation from standalone Debian packages without a full dpkg database.
    • Improves CPE generation for .NET packages for more accurate vulnerability matching.

    2 details in Everything

35. v1.21.0 Mar 17, 2025 · release notes

    syft v1.21.0 adds GraalVM Native Image symbol extraction and fluent-bit 1.7.0 dev/rc support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.21.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.21.0

    • Extracts symbols from the .dynsym section of GraalVM Native Image binaries for richer SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. component data.
    • Supports fluent-bit 1.7.0 development and release-candidate package versions in SBOM generation.

    2 details in Everything

36. v1.20.0 Feb 21, 2025 · release notes

    syft v1.20.0 adds file cataloger selection config, license content inclusion in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., and Bitnami embedded SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.20.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.20.0

    • Adds file catalogers to the selection configuration, giving users explicit control over which file catalogers run.
    • New configuration option to include full license contents (not just identifiers) in generated SBOMs.
    • Supports Bitnami embedded SBOMs, enabling syft to ingest and surface pre-existing SBOM data from Bitnami container images.

    3 details in Everything

37. v1.19.0 Jan 22, 2025 · release notes

    Syft v1.19.0 adds NuGetNuGetMicrosoft's package manager for .NET, hosting a public registry of reusable libraries so tools can pull in dependencies without bundling or manually maintaining third-party code. package cataloging and license parsing from vendor directories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.19.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.19.0

    • Adds license parsing from vendor directories, improving license detection coverage for vendored dependencies.
    • Supports cataloging NuGet packages, enabling SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation for .NET ecosystems.

    2 details in Everything

38. v1.18.0 Dec 9, 2024 · release notes

    syft v1.18.0 adds Rust audit binary relationships, configurable layer size, Dart arm/v7 support, and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. path normalization.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.18.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.18.0

    • Adds dependency relationships for Rust audit binary packages in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Supports configuration of image layer size reporting in syft.
    • Supports Dart arm/v7 architecture for both Dart SDK 2.x and 3.x.
    • Converts SPDX absolute paths to relative paths in SPDX output.

    4 details in Everything

39. v1.17.0 Nov 21, 2024 · release notes

    Syft v1.17.0 adds Rust dependency relationships and Node 6.x support to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.17.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.17.0

    • Surfaces Rust dependency relationships in generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Supports scanning Node.js 6.x package manifests.

    2 details in Everything

40. v1.16.0 Nov 4, 2024 · release notes

    Syft v1.16.0 omits devDependencies from package-lock.json SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. by default for cleaner production inventories.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.16.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.16.0

    └──▷ BREAKING ON UPGRADE

    • !package-lock.json scanning no longer includes devDependencies by default; SBOMs generated from projects with devDependencies will contain fewer packages than in v1.15.0.
41. v1.15.0 Oct 28, 2024 · release notes

    syft v1.15.0 adds config profiles, cargo-auditable binary scanning, Java dependency relationships, and broader dpkg/MariaDB detection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.15.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.15.0

    • Supports hierarchical config file merging and named config profiles for managing multiple scan configurations.
    • Enables the cargo-auditable-binary-cataloger for scanning files and directories (previously container-only).
    • Detects older MariaDB versions via an improved binary classifier.
    • Discovers dpkg status files at additional glob paths for broader Debian package detection.
    • Emits dependency relationships for Java packages in the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output.

    5 details in Everything

42. v1.14.0 Oct 7, 2024 · release notes

    Syft v1.14.0 adds known-unknowns reporting to SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. and expands distro detection for HAProxy, Redis, Node, and Ruby.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.14.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.14.0

    • Reports known unknowns (unidentified components) directly in the output SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for greater visibility into coverage gaps.
    • Identifies bash.preinst as a cataloged artifact.
    • Supports HAProxy release-candidate and older version identifiers.
    • Supports Redis on arm/v5, arm/v7, and 386 architectures across versions 7.2, 7.4, and 8.0.
    • Supports identification of older Node.js versions.

    +1 more show less

    • Supports rubylang/ruby dev, rc, and preview version identifiers.

    6 details in Everything

43. v1.13.0 Sep 24, 2024 · release notes

    Syft v1.13.0 adds a data enrichment flag, Dart support, seven new binary classifiers, and richer JVMJVMThe Java Virtual Machine, a runtime maintained by Oracle (and implemented by others) that executes Java bytecode on any OS, giving cyber tools a portable, garbage-collected environment with a large ecosystem of libraries./JDK cataloging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.13.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.13.0

    • New --enrich flag enables opt-in data enrichment when generating SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • Adds Dart language classifier for detecting Dart binaries.
    • Adds binary classifiers for lighttpd, proftpd, zstd, xz, gzip, jq, and SQLCipher.
    • Catalogs JDK installations more completely, including richer metadata for JVM installations.
    • Stubs unknown package versions instead of dropping packages from the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    +1 more show less

    • Supports scanning bitnami/mysql:8.x images.

    6 details in Everything

44. v1.12.2 Sep 11, 2024 · release notes

    syft v1.12.2 adds curl, Haskell, OCaml, and HAProxy binary detection to SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. cataloging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.12.2 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.12.2

    • Detects curl binaries as cataloged packages in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..
    • New Haskell binaries cataloger identifies Haskell ecosystem components.
    • Adds OCaml ecosystem support for cataloging OCaml packages.
    • Supports HAProxy dev builds for binary-level SBOM detection.

    4 details in Everything

45. v1.11.0 Aug 9, 2024 · release notes

    syft v1.11.0 adds SWI Prolog ecosystem support and improves Java cataloging accuracy

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.11.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.11.0

    • Adds SWI Prolog (swipl) ecosystem cataloging support.
    • Improves Java cataloging with better multi-level parent POM resolution, DependencyManagement support, and cycle detection.
    • Updates PackageSupplier to type Organization for JAR files in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output.
    • Improves main artifact name retrieval accuracy for multi-JAR packages.

    4 details in Everything

46. v1.10.0 Jul 30, 2024 · release notes

    Syft v1.10.0 adds TiDB binary cataloging, Maven CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. generation, Go main module detection, and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware./RISC-V Traefik support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.10.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.10.0

    • Detects Go main module from partial package builds, improving SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. accuracy for incomplete build artifacts.
    • Supports Traefik binary cataloging on linux/arm/v6 and linux/riscv64 architectures.
    • Catalogs TiDB binaries as a new supported package type.
    • Generates Maven-friendly CPEs for Java packages, improving compatibility with Maven-based vulnerability matching.

    4 details in Everything

47. v1.9.0 Jul 11, 2024 · release notes

    Syft v1.9.0 adds Erlang detection on Alpine, Swift package manager V3 support, and PHP Composer downloadLocation mapping.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.9.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.9.0

    • Add detection of Erlang in Alpine linux
    • Add version 3 support for swift package manager of the resolved files
    • Map the downloadLocation field for PHP Composer packages

    3 details in Everything

48. v1.8.0 Jun 24, 2024 · release notes

    Syft v1.8.0 adds CycloneDX 1.6CycloneDX 1.6An OWASP-maintained Software Bill of Materials standard that catalogs components, dependencies, and supply-chain metadata; tools use it to produce or consume machine-readable SBOMs in a widely supported schema. support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.8.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.8.0

    • Adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.6 as a supported output format

    1 detail in Everything

49. v1.7.0 Jun 14, 2024 · release notes

    Syft v1.7.0 adds CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. generation for WordPress plugins and themes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.7.0

50. v1.6.0 Jun 10, 2024 · release notes

    Syft v1.6.0 adds go binary package relationship detection, util-linux classification, and license metadata for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Adds relationships for go binary packages to expose dependency links in the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Adds classifier for util-linux to correctly identify util-linux library packages
    • Adds support for more advanced Lua syntax in license detection logic
    • Adds license field to ELF binary package metadata extraction

    4 details in Everything

51. v1.5.0 May 28, 2024 · release notes

    Adds syft config command, new package relationships (SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format., RPM DB, Python wheel eggs), and fluent-bit detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • Introduces the syft config command for managing tool configuration
    • Add abstraction for adding relationships from package cataloger results
    • Capture dependencies when parsing SPDX SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Add support for RPM DB package relationships
    • Detect fluent-bit binaries

    5 details in Everything

52. v1.4.0 May 9, 2024 · release notes

    Syft v1.4.0 adds relationship tracking for ELFELFThe standard binary format for executables, shared libraries, and object files on Linux and most Unix-like systems, giving cyber tools a predictable structure to parse, instrument, or analyze compiled code. and ALPM packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds relationships to ELF packages

    1 detail in Everything

53. v1.3.0 Apr 26, 2024 · release notes

    Syft v1.3.0 adds known CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. indexing for Go modules and PHP packages to enhance SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. accuracy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • Index known Common Platform Enumerations (CPEs) for go modules
    • Support multiple known CPEs per package in the index
    • Index known CPEs for PHP Composer packagist.org packages
    • Index known CPEs for PHP extensions

    4 details in Everything

54. v1.2.0 Apr 12, 2024 · release notes

    syft v1.2.0 adds JRE/JDK differentiation and dnf package support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    • Adds jre and jdk package type differentiation for Java runtime environments
    • Adds support for cataloging dnf packages from Red Hat-based distributions

    2 details in Everything

55. v1.1.0 Mar 25, 2024 · release notes

    Syft v1.1.0 adds Oracle GraalVM detection, binary export metadata, and remote license resolution from package-lock.json

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds binary export metadata (entrypoint and imports) to the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output
    • Enables retrieval of remote licenses when parsing package-lock.json

    2 details in Everything

56. v1.0.0 Feb 29, 2024 · release notes

    syft v1.0.0 adds source type CLI flag for explicit input control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.0.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v1.0.0

    └──▷ USE IT
    Force syft to treat the input argument as a specific format rather than auto-detecting it.
    shell copy

    syft --source docker-archive my-image.tar

57. v0.105.1 Feb 26, 2024 · release notes

    Syft v0.105.1 now includes the syft version in SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. tool info by default.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.105.1 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.105.1

58. v0.105.0 Feb 14, 2024 · release notes

    Syft v0.105.0 adds WordPress plugin cataloging and Go main module version inference from binaries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.105.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.105.0

    • Adds WordPress plugin file cataloger to detect WP plugins within container images or filesystems
    • Enables guessing the Go main module version directly from binary contents during cataloging

    2 details in Everything

59. v0.104.0 Feb 7, 2024 · release notes

    Syft v0.104.0 adds Erlang OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets. cataloger, binary security feature identification, and metadata for Yarn/Poetry lockfiles

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.104.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.104.0

    • Adds Erlang OTP Application cataloger (ErLangOTP) for detecting Erlang applications in archives
    • Parses yarn.lock and poetry.lock files with enhanced metadata fields
    • Supports Conan lockfiles version 0.5 format
    • Annotates each CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. on a package with its source location

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The top-level API refactoring makes it more composable, potentially requiring updates to existing programmatic integrations.
60. v0.101.0 Jan 17, 2024 · release notes

    Adds syft cataloger list command and ability to enable/disable individual catalogers via CLI flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.101.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.101.0

    └──▷ TRY IT
    View all available catalogers and their default states before running a scan.
    copy

    $ syft cataloger list

    • Adds cataloger list subcommand to display available catalogers
    • Adds --cataloger.<name>.enabled=true|false flags to control which catalogers run during a scan

    2 details in Everything

61. v0.100.0 Jan 5, 2024 · release notes

    Adds OpenSSL binary matcher, extended ErLang parsing, and extensible binary cataloguers in v0.100.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.100.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.100.0

    • OpenSSL binary matcher enables detection of OpenSSL installations from raw binaries
    • ErLang parser gains additional functionality for enhanced language coverage

    2 details in Everything

62. v0.99.0 Dec 21, 2023 · release notes

    Syft v0.99.0 adds remote license retrieval for Maven and Yarn, new binary classifiers, and exposes JS cataloger config.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.99.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.99.0

    • Retrieves licenses from pom.properties when a project has no pom.xml present
    • Adds binary classifier support for the Erlang interpreter
    • Adds binary detection for PHP Composer projects
    • Parses Python package licenses from the LicenseFile entry in Wheel Metadata
    • Parses Python package licenses from the LicenseExpression entry in Wheel Metadata

    +1 more show less

    • Adds binary classifier for Julia lang

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !UI events for cataloging tasks have been generalized, potentially breaking scripts relying on previous event structure
63. v0.98.0 Nov 29, 2023 · release notes

    Adds MySQL/MariaDB binary classifiers and compact JSON/XML format configuration to syft

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.98.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.98.0

    • Enhances redis binary classifier to support additional versions
    • Exposes compact JSON and XML format configuration

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removes the power-user command and its related catalogers
64. v0.97.0 Nov 16, 2023 · release notes

    Syft v0.97.0 adds Maven groupID fallback logic and syft-json metadata helper

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.97.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.97.0

    • groupIDFromJavaMetadata function falls back to Maven Central when a package's groupId is not immediately resolvable.
    • New syft-json format output includes a package metadata type helper for programmatic access.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Location virtualPath field renamed to accessPath
65. v0.96.0 Nov 9, 2023 · release notes

    Syft v0.96.0 adds Maven parent POM license scanning and stores image annotations in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.96.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.96.0

    • Adds support for parsing license information from Maven parent POMs when scanning nested jars
    • Stores container image annotations inside the generated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. artifacts

    2 details in Everything

66. v0.95.0 Nov 7, 2023 · release notes

    Syft v0.95.0 adds conaninfo.txt parser for Docker images and PURLs in Gradle lock files, with breaking changes to core metadata types.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.95.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.95.0

    • Add conaninfo.txt parser to detect Conan packages inside Docker images
    • Include Package URLs (PURLs) when scanning Gradle lock files
    • Use case-insensitive matching for Go license files

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The MetadataType field has been removed from the core package struct.
    • !Deprecated syft.Format functions have been removed.
67. v0.94.0 Oct 20, 2023 · release notes

    Syft v0.94.0 adds .NET dependency tree parsing and dpkg relationship support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.94.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.94.0

    • Parse .NET (dotnet) dependency trees to capture nested library relationships within applications.
    • Identify licenses using embedded license text content when standard filename-based detection fails.

    2 details in Everything

68. v0.93.0 Oct 10, 2023 · release notes

    Adds pom.xml license parsing and Golang STD library package detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.93.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.93.0

    • Parse licenses from pom.xml files when they are missing from the manifest
    • Add Golang standard library packages to the catalog when a binary is detected as compiled with that version

    2 details in Everything

69. v0.92.0 Sep 27, 2023 · release notes

    Syft v0.92.0 adds support for multiple image refs pointing to the same SHA in OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. layout sources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.92.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.92.0

70. v0.91.0 Sep 20, 2023 · release notes

    Syft v0.91.0 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.5 support, containerd image sources, and GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. cataloging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.91.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.91.0

    • Add support for containerd as an image source
    • Support cataloging github workflow & github action usages

    2 details in Everything

71. v0.90.0 Sep 11, 2023 · release notes

    Syft v0.90.0 exposes the cobra command for CLI package integration and adds a User-Agent header during updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.90.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.90.0

72. v0.89.0 Aug 31, 2023 · release notes

    Adds SYFT_CONFIG environment variable to override the default configuration file path

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.89.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.89.0

    └──▷ USE IT
    Use a configuration file from a custom location instead of the default path.
    shell copy

    SYFT_CONFIG=/path/to/custom/config.yaml syft ...

    • Add registry certificate verification support

    1 detail in Everything

73. v0.88.0 Aug 25, 2023 · release notes

    syft v0.88.0 adds detection for golang boring crypto/fipsonly modules and bash binaries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.88.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.88.0

    • golang package classifier now detects boringcrypto and fipsonly modules.
    • binary file classifer now produces bash packages for Bash executable files.

    2 details in Everything

74. v0.87.0 Aug 14, 2023 · release notes

    Syft v0.87.0 adds originator logic for supplier metadata, expands deb cataloger to opkg, and adds a new Nginx binary cataloger.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.87.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.87.0

    • Uses originator logic to fill supplier metadata in the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Expands the deb cataloger to include opkg package format support
    • Adds a new binary cataloger for Nginx built from source

    3 details in Everything

75. v0.86.0 Jul 31, 2023 · release notes

    Syft v0.86.0 adds Swift Package Manager cataloging and indexed CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. dictionary

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.86.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.86.0

    • Adds swift-package-manager cataloger to detect Swift Package Manager dependencies in source code or archives
    • Introduces an indexed embedded CPE dictionary for improved Common Platform Enumeration lookups
    • Enhances Python requirements.txt parsing to guess unpinned versions

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The jotframe UI is removed
    • !Python environment marker handling is simplified, potentially altering how markers are parsed
76. v0.85.0 Jul 12, 2023 · release notes

    Adds --base-path CLI flag for scan directory base; adds file source digest support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.85.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.85.0

    └──▷ BREAKING ON UPGRADE

    • !The source API and syft-json source block data shape were refactored; existing consumers of these fields must update their parsing logic.
77. v0.83.0 Jun 5, 2023 · release notes

    Adds --source-version and --source-name flags to annotate SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. with the target's name and version

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.83.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.83.0

    • Add new --source-version and --source-name options to set the name and version of the target being analyzed for reference in resulting syft-json format SBOMs (more formats will support these flags soon).
    • Accept main.version ldflags even without vcs

    2 details in Everything

78. v0.82.0 May 23, 2023 · release notes

    Syft v0.82.0 improves Go main module version detection using ldflags.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.82.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.82.0

79. v0.81.0 May 22, 2023 · release notes

    Syft v0.81.0 adds R package cataloging, SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. expression assertions, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. version warnings.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.81.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.81.0

    • Adds R language support for package cataloging in containers and filesystems
    • Supports describing license properties and making SPDX expression assertions during cataloging
    • Warns when parsing an SBOM document with a newer schema version than expected

    3 details in Everything

80. v0.80.0 May 5, 2023 · release notes

    v0.80.0 improves pnpm support for Syft

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.80.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.80.0

    • Improve pnpm support

    1 detail in Everything

81. v0.79.0 Apr 21, 2023 · release notes

    Syft v0.79.0 adds consul binary classifier and ALPM metadata to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence./SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.79.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.79.0

    • Adds consul binary classifier for package identification
    • Extends CycloneDX and SPDX output formats with ALPM metadata fields

    2 details in Everything

82. v0.78.0 Apr 17, 2023 · release notes

    syft v0.78.0 adds Linux kernel cataloger, Go network license scanning, Consul classifier, and package evidence annotations

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.78.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.78.0

    • Add Linux Kernel cataloger - Enables discovery of packages within the Linux kernel source tree.
    • Support scanning license files in golang packages over the network - Allows license detection for Go modules fetched remotely without local vendor dirs.
    • Add consul binary classifier - Recognizes HashiCorp Consul binaries as a distinct package type.

    3 details in Everything

83. v0.77.0 Apr 11, 2023 · release notes

    Syft v0.77.0 adds support for Gradle lockfiles and Java nar files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.77.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.77.0

    • Adds gradle.lockfile support to detect Gradle dependencies from lockfiles

    1 detail in Everything

84. v0.76.1 Apr 5, 2023 · release notes

    syft v0.76.1 adds Nix Cataloger support and portage file ownership capture

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.76.1 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.76.1

    • Nix packages are now cataloged via the new Nix Cataloger, expanding package detection coverage to the Nix ecosystem.
    • File ownership relationships (user/group metadata) for packages in the Portage ecosystem are now captured during image analysis.

    2 details in Everything

85. v0.76.0 Mar 31, 2023 · release notes

    Syft v0.76.0 adds local go mod license scanning, argocd binary classification, and a new default image source config option

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.76.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.76.0

    • New argocd binary classifier enables detection of ArgoCDArgoCDA Kubernetes-native continuous delivery controller, maintained by the CNCF, that syncs live cluster state to declarative config stored in Git, giving cyber tools automated, auditable deployment pipelines. binaries during scan
    • Added support for scanning local go mod licenses (go.mod/go.sum) to populate license fields for golang packages

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The config.yaml file is deprecated as a valid configuration source; users must migrate to supported config formats or locations.
86. v0.75.0 Mar 13, 2023 · release notes

    Adds cataloging of Ruby binary packages in syft v0.75.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.75.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.75.0

87. v0.74.0 Mar 2, 2023 · release notes

    Syft v0.74.0 adds rust toolchain binary cataloger and haproxy binary support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.74.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.74.0

    • rust toolchain binary cataloger to detect Rust binaries in container images or filesystems
    • haproxy binary cataloger to identify HAProxy installations
    • cosign attest predicate type now matches Syft output type (--output value)

    3 details in Everything

88. v0.73.0 Feb 22, 2023 · release notes

    Adds perl binary cataloging support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.73.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.73.0

    • Catalog perl binary

    1 detail in Everything

89. v0.72.0 Feb 16, 2023 · release notes

    syft v0.72.0 adds support for reading SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from STDIN for conversion workflows

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.72.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.72.0

    • Enables SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. conversions from STDIN

    1 detail in Everything

90. v0.71.0 Feb 9, 2023 · release notes

    Syft v0.71.0 adds Postgres binary cataloging and specific SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. format version export

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.71.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.71.0

    • Extends catalog coverage to include postgres binaries

    1 detail in Everything

91. advisory CVE-2023-24827 Feb 6, 2023 · issue 128
    • CVE-2023-24827: Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set (CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. 6.5, affects >= v0.69.0 && < v0.70.0)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
92. v0.70.0 Feb 3, 2023 · release notes

    Adds cataloging for the traefik binary package format in syft v0.70.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.70.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.70.0

    • traefik catalog support enables identifying Traefik-related packages when scanning container images.

    1 detail in Everything

93. v0.69.0 Jan 30, 2023 · release notes

    Syft v0.69.0 adds library support for scanning unpacked container filesystems

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.69.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.69.0

94. v0.68.0 Jan 20, 2023 · release notes

    Syft v0.68.0 adds support for cataloging the memcached binary.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.68.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.68.0

    • Catalog memcached binary

    1 detail in Everything

95. v0.66.0 Jan 12, 2023 · release notes

    Adds cataloging for Erlang/Elixir, PHP, Apache HTTP, and Redis binary runtimes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.66.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.66.0

    └──▷ USE IT
    Scan a container image for Erlang/Elixir dependencies using rebar and mix.
    shell copy

    syft <image_name> -o syft-json --cataloger-selection include,erlang-rebar,erlang-mix

    • syft now catalogs Erlang/Elixir artifacts via rebar and mix package managers.
    • syft now catalogs PHP binary runtimes.
    • syft now catalogs Apache HTTP binary runtimes.
    • syft now catalogs Redis binary runtimes.
    • The origin field is added to the syftjson output format.

    5 details in Everything

96. v0.65.0 Jan 4, 2023 · release notes

    Syft v0.65.0 adds PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. types for binary classifiers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.65.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.65.0

97. v0.64.0 Dec 23, 2022 · release notes

    Syft v0.64.0 adds Java license parsing and associates binaries with packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.64.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.64.0

    • Adds java license cataloger to extract and report software licenses from Java artifacts
    • Associates binary executables with their corresponding package metadata in the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
    • Includes go.sum h1 digest information in checksums for Go dependencies

    3 details in Everything

98. v0.63.0 Dec 12, 2022 · release notes

    Syft v0.63.0 adds cataloging of Java binary runtimes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.63.0 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.63.0

99. v0.62.3 Nov 30, 2022 · release notes

    Syft v0.62.3 adds a generic binary cataloger and --name output override

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.62.3 https://github.com/anchore/syft.git
    # already have the repo? check out this version:
    $ git checkout v0.62.3

    └──▷ USE IT
    Override the default artifact name in the catalog output (e.g., SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., CSV) by passing --name.
    shell copy

    syft /path/to/image --name my-custom-bundle

100. v0.62.0 Nov 18, 2022 · release notes

     Syft v0.62.0 adds NPM package-lock.json version 3 support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.62.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.62.0

101. v0.61.0 Nov 18, 2022 · release notes

     Syft v0.61.0 adds SPDX 2.3SPDX 2.3An open standard from the Linux Foundation for describing software bills of materials, letting cyber tools exchange dependency, license, and vulnerability data in a common machine-readable format. support and map fields in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.61.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.61.0

     └──▷ USE IT
     Generate an SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. compliant with the SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. 2.3 specification for your application.
     shell copy

     syft packages <image_or_dir> -o spdx-json > sbom.json

102. v0.60.1 Nov 1, 2022 · release notes

     Syft v0.60.1 now includes Go binary h1 digests in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output to aid build reproducibility verification

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.60.1 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.60.1

103. v0.59.0 Oct 17, 2022 · release notes

     Adds attestation support for Singularity images

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.59.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.59.0

     └──▷ BREAKING ON UPGRADE

     • !Removes upload to Anchore Enterprise
104. v0.58.0 Sep 29, 2022 · release notes

     Adds conan.lock package format support and file checksum field in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. output

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.58.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.58.0

     • Adds support for cpp conan.lock files to the package cataloger
     • Adds a file.checksum field in generated SPDX documents

     2 details in Everything

105. v0.57.0 Sep 19, 2022 · release notes

     SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. JSON output now uses consistent sorting in v0.57.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.57.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.57.0

106. v0.56.0 Sep 12, 2022 · release notes

     Syft v0.56.0 adds a new CLI flag to disable network access

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.56.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.56.0

     └──▷ USE IT
     Run Syft in a fully offline environment without network timeouts or errors
     shell copy

     syft packages my_image.tar --output cyclonedx-json --no-network

     • Adds --no-network flag to prevent Syft from contacting toolbox-data.anchore.io

     1 detail in Everything

107. v0.55.0 Aug 29, 2022 · release notes

     Adds pnpm package manager support and captures the private field for npm modules

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.55.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.55.0

     • Add support for pnpm cataloger to discover packages from pnpm-lock.yaml
     • Capture the private field from package.json for npm modules

     2 details in Everything

108. v0.54.0 Aug 17, 2022 · release notes

     syft v0.54.0 adds implicit :latest tag assumption and rpm modularity support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.54.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.54.0

     • Assumes :latest tag implicitly when no tag is specified in image names
     • Adds rpm modularity to rpm records generated by syft

     2 details in Everything

109. v0.53.1 Aug 2, 2022 · release notes

     Adds Singularity Image Format (SIF) support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.53.1 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.53.1

110. v0.53.0 Aug 2, 2022 · release notes

     Syft v0.53.0 adds support for auditable Rust binaries

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.53.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.53.0

111. v0.52.0 Jul 21, 2022 · release notes

     v0.52.0 adds Haskell library detection to syft and switches the binary base image

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.52.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.52.0

     • Adds Haskell (Cabal/Stackage) package catalog support
     • Replaces scratch base image with distroless static

     2 details in Everything

112. v0.51.0 Jul 11, 2022 · release notes

     Syft v0.51.0 adds Docker image skipping, CocoaPods support, Gentoo support, and a filesystem limit flag.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.51.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.51.0

     • Adds -xdev CLI option to limit scans to a single filesystem/device
     • Adds initial CocoaPods (Swift/Objective-C) package cataloger
     • Adds initial Gentoo Linux package cataloger

     3 details in Everything

113. v0.50.0 Jul 6, 2022 · release notes

     Syft v0.50.0 adds Conan C/C++ support and a --all-catalogers flag for image scanning

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.50.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.50.0

     └──▷ TRY IT
     Scan an entire container image using every supported package index to maximize dependency coverage
     copy

     $ syft scan ubuntu:latest --all-catalogers

     • Adds --all-catalogers CLI flag to enable all available catalogers during image scanning instead of the default subset
     • Adds Conan (C/C++) package cataloger support for source code scanning

     2 details in Everything

114. v0.49.0 Jun 24, 2022 · release notes

     Adds --catalogers, SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. language toggles, and Mariner distroless support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.49.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.49.0

     • Catalog packages from source pom.xml during directory scans
     • Add support for Mariner distroless images

     2 details in Everything

115. v0.48.0 Jun 16, 2022 · release notes

     Syft v0.48.0 adds pacman cataloger for Arch Linux packages

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.48.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.48.0

     • Adds Pacman (Arch linux package manager) support

     1 detail in Everything

116. v0.47.0 Jun 9, 2022 · release notes

     Adds support for Amazon Linux 2022 and newer rpm database formats.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.47.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.47.0

     • Adds support for the ndb rpm database format used in rpmdb 4.15+
     • Makes Syft available in the Nix Package Store (nixpkgs)

     2 details in Everything

117. v0.46.0 May 12, 2022 · release notes

     Syft v0.46.0 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. format conversion support, .NET Core cataloging, and post-generation attestation attachment

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.46.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.46.0

     • Support format SBOM conversion allowing output to be converted to a different standard
     • Adds .NET Core support for cataloging packages in .NET Core applications
     • Support attaching attestation right after generate it enabling immediate signature/proof attachment

     3 details in Everything

118. v0.45.0 Apr 29, 2022 · release notes

     Syft v0.45.0 preserves package IDs when decoding Syft JSON SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.45.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.45.0

     • Preserve package IDs on Syft JSON SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. decode
     • refactor command package to remove globals and add dependency injection

     2 details in Everything

119. v0.44.0 Apr 12, 2022 · release notes

     Syft v0.44.0 introduces hash-based detection for Java namespaces/group IDs and additional Spring Framework vendors.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.44.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.44.0

     • Adds hash-based detection for Java namespaces and Group IDs to resolve package identity when POM metadata is missing
     • Expands vendor coverage for Spring Framework libraries

     2 details in Everything

120. v0.43.0 Mar 31, 2022 · release notes

     Adds Dart package cataloging for syft cli

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.43.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.43.0

     • Add dart support

     1 detail in Everything

121. v0.42.0 Mar 17, 2022 · release notes

     syft v0.42.0 adds Go 1.18 binary metadata extraction

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.42.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.42.0

     • Adds support for capturing additional Go 1.18 based binary information

     1 detail in Everything

122. v0.41.4 Mar 14, 2022 · release notes

     Adds Yarn v3 support and updates CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output format to version 1.4.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.41.4 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.41.4

     • syft can now scan dependencies for packages managed by Yarn v3.
     • CycloneDX SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output format has been updated to version 1.4.

     2 details in Everything

123. v0.41.0 Mar 7, 2022 · release notes

     v0.41.0 adds platform selection via --platform flag for container image scanning

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.41.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.41.0

     └──▷ USE IT
     Scan a multi-arch image for a specific CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. architecture to ensure accurate package listing.
     shell copy

     syft --platform linux/amd64 docker.io/library/nginx:latest

124. v0.40.0 Mar 2, 2022 · release notes

     Syft v0.40.0 adds multiple CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. support in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and introduces the syft property namespace for CycloneDX exports.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.40.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.40.0

125. v0.39.3 Feb 26, 2022 · release notes

     Adds capability to sign or attest generated SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.39.3 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.39.3

126. v0.38.0 Feb 15, 2022 · release notes

     Syft v0.38.0 adds improved pURL generation for Java packages and corrects NPM pURL logic.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.38.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.38.0

     • Adds Package URLPackage URLA standardized string format for uniquely identifying software packages across ecosystems (npm, PyPI, Maven, etc.), letting cyber tools reference and correlate dependency data without ecosystem-specific logic. (pURL) generation support for Java packages to the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. output

     1 detail in Everything

127. v0.37.10 Feb 8, 2022 · release notes

     New SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. decode enhancements and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. presenter extensions for Syft v0.37.10

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.37.10 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.37.10

     • Adds distro information to package URLs (pURLs) for OS packages
     • Encodes the upstream qualifier on OS package pURLs
     • Extracts language and package type from pURLs during SBOM decode
     • Extends CycloneDX presenters with syft-specific values
     • Extends CycloneDX presenter with a dependency graph

     5 details in Everything

128. v0.36.0 Jan 19, 2022 · release notes

     Syft v0.36.0 adds PHP metadata support and optional JSON metadata fields

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.36.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.36.0

     • Adds additional PHP metadata extraction for package artifacts.
     • Makes metadataType and other metadata fields optional in the syft JSON output.

     2 details in Everything

129. v0.35.0 Jan 7, 2022 · release notes

     Syft v0.35.0 adds Java .par and lpkg support plus multi-format BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. output.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.35.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.35.0

     • Adds support for .par files in Java ecosystems
     • Enables searching for JARs within archives during cataloging
     • Adds lpkg as a recognized Java package format
     • Supports generating multiple BOM files in different formats from a single run

     4 details in Everything

130. v0.34.0 Dec 22, 2021 · release notes

     Adds --exclude-path CLI flag and improves pip VCSVCSVersion control system: software that tracks changes to files over time, letting teams collaborate and roll back mistakes. Cyber tools use it to manage source code, configs, and signatures. URL support in syft v0.34.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.34.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.34.0

     └──▷ USE IT
     Exclude a large node_modules directory from the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. to reduce size and scan time.
     shell copy

     syft --exclude-path node_modules my-image:latest

     Debug why syft reports a specific version by enabling verbose logging which now includes the tool's version.
     shell copy

     syft -v my-image:latest

     • --exclude-path option to skip specific directories during image or filesystem scanning
     • Support for VCS URLs in Python's pip requirements parsing (e.g., git+https://...)
     • Syft version output now included in verbose logs (-v) for easier debugging

     3 details in Everything

131. v0.32.0 Dec 8, 2021 · release notes

     Syft v0.32.0 adds Mach-O cataloging, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. JSON output, and AlmaLinux OS support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.32.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.32.0

     • Added cataloging of Mach-O multi-architecture binaries
     • Added AlmaLinux OS support

     2 details in Everything

132. v0.31.0 Dec 3, 2021 · release notes

     Supports PHP/composer installed.json files and cataloging archive contents for single-file input

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.31.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.31.0

     • catalog now supports installed.json (PHP/composer) as a direct single-file input format
     • syft <file> detects and catalogs contents of archives (e.g., tar, zip) when passed directly instead of requiring a directory or container

     2 details in Everything

133. v0.30.1 Nov 15, 2021 · release notes

     Adds external registry configuration and single-file cataloging support in v0.30.1

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.30.1 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.30.1

     • Adds support for external registry configuration to control source credential handling
     • Adds ability to catalog software inventory from a single file using the existing CLI path argument

     2 details in Everything

134. v0.29.0 Oct 31, 2021 · release notes

     Stabilizes package identifiers based on contents and unhides auto-completion command

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.29.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.29.0

     • syft packages now uses stable, content-based identifiers for packages, replacing the previous unstable scheme.
     • Adds auto-complete subcommand to generate shell completion scripts (previously hidden).

     2 details in Everything

135. v0.28.0 Oct 28, 2021 · release notes

     Adds auto-completion and arm64 support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.28.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.28.0

     └──▷ USE IT
     Pull the official image for running Syft on ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware.-based hardware (e.g., AWS Graviton or Apple Silicon via emulation).
     shell copy

     docker pull anchore/syft:v0.28.0

     • Provides official Docker images for the arm64 architecture

     1 detail in Everything

136. v0.27.0 Oct 21, 2021 · release notes

     syft v0.27.0 adds Windows support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.27.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.27.0

137. v0.26.0 Oct 16, 2021 · release notes

     Syft v0.26.0 introduces GitHub Action integration and enhanced Go package data capture.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.26.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.26.0

     • Adds github-action for continuous scanning in CI/CD workflows
     • Captures additional Go package metadata during image analysis

     2 details in Everything

138. v0.25.0 Oct 7, 2021 · release notes

     Syft v0.25.0 adds Go module cataloging for Go binaries, file output, and extended SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. license mapping

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.25.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.25.0

     • Catalog Go modules used in Go binaries
     • Add option to output SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. report to a file
     • Extend license mapping for common SPDX license names

     3 details in Everything

139. v0.24.0 Sep 23, 2021 · release notes

     syft v0.24.0 adds Files and Relationship fields to SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format.-JSON output

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.24.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.24.0

140. v0.23.0 Sep 13, 2021 · release notes

     Adds a directory source to the power-user subcommand for direct filesystem cataloging.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.23.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.23.0

     • Allow syft to populate distro data for all types

     1 detail in Everything

141. v0.21.0 Aug 23, 2021 · release notes

     Adds Pipenv (Pipfile.lock) support to the cataloger

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.21.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.21.0

     • syft can now read Pipfile.lock files from Python application directories.

     1 detail in Everything

142. v0.19.0 Jun 30, 2021 · release notes

     Adds support for scanning a root filesystem

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.19.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.19.0

143. v0.17.0 Jun 4, 2021 · release notes

     Syft v0.17.0 adds improved app.jar packaging discovery and reports RPM version epoch.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.17.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.17.0

     • Improve discovery of self-executing JARs packaged as app.jar

     1 detail in Everything

144. v0.16.1 May 25, 2021 · release notes

     Syft v0.16.1 adds import timeout configuration

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.16.1 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.16.1

145. v0.15.1 Apr 22, 2021 · release notes

     Adds secrets cataloger, Rust Cargo.lock support, binary identification, registry image pulling, and --dir flag

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.15.1 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.15.1

     └──▷ USE IT
     Pull and scan an image directly from a registry using explicit credentials
     shell copy

     syft registry:my-registry.io/my-image --username myuser --password mypass

     • --dir flag allows explicitly passing a directory to syft
     • Registry credential fields now require both username and password
     • Adds secrets cataloger to detect secrets in scanned images/filesystems
     • Adds Rust crates cataloging from Cargo.lock files
     • Adds binary package identification capability

     +4 more show less

     • Adds file metadata cataloger for extracting file-level attributes
     • Enables pulling container images directly from a registry without local load
     • Reports package database verification metadata in output
     • Improves CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. generation with hyphen replacement logic and Jenkins package type categorization by groupId

     9 details in Everything

146. v0.14.0 Mar 20, 2021 · release notes

     Syft v0.14.0 adds Photon OS and distroless image identification support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.14.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.14.0

     • Added Photon OS to the list of supported distros for inventory
     • Added detection capability for distroless container images

     2 details in Everything

147. v0.13.0 Feb 25, 2021 · release notes

     Adds relationships and ownership-by-file-overlap detection for package analysis

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.13.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.13.0

     • Adds support for extracting relationships in the output catalog to show how packages are related.
     • Adds ownership-by-file-overlap relationship type, linking packages that share file paths.

     2 details in Everything

148. v0.11.0 Dec 18, 2020 · release notes

     syft v0.11.0 adds --overwrite flag and Anchore Engine upload integration

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.11.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.11.0

     • Enables uploading SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. results directly to Anchore Engine via a new built-in integration

     1 detail in Everything

149. v0.10.0 Dec 10, 2020 · release notes

     v0.10.0 adds registry manifest/digest to JSON output and Anchore Engine upload support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.10.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.10.0

     • Include raw or computed manifest and digest fields in JSON output for registries that provide them.
     • Add built-in capability to upload SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. results directly to an Anchore Engine instance.

     2 details in Everything

150. v0.9.1 Dec 2, 2020 · release notes

     Syft v0.9.1 adds CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. population from Maven POM GroupId elements

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.9.1 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.9.1

     • Includes Common Platform Enumerations (CPEs) for Java packages by extracting elements from Maven POM GroupId fields

     1 detail in Everything

151. v0.9.0 Nov 30, 2020 · release notes

     Syft v0.9.0 adds JSON schema generation for its struct definitions

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.9.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.9.0

152. v0.8.0 Nov 17, 2020 · release notes

     Adds JSON document import for Syft

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.8.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.8.0

     • Add JSON document import

     1 detail in Everything

153. v0.7.0 Nov 11, 2020 · release notes

     Adds ID_LIKE to distro info and distro/version fields to JSON output

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.7.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.7.0

     └──▷ USE IT
     Access the full distro identification string including sibling distributions from the JSON catalog.
     shell copy

     syft -o json <target> | jq '.distro'

     • Includes ID_LIKE field when parsing distro information for more accurate base OS identification
     • Adds distro.name and distro.version fields to the JSON presenter output

     2 details in Everything

154. v0.6.0 Nov 10, 2020 · release notes

     Syft v0.6.0 adds identified distro metadata to JSON output and RPM DB file info

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.6.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.6.0

     • Adds identified distro and version to JSON presenter output via --by-distro or default JSON fields for the scanned image
     • Adds RPM file info sourced from the RPM database, including source package details in software cataloging

     2 details in Everything

155. v0.5.0 Oct 30, 2020 · release notes

     Syft v0.5.0 adds Java/npm to inline comparison

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.5.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.5.0

     • Add java/npm to inline comparison

     1 detail in Everything

156. v0.4.0 Oct 23, 2020 · release notes

     Adds python cataloger image/directory support and package.json detection in syft v0.4.0

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.4.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.4.0

157. v0.2.0 Oct 8, 2020 · release notes

     Syft v0.2.0 adds native support for cataloging Ruby gemspec files

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.2.0 https://github.com/anchore/syft.git
     # already have the repo? check out this version:
     $ git checkout v0.2.0

     • gemspec file cataloging support enables scanning Ruby dependencies defined via .gemspec manifests, expanding coverage beyond standard Gemfile.lock parsing.

     1 detail in Everything