https://cybertoolchain.io/tools/syft New releases and features in syft, tracked by The Cyber Toolchain. en Mon, 19 Oct 2026 19:01:26 GMT https://github.com/anchore/syft/releases/tag/v1.55.0 https://github.com/anchore/syft/releases/tag/v1.55.0 Mon, 19 Oct 2026 19:01:26 GMT Syft v1.55.0 adds IPK package scanning via the deb-archive-cataloger.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds support for scanning IPK packages using the `deb-archive-cataloger`.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.54.0 https://github.com/anchore/syft/releases/tag/v1.54.0 Thu, 01 Oct 2026 20:54:29 GMT syft v1.54.0 adds a Perl ecosystem cataloger, reports the Perl interpreter as a CPAN package, and supports non-daemon Podman analysis.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a new package cataloger for the Perl ecosystem (CPAN), enabling SBOM generation for Perl projects.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Reports the Perl interpreter itself as a CPAN package in generated SBOMs. • Supports scanning container images via non-daemon Podman (daemonless mode). Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.52.0 https://github.com/anchore/syft/releases/tag/v1.52.0 Thu, 17 Sep 2026 14:38:17 GMT Syft v1.52.0 adds passthrough-exact-format to copy matching syft-json input to output unchanged.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `passthrough-exact-format` output format that copies a matching `syft-json` input document to output byte-for-byte without re-encoding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.51.0 https://github.com/anchore/syft/releases/tag/v1.51.0 Mon, 10 Aug 2026 14:55:18 GMT Syft v1.51.0 adds native Go FIPS 140 mode detection in binaries and extended stdlib scope for symbol capture. • Detects native Go FIPS 140 mode in scanned binaries, surfacing FIPS compliance status in generated SBOMs. • Adds `extended-stdlib` scope and expanded module patterns for symbol capture, improving Go binary analysis coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.50.0 https://github.com/anchore/syft/releases/tag/v1.50.0 Tue, 28 Jul 2026 17:44:08 GMT Syft v1.50.0 adds a Bun binary classifier for detecting the Bun JavaScript runtime in SBOMs. • Adds a binary classifier for the Bun JavaScript runtime, enabling Syft to detect and catalog Bun in container images and filesystems. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.49.0 https://github.com/anchore/syft/releases/tag/v1.49.0 Tue, 21 Jul 2026 13:16:54 GMT Syft v1.49.0 adds support for OCI image index manifests in root OCI layouts. • Supports `application/vnd.oci.image.index.v1+json` manifests in root OCI layout directories, enabling SBOM generation from multi-platform OCI index artifacts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.48.0 https://github.com/anchore/syft/releases/tag/v1.48.0 Thu, 16 Jul 2026 14:47:52 GMT Syft v1.48.0 adds vcpkg, macOS .app, Kerberos 5, SafeTensor, and Ubuntu Pro/ESM cataloging plus Go binary symbol capture. • Adds dependency relationship edges from `mix.lock` to SBOM output. • Adds SafeTensor model type cataloging to SBOM output for ML model inventories. • Captures symbols from Go binaries for richer binary-level SBOM data. • Detects Ubuntu Pro/ESM extended support status on scanned systems. • Adds a scan duration timer to Syft output. • Adds support for `vcpkg` C/C++ package manager cataloging. • Adds a macOS `.app` bundle cataloger to inventory native macOS applications. • Adds support for Kerberos 5 library cataloging. • Includes the date of scan in SBOM results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.46.0 https://github.com/anchore/syft/releases/tag/v1.46.0 Fri, 26 Jun 2026 09:45:12 GMT syft v1.46.0 adds SPDX 3, Deno, Bun lockfile, Elastic agent/Beats support, uv PEP 723 lockfiles, and .bpl PE cataloging. • Supports SPDX 3 as an output format for SBOMs. • Adds Deno dependency cataloging support. • Adds support for Bun lockfile (`bun.lock`) in the JavaScript cataloger. • Catalogs Elastic Agent and Elastic Beats binaries with new binary classifiers. • Detects uv PEP 723 script lockfiles (`*.py.lock`) with the Python cataloger. • Adds `.bpl` file support to the PE / DLL cataloger. • Adds PURL types to the `cataloger info` command output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.46.0 https://github.com/anchore/syft/releases/tag/v1.46.0 Fri, 26 Jun 2026 09:45:12 GMT Syft v1.46.0 adds SPDX 3, Deno, Bun lockfile, uv PEP 723, Elastic agent/Beats support, and purl types in cataloger info. • Adds SPDX 3 output format support, enabling generation of SPDX 3-compliant SBOMs. • Adds Deno ecosystem support, cataloging Deno dependencies from projects. • Supports Bun lockfile (`bun.lock`) parsing for JavaScript/TypeScript projects using Bun. • Supports uv PEP 723 script lockfiles (`*.py.lock`) in the Python cataloger. • Adds binary classifiers and cataloging for Elastic Agent and Elastic Beats binaries. • Adds `.bpl` file support to the PE/DLL cataloger for broader Windows binary coverage. • Adds PURL types to the `cataloger info` command output for richer cataloger metadata. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.45.0 https://github.com/anchore/syft/releases/tag/v1.45.0 Tue, 02 Jun 2026 20:32:58 GMT syft v1.45.0 adds ZapAddOn JAR support, ingress-nginx binary cataloging, and MySQL Cluster detection. • Supports ZapAddOns packaged as JAR files for SBOM cataloging. • Catalogs the ingress-nginx binary as a distinct component. • Distinguishes between MySQL Cluster (ndb) and standard MySQL when classifying MySQL binaries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.45.0 https://github.com/anchore/syft/releases/tag/v1.45.0 Tue, 02 Jun 2026 20:32:58 GMT Syft v1.45.0 adds ZapAddOns JAR cataloging, ingress-nginx binary detection, and MySQL Cluster/MySQL distinction. • Supports ZapAddOns packaged as JAR files, enabling SBOM generation for OWASP ZAP plugin artifacts. • Catalogs ingress-nginx binaries, adding the popular Kubernetes ingress controller to binary detection coverage. • Distinguishes MySQL Cluster (ndb) from standard MySQL in the binary classifier, reducing misidentification in SBOM output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.43.0 https://github.com/anchore/syft/releases/tag/v1.43.0 Wed, 22 Apr 2026 15:59:57 GMT syft v1.43.0 adds Deno binary classifiers, OpenLDAP detection, and expanded Haskell/Erlang version support. • Adds Deno binary classifiers for detecting Deno runtime packages. • Adds OpenLDAP binary detection support. • Supports cataloging older Haskell package versions. • Supports cataloging older Erlang package versions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.42.0 https://github.com/anchore/syft/releases/tag/v1.42.0 Tue, 10 Feb 2026 17:39:42 GMT syft v1.42.0 adds GGUF model scanning from OCI registries and captures yarn dev dependencies • Supports scanning GGUF (AI model) files directly from OCI registries. • Detects dev dependencies in yarn lockfiles, which were previously missed. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.41.0 https://github.com/anchore/syft/releases/tag/v1.41.0 Tue, 27 Jan 2026 11:07:53 GMT Syft v1.41.0 detects Debian version from /etc/debian_version for more accurate OS identification. • Detects Debian OS version from /etc/debian_version, improving distro identification in Debian-based images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.40.0 https://github.com/anchore/syft/releases/tag/v1.40.0 Thu, 08 Jan 2026 12:49:55 GMT syft v1.40.0 adds binary cataloging for Istio, Envoy, Grafana, and Valkey, plus PNPM dev-dependency filtering. • Supports filtering out development and test dependencies for PNPM packages from the generated SBOM. • Catalogs Istio binaries (pilot-discovery, pilot-agent) for version detection. • Catalogs Envoy binary for version detection. • Catalogs Grafana binary for version detection. • Adds a binary classifier for Valkey to detect its version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.39.0 https://github.com/anchore/syft/releases/tag/v1.39.0 Mon, 22 Dec 2025 21:15:15 GMT syft v1.39.0 adds Gemfile.next.lock support, richer cataloger info output, UPX-compressed Go binary scanning, snap revision pinning, and .NET single-file dep detection. • Supports `Gemfile.next.lock` as a dependency manifest source for Ruby projects. • Enriches `syft catalogers` command output with details on what each cataloger looks for and what it can find. • Supports reading LZMA-compressed `.go.buildinfo` sections in UPX-packed binaries. • Enables specifying a specific snap revision when pulling a snap for scanning. • Detects embedded `deps.json` metadata inside single-file .NET binaries. • ELF note cataloger now captures the OS field from ELF notes. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.38.0 https://github.com/anchore/syft/releases/tag/v1.38.0 Mon, 17 Nov 2025 17:55:51 GMT syft v1.38.0 adds GGUF AI model cataloging, CPE list scanning, Elixir binary detection, PyPI license enrichment, and license file search. • Catalogs GGUF model files, enabling SBOM generation for AI/ML models stored in the GGUF format. • Supports scanning a user-supplied list of CPEs, allowing targeted vulnerability surface analysis beyond auto-detected packages. • Detects Elixir binaries installed on the system, expanding language runtime coverage. • Enriches Python package license metadata by querying PyPI, improving license compliance accuracy. • Adds license file search capability to surface license artifacts during cataloging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.37.0 https://github.com/anchore/syft/releases/tag/v1.37.0 Mon, 03 Nov 2025 18:26:45 GMT Syft v1.37.0 adds support for .far and .rar Java resource adapter archive formats. • Supports `.far` (Java resource adapter extension) as a recognized Java archive type for cataloging. • Supports `.rar` (Java resource adapter extension) as a recognized Java archive type for cataloging. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.36.0 https://github.com/anchore/syft/releases/tag/v1.36.0 Wed, 22 Oct 2025 20:21:18 GMT syft v1.36.0 adds remote license fetching for pnpm, universal macOS binary support, and PDM package manager support. • Fetches remote licenses for packages declared in pnpm-lock.yaml files. • Supports universal (fat) Mach-O binaries for multi-architecture macOS scanning. • Adds support for PDM (Python Dependency Manager) project files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.34.1 https://github.com/anchore/syft/releases/tag/v1.34.1 Wed, 15 Oct 2025 15:43:12 GMT Syft v1.34.1 adds ffmpeg/libav detection, pnpm v9 lockfile support, and Windows ARM64 releases. • Detects ffmpeg and libav libraries when generating SBOMs. • Supports pnpm lockfile version 9.0 for JavaScript dependency scanning. • Publishes official Windows ARM64 release binaries. • Handles unquoted dependencies in setup.py when cataloging Python packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.32.0 https://github.com/anchore/syft/releases/tag/v1.32.0 Tue, 26 Aug 2025 21:59:31 GMT Syft v1.32.0 adds full Go build list cataloging, package.json author parsing, and basic Conda ecosystem support. • Catalogs the entire Go build list (not just go.mod-listed packages), surfacing transitive dependencies in SBOMs. • Parses the `authors` keyword from package.json, enriching Node.js package metadata. • Adds basic Conda ecosystem support, enabling SBOM generation for Conda environments. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.31.0 https://github.com/anchore/syft/releases/tag/v1.31.0 Wed, 13 Aug 2025 15:04:57 GMT Syft v1.31.0 adds the ability to set a PackageSupplier field in the root of SPDX documents. • Adds option to set `PackageSupplier` in the root of generated SPDX documents via the CLI. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.30.0 https://github.com/anchore/syft/releases/tag/v1.30.0 Fri, 08 Aug 2025 18:32:55 GMT Syft v1.30.0 adds a binary classifier for HashiCorp Vault. • Adds binary classifier for HashiCorp Vault, enabling detection of Vault installations in SBOM scans. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.29.0 https://github.com/anchore/syft/releases/tag/v1.29.0 Mon, 21 Jul 2025 19:49:39 GMT Syft v1.29.0 adds support for cataloging Python uv.lock files. • Catalogs Python `uv.lock` files, enabling SBOM generation for projects managed with the uv package manager. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.28.0 https://github.com/anchore/syft/releases/tag/v1.28.0 Wed, 02 Jul 2025 16:35:53 GMT Syft v1.28.0 adds native support for cataloging Snap packages. • Adds native support for Snap packages, enabling Syft to catalog snaps in SBOMs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.27.0 https://github.com/anchore/syft/releases/tag/v1.27.0 Mon, 09 Jun 2025 18:45:20 GMT Syft v1.27.0 adds the current schema version to the `syft version` command output. • Adds Syft schema version to the output of the `version` command for quick schema identification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.26.0 https://github.com/anchore/syft/releases/tag/v1.26.0 Tue, 20 May 2025 21:35:14 GMT Syft v1.26.0 extracts version resources from non-.NET DLLs and executables for broader Windows binary coverage. • Reads version resources from non-.NET Windows DLLs and executables, expanding package detection beyond .NET binaries. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.25.0 https://github.com/anchore/syft/releases/tag/v1.25.0 Fri, 16 May 2025 16:37:39 GMT Syft v1.25.0 adds a PHP interpreter and extensions cataloger for richer PHP SBOM coverage. • Adds PHP interpreter and extensions cataloger to enumerate PHP runtime and installed extensions in SBOMs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.24.0 https://github.com/anchore/syft/releases/tag/v1.24.0 Wed, 14 May 2025 15:01:54 GMT syft v1.24.0 adds Dart, PHP Pear, Homebrew, and Nix catalogers plus richer layer and license metadata. • New Dart pubspec cataloger for inventorying Dart/Flutter dependencies. • New PHP Pear cataloger for PHP PEAR package detection. • New Homebrew cataloger for macOS Homebrew-installed packages. • New Nix dependency detection cataloger. • Portage license strings are now translated to SPDX expressions. • Detects whether a full license text or a license name was provided, improving license classification accuracy. • Returns full license string instead of a SHA256 hash when the license string exceeds 64 characters. • Annotates visible/hidden paths when scanning with all-layers scope. • Exposes the LayerID in which a package was first found, enabling layer-level provenance tracking. • Go binaries that previously received (devel) as a version now report `UNKNOWN` per compliance policy. • Preserves original package IDs from decoded SBOMs when available, maintaining ID continuity in SBOM round-trips. • Base Docker image upgraded to `gcr.io/distroless/static-debian12`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.23.0 https://github.com/anchore/syft/releases/tag/v1.23.0 Thu, 24 Apr 2025 20:24:15 GMT syft v1.23.0 adds Chrome binary detection, libman JS assets, R cataloger in dir scans, and undeclared Python license file detection. • Supports skipping archive extraction when using a file source. • Enables the R cataloger during directory scans (previously limited to image scans). • Detects JavaScript assets in .NET projects via libman (`library.json`). • Parses GitHub Actions workflow comments to surface action dependencies. • Detects Chrome browser binaries as catalogued packages. • Detects undeclared license files when scanning Python installations. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.22.0 https://github.com/anchore/syft/releases/tag/v1.22.0 Tue, 01 Apr 2025 14:46:03 GMT syft v1.22.0 adds direct .deb archive cataloging and improved .NET CPE generation • Catalogs `.deb` archives directly, enabling SBOM generation from standalone Debian packages without a full dpkg database. • Improves CPE generation for .NET packages for more accurate vulnerability matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.21.0 https://github.com/anchore/syft/releases/tag/v1.21.0 Mon, 17 Mar 2025 19:00:39 GMT syft v1.21.0 adds GraalVM Native Image symbol extraction and fluent-bit 1.7.0 dev/rc support • Extracts symbols from the `.dynsym` section of GraalVM Native Image binaries for richer SBOM component data. • Supports fluent-bit 1.7.0 development and release-candidate package versions in SBOM generation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.20.0 https://github.com/anchore/syft/releases/tag/v1.20.0 Fri, 21 Feb 2025 20:52:55 GMT syft v1.20.0 adds file cataloger selection config, license content inclusion in SBOMs, and Bitnami embedded SBOM support. • Adds file catalogers to the selection configuration, giving users explicit control over which file catalogers run. • New configuration option to include full license contents (not just identifiers) in generated SBOMs. • Supports Bitnami embedded SBOMs, enabling syft to ingest and surface pre-existing SBOM data from Bitnami container images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.19.0 https://github.com/anchore/syft/releases/tag/v1.19.0 Wed, 22 Jan 2025 20:04:58 GMT Syft v1.19.0 adds NuGet package cataloging and license parsing from vendor directories. • Adds license parsing from vendor directories, improving license detection coverage for vendored dependencies. • Supports cataloging NuGet packages, enabling SBOM generation for .NET ecosystems. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.18.0 https://github.com/anchore/syft/releases/tag/v1.18.0 Mon, 09 Dec 2024 21:09:46 GMT syft v1.18.0 adds Rust audit binary relationships, configurable layer size, Dart arm/v7 support, and SPDX path normalization. • Adds dependency relationships for Rust audit binary packages in generated SBOMs. • Supports configuration of image layer size reporting in syft. • Supports Dart arm/v7 architecture for both Dart SDK 2.x and 3.x. • Converts SPDX absolute paths to relative paths in SPDX output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.17.0 https://github.com/anchore/syft/releases/tag/v1.17.0 Thu, 21 Nov 2024 14:46:36 GMT Syft v1.17.0 adds Rust dependency relationships and Node 6.x support to SBOM generation. • Surfaces Rust dependency relationships in generated SBOMs. • Supports scanning Node.js 6.x package manifests. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.16.0 https://github.com/anchore/syft/releases/tag/v1.16.0 Mon, 04 Nov 2024 22:36:23 GMT Syft v1.16.0 omits devDependencies from package-lock.json SBOMs by default for cleaner production inventories. • Omits devDependencies from package-lock.json files by default, reducing noise in production SBOMs. Breaking changes: • package-lock.json scanning no longer includes devDependencies by default; SBOMs generated from projects with devDependencies will contain fewer packages than in v1.15.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.15.0 https://github.com/anchore/syft/releases/tag/v1.15.0 Mon, 28 Oct 2024 21:18:43 GMT syft v1.15.0 adds config profiles, cargo-auditable binary scanning, Java dependency relationships, and broader dpkg/MariaDB detection. • Supports hierarchical config file merging and named config profiles for managing multiple scan configurations. • Enables the cargo-auditable-binary-cataloger for scanning files and directories (previously container-only). • Detects older MariaDB versions via an improved binary classifier. • Discovers dpkg status files at additional glob paths for broader Debian package detection. • Emits dependency relationships for Java packages in the SBOM output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.14.0 https://github.com/anchore/syft/releases/tag/v1.14.0 Mon, 07 Oct 2024 20:48:38 GMT Syft v1.14.0 adds known-unknowns reporting to SBOMs and expands distro detection for HAProxy, Redis, Node, and Ruby. • Reports known unknowns (unidentified components) directly in the output SBOM for greater visibility into coverage gaps. • Identifies `bash.preinst` as a cataloged artifact. • Supports HAProxy release-candidate and older version identifiers. • Supports Redis on arm/v5, arm/v7, and 386 architectures across versions 7.2, 7.4, and 8.0. • Supports identification of older Node.js versions. • Supports rubylang/ruby dev, rc, and preview version identifiers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.13.0 https://github.com/anchore/syft/releases/tag/v1.13.0 Tue, 24 Sep 2024 13:35:48 GMT Syft v1.13.0 adds a data enrichment flag, Dart support, seven new binary classifiers, and richer JVM/JDK cataloging. • New `--enrich` flag enables opt-in data enrichment when generating SBOMs. • Adds Dart language classifier for detecting Dart binaries. • Adds binary classifiers for lighttpd, proftpd, zstd, xz, gzip, jq, and SQLCipher. • Catalogs JDK installations more completely, including richer metadata for JVM installations. • Stubs unknown package versions instead of dropping packages from the SBOM. • Supports scanning bitnami/mysql:8.x images. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.12.2 https://github.com/anchore/syft/releases/tag/v1.12.2 Wed, 11 Sep 2024 14:20:08 GMT syft v1.12.2 adds curl, Haskell, OCaml, and HAProxy binary detection to SBOM cataloging. • Detects curl binaries as cataloged packages in SBOMs. • New Haskell binaries cataloger identifies Haskell ecosystem components. • Adds OCaml ecosystem support for cataloging OCaml packages. • Supports HAProxy dev builds for binary-level SBOM detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.11.0 https://github.com/anchore/syft/releases/tag/v1.11.0 Fri, 09 Aug 2024 18:00:27 GMT syft v1.11.0 adds SWI Prolog ecosystem support and improves Java cataloging accuracy • Adds SWI Prolog (swipl) ecosystem cataloging support. • Improves Java cataloging with better multi-level parent POM resolution, DependencyManagement support, and cycle detection. • Updates PackageSupplier to type Organization for JAR files in SBOM output. • Improves main artifact name retrieval accuracy for multi-JAR packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.10.0 https://github.com/anchore/syft/releases/tag/v1.10.0 Tue, 30 Jul 2024 16:20:36 GMT Syft v1.10.0 adds TiDB binary cataloging, Maven CPE generation, Go main module detection, and ARM/RISC-V Traefik support. • Detects Go main module from partial package builds, improving SBOM accuracy for incomplete build artifacts. • Supports Traefik binary cataloging on linux/arm/v6 and linux/riscv64 architectures. • Catalogs TiDB binaries as a new supported package type. • Generates Maven-friendly CPEs for Java packages, improving compatibility with Maven-based vulnerability matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.9.0 https://github.com/anchore/syft/releases/tag/v1.9.0 Thu, 11 Jul 2024 17:39:39 GMT Syft v1.9.0 adds Erlang detection on Alpine, Swift package manager V3 support, and PHP Composer downloadLocation mapping. • Add detection of Erlang in Alpine linux • Add version 3 support for swift package manager of the resolved files • Map the downloadLocation field for PHP Composer packages Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.8.0 https://github.com/anchore/syft/releases/tag/v1.8.0 Mon, 24 Jun 2024 15:51:42 GMT Syft v1.8.0 adds CycloneDX 1.6 support • Adds CycloneDX 1.6 as a supported output format Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.7.0 https://github.com/anchore/syft/releases/tag/v1.7.0 Fri, 14 Jun 2024 19:55:49 GMT Syft v1.7.0 adds CPE generation for WordPress plugins and themes. • Adds indexing of known CPEs for WordPress plugins and themes to improve package identification coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.6.0 https://github.com/anchore/syft/releases/tag/v1.6.0 Mon, 10 Jun 2024 15:47:47 GMT Syft v1.6.0 adds go binary package relationship detection, util-linux classification, and license metadata for ELF packages. • Adds relationships for go binary packages to expose dependency links in the SBOM • Adds classifier for util-linux to correctly identify util-linux library packages • Adds support for more advanced Lua syntax in license detection logic • Adds `license` field to ELF binary package metadata extraction Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.5.0 https://github.com/anchore/syft/releases/tag/v1.5.0 Tue, 28 May 2024 15:19:31 GMT Adds `syft config` command, new package relationships (SPDX, RPM DB, Python wheel eggs), and fluent-bit detection • Introduces the `syft config` command for managing tool configuration • Add abstraction for adding relationships from package cataloger results • Capture dependencies when parsing SPDX SBOMs • Add support for RPM DB package relationships • Detect fluent-bit binaries Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.3.0 https://github.com/anchore/syft/releases/tag/v1.3.0 Fri, 26 Apr 2024 15:08:18 GMT Syft v1.3.0 adds known CPE indexing for Go modules and PHP packages to enhance SBOM accuracy. • Index known Common Platform Enumerations (CPEs) for go modules • Support multiple known CPEs per package in the index • Index known CPEs for PHP Composer packagist.org packages • Index known CPEs for PHP extensions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft https://github.com/anchore/syft/releases/tag/v1.2.0 https://github.com/anchore/syft/releases/tag/v1.2.0 Fri, 12 Apr 2024 18:39:13 GMT syft v1.2.0 adds JRE/JDK differentiation and dnf package support • Adds `jre` and `jdk` package type differentiation for Java runtime environments • Adds support for cataloging `dnf` packages from Red Hat-based distributions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/syft