v1.29.0

Added Features

• Catalog python uv.lock files [#3268 #3763 @jkugler]

Additional Changes

• Pkg Metadata type unmarshal bug [#4043 @houdini91]

(Full Changelog)

v1.28.0

Added Features

• add native support for snap packages [#1088 #3929 @wagoodman]

Additional Changes

• upgrade tablewriter dependency to use new API [#3990 @cpanato]

(Full Changelog)

v1.27.1

Bug Fixes

• Allow decoding of enterprise-modified anchorectl json files [#3997 @wagoodman]
• Allow decoding of anchorectl json files [#3973 @wagoodman]

Additional Changes

• provide separate nonroot image [#3998 @kzantow]

(Full Changelog)

v1.27.0

Added Features

• add syft schema version to version command [#3949 @spiffcs]

Bug Fixes

• Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#3967 @jayvdb]
• Remove CPE product candidates for opentelemetry and redis Rust crates [#3962 @jayvdb]
• Harden Container Runtime with Non-Root User [#3941 @MikeTheCyberGuy]
• terraform provider lock entries should not require constraints [#3934 @ghouscht]
• sbom cataloger returning upstream package [#3662 #3981 @kzantow]
• Syft missing md5 sums and list data for dpkg packages under status.d/ [#3912]
• Failure to detect dependency relationships between Python packages [#3958 #3965 @christoph-blessing]
• Heavy memory consumption when directory scanning deb source [#3928 #3953 @kzantow]
• In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#3942 #3944 @kzantow]
• Syft incorrectly reports multiple APKs as parents of symlinked files [#3847 #3923 @luhring]

(Full Changelog)

A HUGE thank you to @rezmoss for his help identifying and solving an issue causing excessive time and memory consumption with large numbers of symlinks! ❤️

v1.26.1

Bug Fixes

• Dotnet deps binary cataloger hangs [#3919 #3930 @kzantow]

(Full Changelog)

v1.26.0

Added Features

• Read version resources from non-.NET DLLs and executables [#3842 #3911 @wagoodman]

Bug Fixes

• pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#3922 @wagoodman]
• syft 1.24.0 debug container - wget fails TLS [#3891 #3915 @spiffcs]

(Full Changelog)

v1.25.1

Additional Changes

• remove go-rpmdb replace directive [#3908 @wagoodman]

(Full Changelog)

v1.25.0

Added Features

• Add PHP interpreter + extensions cataloger [#2585 @LaurentGoderre]

Bug Fixes

• update license content filtering default case to be 'none' for no content [#3903 @spiffcs]
• Distinguish openjdk vs jdk when using file source [#3895 @adammcclenaghan]
• Make it discoverable if Native Image contains no embedded SBOM [#3731 #3805 @sathiya06]

(Full Changelog)

v1.24.0

Added Features

• Add cataloger for Dart pubspec [#3292 @LaurentGoderre]
• Translate Portage license strings to SPDX expressions [#1763 @wagoodman]
• Use package ID from decoded SBOMs when provided [#1872 @jneate]
• Annotate visible/hidden paths when all-layers scope [#3855 @wagoodman]
• Add support for PHP Pear [#2775 @LaurentGoderre]
• Detect whether full license text or a license name has been provided [#3088 #3876 @spiffcs #3450 @spiffcs]
• Add Cataloger for Homebrew on macOS [#3632 #3724 @rezmoss]
• Provide a way to get the LayerID the package was first found in [#435 #3858 @wagoodman #3138 @tomersein]
• Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#3324 #3873 @wagoodman]
• Upgrade base Docker image to gcr.io/distroless/static-debian12 [#3840 #3862 @bgoareguer]
• Return full license string instead of SHA256 hash when license string exceeds 64 characters [#3780 #3844 @spiffcs]
• Detect nix dependencies [#3814 #3837 @wagoodman]

Bug Fixes

• update license sort to be stable with contents field [#3860 @spiffcs]
• Improve detection of erlang binary in alpine Linux [#3839 @avodotiiets]
• Do not search for main module versions within binary contents by default [#3874 @wagoodman]
• dpkg license improvement for non SPDX licenses [#3090 #3888 @spiffcs]
• CycloneDX group field not symmetrically handled by encoder/decoders [#2981 #3853 @kzantow]
• Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#3872 #3875 @wagoodman]
• Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#3864]
• .NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#3866 #3869 @wagoodman]
• Propagate error in FileSourceProvider instead of warn log [#3831 #3845 @Rupikz]
• Update github.com/Masterminds/semver package [#3829 #3836 @popey]
• go-module-file-cataloger fails if symlinks in path [#3614 #3783 @VictorHuu]
• Support fluent-bit some versions of arm/s390x images [#3793 #3817 @VictorHuu]

Additional Changes

• update rust test fixtures to latest [#3852 @spiffcs]

(Full Changelog)

v1.23.1

Additional Changes

• Resolve owned file paths when searching for overlaps [#3828 @wagoodman]

(Full Changelog)