openSUSE-SU-2026:20928-1

Описание

This update for syft fixes the following issues:

Changes in syft:

• Update to version 1.45.0:

  • Added Features
    • Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke]
    • MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
    • Catalog ingress-nginx binary [#4818 #4857 @witchcraze]
  • Bug Fixes
    • Support helm binary various versions [#4820 #4922 @witchcraze]
    • Support julia binary various versions [#4867 #4945 @witchcraze]
    • Support deno binary old versions [#4865 #4939 @witchcraze]
    • Compressed kernel modules are not scanned by the linux-kernel-cataloger [#4721 #4740 @will-bates11]
    • Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#4691 #4838 @calumleslie]
    • Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882 @witchcraze]
    • Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
    • Exclude path ending with a slash are discarded [#4839 #4892 @ChrisJr404]
    • Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
    • fix parsing of debian/copyright files [#4708 #4754 @Bahtya]
    • Grype ignores python requirements in arbitrary equality (===) format [#4834 #4835 @cyphercodes]
    • valkey is detected as both of valkey and redis [#4591 #4619 @witchcraze]
    • TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#4837 #4848 @ChrisJr404]
  • Additional Changes
    • hoist name normalization regexp to package level [#4926 @matiasinsaurralde]
    • bump the actions-minor-patch group across 1 directory with 6 updates [#4946 @dependabot]
    • bump the actions-minor-patch group across 2 directories with 2 updates [#4936 @dependabot]
    • bump the actions-minor-patch group across 1 directory with 4 updates [#4927 @dependabot]
    • bump the actions-minor-patch group across 1 directory with 2 updates [#4920 @dependabot]
    • bump the actions-minor-patch group across 1 directory with 2 updates [#4897 @dependabot]
    • update CPE dictionary index [#4831 @anchore-oss-update-bot]
  • Dependencies
    • chore(deps): bump github.com/containerd/containerd/v2 (#4935)
    • chore(deps): update anchore dependencies (#4821)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#4930)
    • chore(deps): update CPE dictionary index (#4925)
    • chore(deps): update CPE dictionary index (#4909)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#4911)

• Update to version 1.44.0:

  • Added Features
    • Add support for linux-riscv64 [#4757 @luhenry]
  • Bug Fixes
    • Yarn lockfile cataloguing does not handle aliases [#4833 #4836 @cyphercodes]
    • Some snippet files are saved in the previous test directory [#4829 #4830 @witchcraze]
    • empty rockspec causes index out of range [#4824 #4827 @aki1770-del]
    • PE cataloger shows asp.net core ref assemblies using fileversion build stamp instead of productversion [#4813 #4814 @rezmoss]
    • Syft safeCopy silently swallows archive decompression errors [#4806 #4807 @SAY-5]

• Update to version 1.43.0:

  • Added Features
    • added deno bin classifiers [#4677 @rezmoss]
    • Support haskell old versions [#3237 #4793 @witchcraze]
    • Add support for OpenLDAP binary detection [#4768 #4755 @nadimz]
    • Support erlang ols versions [#3235 #4766 @witchcraze]
  • Bug Fixes
    • improve redhat-release parsing fallback for RHEL clones [#4808 @westonsteimel]
    • fix format string in search results struct [#4775 @willmurphyscode]
    • prevent infinite recursion in Document.UnmarshalJSON with encoding/json/v2 [#4748 @benja-M-1]
    • Syft can not complete scanning golang image [#4686]
    • javascript-package-cataloger drops entire package.json when authors/contributors/maintainers is a single string [#4778 #4779 @yoav-orca]
    • pnpm lock file cataloger produces unstable output [#4648 #4765 @lawrence3699]
    • Linux Kernel bzImage and zImage not cataloged by linux-kernel-cataloger [#4769 #4751 @nadimz]
    • Support istio binary (pilot-discovery, pilot-agent) alpha,beta,rc,dev version [#4546 #4645 @witchcraze]
    • Scanning mounted ISO: duplicate entries [#4759]
  • Additional Changes
    • update CPE dictionary index [#4767 @anchore-oss-update-bot]
  • Dependencies
    • chore(deps): update anchore dependencies (#4797)
    • chore(deps): restore Go version to 1.25.8 (#4804)
    • chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4790)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.18.0 (#4792)
    • chore(deps): update Go version (#4798)
    • chore(deps): update tools to latest versions (#4701)
    • chore(deps): update Go version (#4773)
    • chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#4750)
    • chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#4752)
    • chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#4737)
    • chore(deps): bump the actions-minor-patch group across 2 directories with 7 updates (#4763)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#4764)
    • chore(deps): update CPE dictionary index (#4767)

• Update to version 1.42.4:

  • Bug Fixes
    • Similar Packages Should Be Aggregated [#1162]
    • Support arangodb binary recent version [#4571 #4662 @witchcraze]
    • Support go binary various versions [#4687 #4694 @kzantow]
  • Additional Changes
    • update CPE dictionary index [#4745 @anchore-oss-update-bot]
    • update CPE dictionary index [#4726 @anchore-oss-update-bot]
    • Add a trust boundary section [#4716 @joshbressers]
  • Dependencies
    • chore(deps): update CPE dictionary index (#4745)
    • chore(deps): update CPE dictionary index (#4726)
    • chore(deps): update CPE dictionary index (#4715)
    • chore(deps): update tool versions (#4706)
    • chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 (#4684)
    • chore(deps): bump marocchino/sticky-pull-request-comment (#4685)
    • chore(deps): bump the go-minor-patch group with 2 updates (#4697)
    • chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 (#4699)
    • chore(deps): update CPE dictionary index (#4689)
    • chore(deps): ignore some dependabot deps (#4696)
    • chore(deps): update tools to latest versions (#4690)

• Update to version 1.42.3:

  • Bug Fixes
    • Missing secondary evidence for .NET dependency in ghcr.io/open-telemetry/demo:2.0.0-accounting image [#4652]
  • Additional Changes
    • centralize temp files and prefer streaming IO [#4668 @willmurphyscode]
    • chore(deps): update anchore dependencies (#4681)
    • chore(deps): bump github.com/buger/jsonsparser to v1.1.2 (#4680)
    • chore(deps): bump the go-minor-patch group with 2 updates (#4678)
    • chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#4675)
    • chore(deps): bump the go-minor-patch group with 2 updates (#4674)
    • chore(deps): update tools to latest versions (#4663)
    • chore(deps): bump the go-minor-patch group with 3 updates (#4669)
    • chore(deps): bump github/codeql-action (#4670)
    • chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#4671)
    • chore(deps): update CPE dictionary index (#4673)
    • chore(tests): fix test fixture build on modern ARM Mac (#4666)

• Update to version 1.42.2:

  • Bug Fixes
    • [BUG] Incorrect Maven PURL generation: Automatic-Module-Name should not be used as Maven groupId [#4611 #4642 @xnox]
    • Checksum is 0 for spdx files [#2307 #4620 @ppalucha]
    • Support grafana binary various versions [#4559 #4635 @witchcraze]
  • Additional Changes
    • migrate fixtures to testdata [#4651 @wagoodman]
  • Dependencies
    • chore(deps): update anchore dependencies (#4631)
    • chore(deps): update tools to latest versions (#4630)
    • chore(deps): update SPDX license list (#4637)
    • chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 (#4658)
    • chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#4638)
    • chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates (#4657)
    • chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#4659)
    • chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#4646)
    • chore(deps): update CPE dictionary index (#4647)
    • chore(deps): bump the go-minor-patch group across 1 directory with 5 updates (#4661)
    • chore(deps): update CPE dictionary index (#4636)
    • chore(deps): bump github/codeql-action (#4634)
    • chore(deps): bump github.com/charmbracelet/bubbles from 0.21.1 to 1.0.0 (#4633)
    • chore(deps): bump the go-minor-patch group with 5 updates (#4632)

• Update to version 1.42.1:

  • Bug Fixes
    • Use redhat as namespace for hummingbird rpms [#4615 @scoheb]
    • False Positive: Emacs snap package version CVE-2024-39331 [#4485]
  • Additional Changes
    • call cleanup on tmpfile and replace some io.ReadAlls with streams [#4629 @willmurphyscode]
    • bumps go mod version to 1.25; ci takes latest patch [#4628 @spiffcs]
  • Dependencies
    • chore(deps): update tools to latest versions (#4614)
    • chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4622)
    • chore(deps): bump the go-minor-patch group with 2 updates (#4621)
    • chore(deps): update CPE dictionary index (#4623)

• Update to version 1.42.0:

  • Added Features
    • Add support for scanning GGUF models from OCI registries [#4335 @spiffcs]
    • yarn lockfile scan doesnt catch dev dependencies [#4548 #4549 @rezmoss]
  • Additional Changes
    • CPE detection for APK libavif to use aomedia vendor [#4597 @naag]
  • Dependencies
    • chore(deps): update anchore dependencies (#4613)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (#4612)
    • chore(deps): update CPE dictionary index (#4610)
    • chore(deps): bump github.com/bmatcuk/doublestar/v4 (#4606)
    • chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates (#4607)
    • chore(deps): update CPE dictionary index (#4601)
    • chore(deps): update tools to latest versions (#4594)

• Update to version 1.41.2:

  • Bug Fixes
    • further improve go binary classifier, including windows [#4593 @kzantow]
    • Wrong format in license [#4233 #4588 @spiffcs]
    • Cannot detect installation of Qt6 [#4467 #4550 @rezmoss]
    • bug: Syft mis-identifies binary as deb inside a snap [#4486 #4500 @popey]
  • Dependencies
    • chore(deps): update tools to latest versions (#4589)
    • chore(deps): bump the go-minor-patch group with 2 updates (#4583)
    • chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4584)

• Update to version 1.41.1:

  • Bug Fixes
    • [Bug Report] Missing some dependencies on cyclonedx formatted SBOM using syft [#4562 #4573 @spiffcs]
  • Dependencies
    • chore(deps): update tools to latest versions (#4577)

• Update to version 1.41.0:

  • Added Features
    • detect Debian version from /etc/debian_version [#4569 @kzantow]
  • Bug Fixes
    • correctly report supporting evidence for binary packages [#4558 @kzantow]
  • Dependencies
    • chore(deps): update anchore dependencies (#4575)
    • chore(deps): update tools to latest versions (#4570)
    • chore(deps): bump the actions-minor-patch group across 2 directories with 3 updates (#4568)
    • chore(deps): bump the go-minor-patch group with 6 updates (#4567)
    • chore(deps): update tools to latest versions (#4565)
    • chore(deps): bump github.com/spdx/tools-golang (#4557)

• Update to version 1.40.1:

  • Bug Fixes
    • mongodb binary not detected manual/source install [#4540 #4541 @rezmoss]
    • chore: sync generated file immediately (#4538)
  • Dependencies
    • chore(deps): update anchore dependencies (#4552)
    • chore(deps): update tools to latest versions (#4551)
    • chore(deps): update tools to latest versions (#4545)
    • chore(deps): update tools to latest versions (#4542)
    • chore(deps): bump the go-minor-patch group with 4 updates (#4543)
    • chore(deps): bump anchore/sbom-action (#4544)
    • chore(deps): update tools to latest versions (#4537)

• Update to version 1.40.0:

  • Added Features
    • Exclude development or test dependencies for PNPM Package type [#4430 #4487 @rezmoss]
    • Catalog istio binary (pilot-discovery, pilot-agent) [#4508 #4521 @witchcraze]
    • Catalog envoy binary [#4506 #4530 @witchcraze]
    • Catalog grafana binary [#4505 #4516 @witchcraze]
    • Add a binary classifier for valkey [#3400 #4509 @witchcraze]
  • Bug Fixes
    • old bitnami images without spdx files arent getting picked up correctly in the catalog [#4529 #4532 @rezmoss]
    • wrong traefik rc versions at binary detection [#3535 #4499 @rezmoss]
    • FromPOSIX() in internals\windows\path.go assumes that all Windows root paths must have a colon terminator [#4070 #4075 @luissantosHCIT]
    • binary cataloger is picking up the go version instead of the actual binary version in traefik experimental images [#4498 #4499 @rezmoss]
  • Dependencies
    • chore(deps): update anchore dependencies (#4535)
    • chore(deps): bump the go-minor-patch group with 3 updates (#4524)
    • chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4525)
    • chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#4526)
    • chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 (#4527)
    • chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2 (#4513)
    • chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 (#4501)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8 (#4502)
    • chore(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#4503)
    • chore(deps): update tools to latest versions (#4504)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 (#4518)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.18 to 0.5.19 (#4520)

• Update to version 1.39.0:

  • Added Features
    • add support for Gemfile.next.lock [#4457 @HatiCode]
    • Command output to give more information on what catalogers look for and what they can find [#4155 #4317 @wagoodman]
    • Support reading lzma compressed .go.buildinfo sections with upx [#4411 #4480 @wagoodman]
    • Specify specific snap revision to pull [#4389 #4439 @VictorHuu]
    • Cannot detect embedded deps.json metadata in single-file .NET binaries [#4344 #4375 @rezmoss]
    • ELF note cataloger does not pick up OS field, but should [#4384 #4438 @VictorHuu]
  • Bug Fixes
    • remove debug print statement in dependency parser [#4412 @cgreeno]
    • dotnet-deps cataloger should skip project references with type "project" when building the sbom [#4423 #4436 @rezmoss]
    • File digests not computed when using --base-path [#4410 #4478 @wagoodman]
    • Syft should not define subpaths by default in PURLs [#4394 #4395 @rezmoss]
    • go: valid purl but incorrect name [#1737 #4395 @rezmoss]
    • Incorrect Go module PURL generation when module path contains /vN (e.g. /v5) [#4316 #4395 @rezmoss]
    • Failing to convert npm repository information correctly to SPDX [#4362 #4390 @kendrickm]
  • Dependencies
    • chore(deps): update tools to latest versions (#4491)
    • chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0 (#4489)
    • chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#4481)
    • chore(deps): bump github.com/goccy/go-yaml from 1.19.0 to 1.19.1 (#4482)
    • chore(deps): bump actions/cache from 5.0.0 to 5.0.1 (#4476)
    • chore(deps): bump actions/cache in /.github/actions/bootstrap (#4477)
    • chore(deps): update tools to latest versions (#4473)
    • chore(deps): update tools to latest versions (#4466)
    • chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#4468)
    • chore(deps): bump actions/cache from 4.3.0 to 5.0.0 (#4469)
    • chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to 0.1.16 (#4470)
    • chore(deps): bump actions/cache in /.github/actions/bootstrap (#4471)
    • chore(deps): update tools to latest versions (#4462)
    • chore(deps): update tools to latest versions (#4456)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7 (#4460)
    • chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 (#4459)
    • chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 (#4458)

• Update to version 1.38.2 (.1 was not released):

  • Bug Fixes
    • drop cpe from gguf [#4383 @spiffcs]
    • emit lua rockspec dependencies in metadata [#4376 @willmurphyscode]
    • Invalid SBOMs are created when GO replace directive is used [#4415 #4419 @VictorHuu]
    • Incorrect CPE for Vercel's Next js [#4443 #4450 @willmurphyscode]
    • v1.38.0 generates empty sbom for tgz sources [#4416 #4421 @VictorHuu]
    • Syft: The dependency graph does not include all Requires-Dist relationships defined in the package's METADATA file [#4401 #4408 @willmurphyscode]
  • Dependencies
    • chore(deps): update anchore dependencies (#4440)
    • chore(deps): update tools to latest versions (#4442)
    • chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.11 (#4447)
    • chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.1 (#4445)
    • chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0 (#4448)
    • chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 (#4446)
    • chore(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 (#4453)
    • chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to 2.3.5 (#4434)
    • chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#4435)
    • chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4431)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.17 to 0.5.18 (#4432)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.15 to 0.5.17 (#4413)
    • chore(deps): update tools to latest versions (#4420)
    • chore(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1.2 (#4427)
    • chore(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4424)
    • chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 (#4426)
    • chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#4381)
    • chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1 (#4382)
    • chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4396)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.3 to 6.7.5 (#4397)
    • chore(deps): update tools to latest versions (#4398)
    • chore(deps): bump github.com/google/go-containerregistry (#4409)
    • chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#4386)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to 6.7.3 (#4387)
    • chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#4391)
    • chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4392)
    • chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#4393)

• Update to version 1.38.0:

  • Added Features
    • add support for cataloging GGUF models [#4184 #4279 @spiffcs]
    • Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
    • Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]
  • Bug Fixes
    • Support extras statements in Python PDM cataloger [#4352 @wagoodman]
    • Preserve --from argument order [#4350 @wagoodman]
    • SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
    • empty PURL output in dependency snapshot format breaks sbom-action [#4311]
    • Interface includes constraint elements, can only be used in type parameters [#4346]
    • Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
    • Upgrade to Golang 1.25.4 [#4341]
  • Additional Changes
    • migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
    • Add license enrichment from pypi to python packages [#4295 @timols]
    • license file search [#4327 @kzantow]
  • Dependencies
    • chore(deps): update anchore dependencies (#4374)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.1 to 6.7.2 (#4372)
    • chore(deps): bump golang.org/x/tools from 0.38.0 to 0.39.0 (#4364)
    • chore(deps): update tools to latest versions (#4370)
    • chore(deps): update tools to latest versions (#4365)
    • chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 (#4366)
    • chore(deps): update tools to latest versions (#4358)
    • chore(deps): bump golang.org/x/mod from 0.29.0 to 0.30.0 (#4359)
    • chore(deps): bump github.com/olekukonko/tablewriter from 1.0.9 to 1.1.1 (#4354)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.0 to 6.7.1 (#4355)
    • chore(deps): update tools to latest versions (#4347)
    • chore(deps): bump github.com/opencontainers/selinux (#4349)
    • chore(deps): bump golang.org/x/time from 0.12.0 to 0.14.0 (#4348)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to 6.7.0 (#4337)
    • chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 (#4340)

• Update to version 1.37.0:

  • Added Features
    • Refactor fileresolver to not require base path [#4298 @Rupikz]
    • Describe cataloger capabilities via test observations [#4318 @wagoodman]
    • Support Java resource adapter extension .far as a Java archive [#4183 #4193 @kyounghunJang]
    • Add Java resource adapter extension ".rar" as supported Java archive [#4136 #4137 @thomassui]
  • Bug Fixes
    • fix empty PURL Github format [#4312 @rezmoss]
    • Canonicalize Ghostscript CPE/PURL for ghostscript packages from PE Binaries [#4308 @kdt523]
    • Respect "rpmmod" PURL qualifier [#4314 @willmurphyscode]
    • fix dpkg packages that are in deinstalled state should not be in SBOM [#3063 #4231 @rkirk-nos]
  • Dependencies
    • chore(deps): update anchore dependencies (#4330)
    • chore(deps): bump github/codeql-action from 4.31.1 to 4.31.2 (#4325)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.8.2 to 1.8.3 (#4326)
    • chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0 (#4329)
    • chore(deps): bump github/codeql-action from 4.31.0 to 4.31.1 (#4321)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8 to 6.6.9 (#4315)
    • chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 (#4310)
    • chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 (#4305)
    • chore(deps): update tools to latest versions (#4307)

• Update to version 1.36.0 (1.35.0 was not released):

  • Added Features
    • Add the ability to fetch remote licenses for pnpm-lock.yaml files [#4286 @timols]
    • support universal (fat) mach-o binary files [#4278 @JoeyShapiro]
    • pdm support [#2709 #4234 @paulslaby]
  • Bug Fixes
    • Remove duplicate image source providers [#4289 @Rupikz]
    • syft can't extract go module information from executables on Windows [#4271 #4285 @JoeyShapiro]
  • Dependencies
    • chore(deps): update tools to latest versions (#4302)
    • chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to 2.3.4 (#4301)
    • chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 (#4299)
    • chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4296)
    • chore(deps): bump anchore/sbom-action from 0.20.7 to 0.20.8 (#4297)
    • chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.7 (#4293)

• Update to version 1.34.2:

  • Bug Fixes
    • Extract zip archive with multiple entries [#4283 @Rupikz]
    • panic while resolving maven properties in archive parser [#4288 #4290 @kzantow]
  • Dependencies
    • chore(deps): update tools to latest versions (#4291)

• Update to version 1.34.1 (1.34.0 was not released):

  • Added Features
    • feat: enhance setup.py parser to handle unquoted dependencies [#4255 @HalaAli198]
    • feat: support for identifying ffmpeg/libav libraries [#4227 @popey]
    • feat: PNPM latest lockfile (version 9.0) [#3927 #4256 @bernardoamc]
    • Add Windows ARM64 releases [#4179 #4237 @compnerd]
  • Bug Fixes
    • fix: SBOM CPE mismatch for Qt5 causes Grype to miss CVE matches [#4036 #4093 @hawkaii]
    • fix: use of manifest files present in Snap packages when generating SBOMs [#4147 #4151 @popey]
    • fix: Pom xml only archive parser [#4272 @douglasclarke]
  • Dependencies
    • chore(deps): bump actions/cache from 4.2.4 to 4.3.0 (#4240)
    • chore(deps): bump actions/cache in /.github/actions/bootstrap (#4241)
    • chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 (#4222)
    • chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.2 to 0.9.3 (#4251)
    • chore(deps): bump github.com/charmbracelet/bubbletea (#4228)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.14 to 0.5.15 (#4225)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.3 (#4259)
    • chore(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to 0.6.0 (#4267)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.8.0 to 1.8.1 (#4229)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.8.1 to 1.8.2 (#4254)
    • chore(deps): bump github.com/iancoleman/orderedmap (#4258)
    • chore(deps): bump github.com/mholt/archives from 0.1.3 to 0.1.5 (#4280)
    • chore(deps): bump github.com/quasilyte/go-ruleguard/dsl (#4245)
    • chore(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#4239)
    • chore(deps): bump github/codeql-action from 3.30.4 to 3.30.5 (#4246)
    • chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 (#4253)
    • chore(deps): bump github/codeql-action from 3.30.6 to 4.30.7 (#4262)
    • chore(deps): bump github/codeql-action from 4.30.7 to 4.30.8 (#4277)
    • chore(deps): bump golang.org/x/mod from 0.28.0 to 0.29.0 (#4266)
    • chore(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 (#4263)
    • chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 (#4268)
    • chore(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 (#4265)
    • chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1 (#4276)
    • chore(deps): update anchore dependencies (#4282)
    • chore(deps): update tools to latest versions (#4221)
    • chore(deps): update tools to latest versions (#4230)
    • chore(deps): update tools to latest versions (#4236)
    • chore(deps): update tools to latest versions (#4238)
    • chore(deps): update tools to latest versions (#4248)
    • chore(deps): update tools to latest versions (#4261)
    • chore(deps): update tools to latest versions (#4274)
    • chore: update ffmpeg tests (#4249)
    • chore: update to use old configuration on new cosign (#4287)

• Update to version 1.33.0:

  • Added Features
    • Modify RpmDBEntry to include modularityLabel for cyclonedx [#4212 @sfc-gh-rmaj]
    • Add locations onto packages read from Java native image SBOMs [#4186 @rudsberg]
  • Dependencies
    • chore(deps): update anchore dependencies (#4220)
    • chore(deps): update tools to latest versions (#4215)
    • chore(deps): bump zizmorcore/zizmor-action from 0.1.2 to 0.2.0 (#4216)
    • chore(deps): bump 8398a7/action-slack from 3.18.0 to 3.19.0 (#4217)
    • chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 (#4218)
    • chore(deps): bump modernc.org/sqlite from 1.38.2 to 1.39.0 (#4219)
    • chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.8 to 1.3.9 (#4214)
    • chore(deps): bump github.com/spf13/afero from 1.14.0 to 1.15.0 (#4202)
    • chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.6 to 1.3.8 (#4203)
    • chore(deps): bump github.com/vbatts/go-mtree from 0.5.4 to 0.6.0 (#4204)
    • chore(deps): update tools to latest versions (#4200)
    • chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 (#4210)
    • chore(deps): bump golang.org/x/tools from 0.36.0 to 0.37.0 (#4211)
    • chore(deps): update tools to latest versions (#4194)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.7.10 to 1.8.0 (#4197)
    • chore(deps): bump golang.org/x/mod from 0.27.0 to 0.28.0 (#4198)
    • chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#4182)
    • chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#4188)
    • chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#4189)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.7.9 to 1.7.10 (#4190)
    • chore(deps): bump github/codeql-action from 3.30.0 to 3.30.1 (#4191)
    • chore(deps): bump actions/github-script from 7 to 8 (#4192)
    • chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 (#4173)
    • chore(deps): update tools to latest versions (#4185)
    • chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#4178)
    • chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.0 (#4180)
    • chore(deps): bump github/codeql-action from 3.29.11 to 3.30.0 (#4181)
    • chore(deps): bump github.com/anchore/stereoscope (#4174)
    • chore(deps): bump github.com/gookit/color from 1.5.4 to 1.6.0 (#4176)
    • chore(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 (#4172)

• Update to version 1.32.0:

  • Added Features
    • Catalog entire build list for Go projects, not just packages listed in go.mod [#432 #4127 @spiffcs]
    • package.json authors keyword parsing [#2250 #4003 @popey]
    • Conda ecosystem support (basic) [#4002@SimeonStoykovQC]
  • Bug Fixes
    • When scanning the FFmpeg binary with Syft a new package is now added [#3988 #3994 @popey]
    • Warn loudly if SQLite driver is not present when needed [#3234 #4150 @kzantow]
  • Additional Changes
    • Update dependencies to use go.yaml.in/yaml [#4157 @n-bes]
    • chore(deps): update anchore dependencies (#4169)
    • chore(deps): bump github.com/diskfs/go-diskfs (#4159)
    • chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (#4160)
    • chore(deps): update tools to latest versions (#4154)
    • chore(deps): bump github/codeql-action from 3.29.10 to 3.29.11 (#4149)
    • chore(deps): bump github/codeql-action from 3.29.9 to 3.29.10 (#4145)
    • chore(deps): update CPE dictionary index (#4143)
    • chore(deps): bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 (#4144)
    • chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 (#4141)
    • chore(deps): update tools to latest versions (#4139)

• Update to version 1.31.0:

  • Added Features
    • Option to set PackageSupplier in root of SPDX document generated by CLI [#3098 #4131 @spiffcs]
  • Bug Fixes
    • closed reader during java binary detection [#4129 @kzantow]
    • support multiple letters in openssl patch version [#4106 @honigbot]
    • Can not have license ID [#1964 #4132 @spiffcs]
    • Syft sometimes reports URL for license value when scanning JARs with a URL in Bundle-License field of manifest [#3186]
  • Dependencies
    • chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to 0.1.2 (#4135)
    • chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 (#4134)
    • chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#4130)
    • chore(deps): update CPE dictionary index (#4126)

• Update to version 1.30.0:

  • Added Features
    • add binary classifier for hashicorp vault [#4121 @willmurphyscode]
  • Bug Fixes
    • fix: update nondeterministic Java archive cataloging and improve groupID [#3521 #4118 @kzantow]
  • Dependencies
    • chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 (#4122)
    • chore(deps): bump golang.org/x/mod from 0.26.0 to 0.27.0 (#4123)
    • chore(deps): bump github/codeql-action from 3.29.7 to 3.29.8 (#4124)
    • chore(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#4115)
    • chore(deps): bump actions/cache from 4.2.3 to 4.2.4 (#4119)
    • chore(deps): bump actions/cache in /.github/actions/bootstrap (#4120)
    • chore(deps): update tools to latest versions (#4111)
    • chore(deps): update CPE dictionary index (#4112)
    • chore(deps): update tools to latest versions (#4108)
    • chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#4096)

• Update to version 1.29.1:

  • Bug Fixes
    • Missing license information for tzdata [#4102]
    • Improve JVM Scan Accuracy for JDK and JRE Detection [#4071 #4046 @kzantow]
    • Azul JDK classified as Oracle JRE [#3893 #4046 @kzantow]
  • Dependencies
    • chore(deps): update anchore dependencies (#4104)
    • chore(deps): update anchore dependencies (#4098)
    • chore(deps): bump github.com/anchore/stereoscope (#4091)
    • chore(deps): bump github.com/docker/docker (#4092)
    • chore(deps): bump modernc.org/sqlite from 1.38.1 to 1.38.2 (#4088)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.13 to 0.5.14 (#4089)
    • chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.9.0 to 4.9.1 (#4087)
    • chore(deps): bump github.com/olekukonko/tablewriter from 1.0.8 to 1.0.9 (#4086)
    • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.7 to 6.6.8 (#4085)
    • chore(deps): bump modernc.org/sqlite from 1.38.0 to 1.38.1 (#4084)
    • chore(deps): update tools to latest versions (#4082)
    • chore(deps): update CPE dictionary index (#4083)
    • chore(deps): update tools to latest versions (#4079)
    • chore(deps): bump github/codeql-action from 3.29.3 to 3.29.4 (#4080)
    • chore(deps): update tools to latest versions (#4076)
    • chore(deps): update tools to latest versions (#4072)
    • chore(deps): bump github/codeql-action from 3.29.2 to 3.29.3 (#4074)
    • chore(deps): bump anchore/sbom-action from 0.20.2 to 0.20.4 (#4073)

• Update to version 1.29.0:

  • Added Features
    • Catalog python uv.lock files [#3268 #3763 @jkugler]
  • Additional Changes
    • Pkg Metadata type unmarshal bug [#4043 @houdini91]
  • Dependencies
    • chore(deps): update anchore dependencies (#4068)
    • chore(deps): bump pygments (#4064)
    • chore(deps): update tools to latest versions (#4065)
    • chore(deps): bump sigstore/cosign-installer from 3.9.1 to 3.9.2 (#4066)
    • chore(deps): update CPE dictionary index (#4067)
    • chore(deps): bump marocchino/sticky-pull-request-comment (#4063)
    • chore(deps): update tools to latest versions (#4060)
    • chore(deps): bump github.com/go-viper/mapstructure/v2 (#4061)
    • chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.8.1 to 4.9.0 (#4059)
    • chore(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#4054)
    • chore(deps): update tools to latest versions (#4053)
    • chore(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#4056)
    • chore(deps): update CPE dictionary index (#4058)
    • chore(deps): bump github.com/olekukonko/tablewriter from 1.0.7 to 1.0.8 (#4049)
    • chore(deps): update CPE dictionary index (#4050)
    • chore(deps): bump github.com/hashicorp/hcl/v2 from 2.23.0 to 2.24.0 (#4051)
    • chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.5 to 1.3.6 (#4052)
    • chore(deps): bump anchore/sbom-action from 0.20.1 to 0.20.2 (#4048)

• Update to version 1.28.0:

  • Added Features
    • add native support for snap packages [#1088 #3929 @wagoodman]
  • Additional Changes
    • upgrade tablewriter dependency to use new API [#3990 @cpanato]
  • Dependencies
    • chore(deps): update anchore dependencies (#4047)
    • chore(deps): update anchore dependencies (#4045)
    • chore: upgrade tablewriter dependency to use new API (#3990)
    • chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0 (#4040)
    • chore: update tests to read from latest test-fixture-cache and fix cache publish (#4042)
    • chore(deps): bump github.com/mholt/archives from 0.1.2 to 0.1.3 (#4032)
    • chore(deps): bump marocchino/sticky-pull-request-comment (#4019)
    • chore(deps): bump sigstore/cosign-installer from 3.9.0 to 3.9.1 (#4022)
    • chore(deps): update tools to latest versions (#4035)
    • chore(deps): update CPE dictionary index (#4037)
    • chore(deps): bump github/codeql-action from 3.29.0 to 3.29.2 (#4039)
    • chore(deps): update CPE dictionary index (#4021)
    • chore(deps): update tools to latest versions (#4016)
    • chore(deps): update tools to latest versions (#4012)
    • chore(deps): bump github.com/go-viper/mapstructure/v2 (#4014)
    • chore(deps): bump sigstore/cosign-installer from 3.8.2 to 3.9.0 (#4015)
    • chore(deps): update CPE dictionary index (#4007)
    • chore(deps): bump anchore/sbom-action from 0.20.0 to 0.20.1 (#4008)
    • chore(deps): bump github.com/google/go-containerregistry (#4009)
    • chore(deps): update tools to latest versions (#3992)
    • chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 (#4000)

• Update to version 1.27.1:

  • fix: provide separate nonroot image (#3998)
  • account for non-import shapes (#3997)
  • Allow decoding of anchorectl json files (#3973)
  • chore(deps): bump github.com/anchore/stereoscope (#3991)

• Update to version 1.27.0:

  • Added Features
    • add syft schema version to version command [#3949 @spiffcs]
  • Bug Fixes
    • Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#3967 @jayvdb]
    • Remove CPE product candidates for opentelemetry and redis Rust crates [#3962 @jayvdb]
    • Harden Container Runtime with Non-Root User [#3941 @MikeTheCyberGuy]
    • terraform provider lock entries should not require constraints [#3934 @ghouscht]
    • sbom cataloger returning upstream package [#3662 #3981 @kzantow]
    • Syft missing md5 sums and list data for dpkg packages under status.d/ [#3912]
    • Failure to detect dependency relationships between Python packages [#3958 #3965 @christoph-blessing]
    • Heavy memory consumption when directory scanning deb source [#3928 #3953 @kzantow]
    • In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#3942 #3944 @kzantow]
    • Syft incorrectly reports multiple APKs as parents of symlinked files [#3847 #3923 @luhring]
  • Dependencies
    • chore(deps): bump modernc.org/sqlite from 1.37.1 to 1.38.0 (#3979)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.16.1 to 5.16.2 (#3978)
    • chore(deps): update tools to latest versions (#3977)
    • chore(deps): update CPE dictionary index (#3976)
    • chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 (#3970)
    • chore(deps): bump github.com/sergi/go-diff (#3971)
    • chore(deps): bump golang.org/x/mod from 0.24.0 to 0.25.0 (#3963)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.12 to 0.5.13 (#3964)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.1 (#3960)
    • chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 (#3952)
    • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.11 to 0.5.12 (#3943)
    • chore(deps): update tools to latest versions (#3945)
    • chore(deps): update CPE dictionary index (#3947)
    • chore(deps): bump github.com/google/go-containerregistry (#3933)
    • chore(deps): update CPE dictionary index (#3935)
    • chore(deps): bump modernc.org/sqlite from 1.37.0 to 1.37.1 (#3926)

• Update to version 1.26.1:

  • fix(dotnet-deps-cataloger): avoid repeated dependency resolution (#3930)
  • chore(deps): update tools to latest versions (#3921)
  • chore(deps): bump github.com/google/go-containerregistry (#3925)

• Update to version 1.26.0:

  • Added Features
    • Read version resources from non-.NET DLLs and executables [#3842 #3911 @wagoodman]
  • Bug Fixes
    • pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#3922 @wagoodman]
    • syft 1.24.0 debug container - wget fails TLS [#3891 #3915 @spiffcs]
  • Dependencies
    • chore(deps): update CPE dictionary index (#3913)

• Update to version 1.25.1:

  • remove go-rpmdb replace directive [#3908 @wagoodman]

• Update to version 1.25.0:

  • Added Features
    • Add PHP interpreter + extensions cataloger [#2585 @LaurentGoderre]
  • Bug Fixes
    • update license content filtering default case to be 'none' for no content [#3903 @spiffcs]
    • Distinguish openjdk vs jdk when using file source [#3895 @adammcclenaghan]
    • Make it discoverable if Native Image contains no embedded SBOM [#3731 #3805 @sathiya06]
  • Dependencies
    • chore(deps): bump github/codeql-action from 3.28.17 to 3.28.18 (#3905)
    • chore(deps): bump github.com/mholt/archives from 0.1.1 to 0.1.2 (#3898)
    • chore(deps): bump anchore/sbom-action from 0.19.0 to 0.20.0 (#3899)

• Update to version 1.24.0: https://github.com/anchore/syft/compare/v1.23.1...v1.24.0

  • Added Features
    • Add cataloger for Dart pubspec [#3292 @LaurentGoderre]
    • Translate Portage license strings to SPDX expressions [#1763 @wagoodman]
    • Use package ID from decoded SBOMs when provided [#1872 @jneate]
    • Annotate visible/hidden paths when all-layers scope [#3855 @wagoodman]
    • Add support for PHP Pear [#2775 @LaurentGoderre]
    • Detect whether full license text or a license name has been provided [#3088 #3876 @spiffcs #3450 @spiffcs]
    • Add Cataloger for Homebrew on macOS [#3632 #3724 @rezmoss]
    • Provide a way to get the LayerID the package was first found in [#435 #3858 @wagoodman #3138 @tomersein]
    • Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#3324 #3873 @wagoodman]
    • Upgrade base Docker image to gcr.io/distroless/static-debian12 [#3840 #3862 @bgoareguer]
    • Return full license string instead of SHA256 hash when license string exceeds 64 characters [#3780 #3844 @spiffcs]
    • Detect nix dependencies [#3814 #3837 @wagoodman]
  • Bug Fixes
    • update license sort to be stable with contents field [#3860 @spiffcs]
    • Improve detection of erlang binary in alpine Linux [#3839 @avodotiiets]
    • Do not search for main module versions within binary contents by default [#3874 @wagoodman]
    • dpkg license improvement for non SPDX licenses [#3090 #3888 @spiffcs]
    • CycloneDX group field not symmetrically handled by encoder/decoders [#2981 #3853 @kzantow]
    • Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#3872 #3875 @wagoodman]
    • Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#3864]
    • .NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#3866 #3869 @wagoodman]
    • Propagate error in FileSourceProvider instead of warn log [#3831 #3845 @Rupikz]
    • Update github.com/Masterminds/semver package [#3829 #3836 @popey]
    • go-module-file-cataloger fails if symlinks in path [#3614 #3783 @VictorHuu]
    • Support fluent-bit some versions of arm/s390x images [#3793 #3817 @VictorHuu]
  • Additional Changes
    • update rust test fixtures to latest [#3852 @spiffcs]

• Update to version 1.23.1:

  • chore(deps): update tools to latest versions (#3830)
  • Resolve owned file paths when searching for overlaps (#3828)

• Update to version 1.23.0:

  • Added Features
    • Support skipping archive extraction with file source [#3795 @adammcclenaghan]
    • Use the R cataloger in directory scans [#3774 @spiffcs]
    • Add support for detecting javascript assets in .NET projects using libman [#3825 @wagoodman]
    • Parse GitHub actions comments [#3776 @wagoodman]
    • Support chrome binary detection [#3174 #3136 @lem-onade]
    • Add support for detecting undeclared license files scanning from python installations [#2624 #3779 @wagoodman]
  • Bug Fixes
    • .NET cataloger should consider compile target paths from deps.json [#3821 @wagoodman]
    • Skip license scanner injection [#3796 @adammcclenaghan]
    • Delete collection name/type key entries when empty [#3797 @adammcclenaghan]
    • Use module name over relative paths in go.mod replace directives [#3812 @VictorHuu]
    • Correct variable names for Conan lock parsing version handling [#3802 @musangk]
    • Consider DLL claims for dependencies of .NET packages from deps.json [#3822 @wagoodman]
    • Empty source during decoding an SBOM document should not be fatal [#3791 @wagoodman]
    • Dpkg are not detected when scanning a directory [#3726 #3820 @VictorHuu]
    • Support golang tip image [#3681 #3757 @VictorHuu]
    • syft cataloger list should flatten options [#3801 #3804 @kzantow]
    • Unable to generate a correct SBOM for C++ project [#3755]
  • Dependencies
    • chore(deps): update anchore dependencies (#3827)
    • chore(deps): update tools to latest versions (#3823)
    • chore(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 (#3818)
    • chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 (#3819)
    • chore(deps): update tools to latest versions (#3815)
    • chore(deps): update CPE dictionary index (#3813)
    • chore(deps): update tools to latest versions (#3806)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.15.0 to 5.16.0 (#3807)
    • chore(deps): bump github.com/anchore/stereoscope from 0.1.2 to 0.1.3 (#3803)
    • chore(deps): update tools to latest versions (#3798)
    • chore(deps): update CPE dictionary index (#3799)
    • chore(deps): bump github.com/mholt/archives from 0.1.0 to 0.1.1 (#3778)
    • chore(deps): bump marocchino/sticky-pull-request-comment (#3788)
    • chore(deps): bump github.com/magiconair/properties from 1.8.9 to 1.8.10 (#3789)
    • chore(deps): bump github.com/charmbracelet/bubbles from 0.20.0 to 0.21.0 (#3790)
    • chore(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.15.0 (#3792)
    • chore(deps): update tools to latest versions (#3785)
    • chore(deps): bump github/codeql-action from 3.28.13 to 3.28.15 (#3786)
    • chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 (#3787)
    • chore(deps): update CPE dictionary index (#3782)
    • chore(deps): update tools to latest versions (#3775)

• Update to version 1.22.0:

  • Added Features
    • Improve .NET package CPE generation [#3764 @wagoodman]
    • Catalog deb archives directly [#3315 #3704 @popey]
  • Bug Fixes
    • Dotnet-Portable-Executable-Cataloger uses wrong component version for dotnet runtime libraries [#3282 #3768 @wagoodman]
    • Dotnet deps cataloger returns "wrong" dotnet-framework dependencies and misses out on the runtime (for applications) [#2347 #3768 @wagoodman]
    • .NET deps.json should be considered as installation evidence [#3570 #3563 @wagoodman]
    • Dotnet PE binary cataloger is detecting false positives [#3469 #3563 @wagoodman]
    • Long Processing Time in dpkg-db-cataloger with all-layers Option (Syft 1.20.0) [#3683 #3636 @kzantow]
  • Dependencies
    • chore(deps): update anchore dependencies (#3772)
    • chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766)
    • chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767)
    • chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771)
    • chore(deps): update CPE dictionary index (#3769)
    • chore(deps): bump github/codeql-action from 3.28.12 to 3.28.13 (#3758)
    • chore(deps): update CPE dictionary index (#3756)
    • chore(deps): update tools to latest versions (#3747)
    • chore(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 (#3750)
    • chore(deps): bump github.com/docker/docker (#3749)
    • chore(deps): bump actions/cache from 4.2.2 to 4.2.3 (#3751)
    • chore(deps): bump actions/cache in /.github/actions/bootstrap (#3752)
    • chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#3742)
    • chore(deps): bump actions/setup-go from 5.3.0 to 5.4.0 (#3743)
    • chore(deps): bump github/codeql-action from 3.28.11 to 3.28.12 (#3744)
    • chore(deps): bump github.com/BurntSushi/toml from 1.4.0 to 1.5.0 (#3740)
    • chore(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 (#3738)
    • chore(deps): update tools to latest versions (#3739)

• Update to version 1.21.0:

  • chore(deps): update anchore dependencies (#3727)
  • chore(deps): update CPE dictionary index (#3735)
  • chore(deps): update tools to latest versions (#3722)
  • chore(deps): bump github.com/spf13/afero from 1.12.0 to 1.14.0 (#3736)
  • chore(deps): bump modernc.org/sqlite from 1.36.0 to 1.36.1 (#3737)
  • chore(deps): bump github.com/charmbracelet/lipgloss from 1.0.0 to 1.1.0 (#3732)
  • chore(deps): bump docker/login-action from 3.3.0 to 3.4.0 (#3733)
  • fix(performance): reduce memory allocation in containsPath (#3730)
  • chore: upload individual binaries as artifacts (#3714)
  • fix: fetch Dart package versions from sdk entries (#3572)
  • chore(deps): update tools to latest versions (#3713)
  • chore(deps): update CPE dictionary index (#3715)
  • Add set ID to dotnet packages (#3719)
  • chore(deps): bump github/codeql-action from 3.28.10 to 3.28.11 (#3716)
  • Location order on packages should consider evidence annotations when sorting (#3720)
  • chore: fix some function names in comment (#3717)
  • fix: improve fluent-bit binary detection regex pattern (#3701)
  • chore: updates for go 1.24.1 (#3712)
  • chore(deps): bump golang.org/x/mod from 0.23.0 to 0.24.0 (#3708)
  • Update rustaudit module name (#3689)
  • chore(deps): bump golang.org/x/net from 0.35.0 to 0.37.0 (#3711)
  • chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.4 to 1.3.4 (#3690)
  • Add downloadLocation URI validation (#3697)
  • Native Image SBOM: support extracting symbols in .dynsym section for ELF files (#3647)
  • chore(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 (#3687)
  • chore(deps): bump modernc.org/sqlite from 1.35.0 to 1.36.0 (#3692)
  • chore(deps): bump github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0 (#3693)
  • chore(deps): bump github.com/docker/docker (#3694)
  • chore(deps): bump actions/cache from 4.2.1 to 4.2.2 (#3698)
  • chore(deps): bump actions/cache in /.github/actions/bootstrap (#3699)
  • chore(deps): update CPE dictionary index (#3702)
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.6 to 6.6.7 (#3703)
  • chore(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 (#3709)
  • chore(deps): bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 (#3706)
  • suppress file already closed errors (#3695)
  • Fix /etc/redhat-release file parsing when resolving distro details (#3688)
  • chore(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 (#3675)
  • chore: disable line wrapping glow output (#3679)
  • chore(deps): update CPE dictionary index (#3682)
  • chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 (#3684)
  • chore(deps): bump github/codeql-action from 3.28.9 to 3.28.10 (#3685)
  • chore(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 (#3686)

• Update to version 1.20.0:

  • Added Features
    • Add file catalogers to selection configuration [#3505 @wagoodman]
    • Configuration for including license contents in SBOM [#3626 #3631 @spiffcs]
    • Support Bitnami embedded SBOMs [#3065 #3341 @juan131]
  • Bug Fixes
    • Version parse caused by line breaks on different platforms [#3672 @idhyt]
    • find bitnami files even when no relationships [#3676 @willmurphyscode]
    • License files which do not match an SPDX expression are erroneously handled as 'unlicensed' [#3412 #3366 @HeyeOpenSource]
    • Incorrect URL encoding of package url (purl) [#3533 #3678 @kzantow]
    • syft should not warn on known bad package.json [#3470 #3645 @kzantow]
    • Scanning a project with many DLLs is slow [#3455 #3677 @rogueai]
    • cyclone-dx presenter drops files, includes only packages [#3435 #3539 @spiffcs]
    • "syft config" output swaps comments for search-indexed-archives / search-unindexed-archives [#3624 #3630 @spiffcs]
    • dpkg license improvement for non SPDX licenses [#3090 #3366 @HeyeOpenSource]
    • RPM-based PURLs sometimes have incorrect namespace (specifically OpenSUSE) [#3534 #3615 @mprpic]
  • Additional Changes
    • update to go 1.24.x [#3660 @westonsteimel]
    • replace all shorthand tags of mapstruct -> mapstructure [#3633 @spiffcs]

• Update to version 1.19.0:

  • chore(deps): update tools to latest versions (#3602)
  • chore(deps): bump github/codeql-action from 3.28.1 to 3.28.2 (#3604)
  • chore(deps): bump github.com/hashicorp/hcl/v2 from 2.22.0 to 2.23.0 (#3605)
  • chore(deps): bump github.com/aquasecurity/go-pep440-version (#3606)
  • chore: bump stereoscope to v0.0.13 (#3601)
  • feat(cataloger): add a terraform provider cataloger (#3378)
  • chore(deps): update tools to latest versions (#3597)
  • chore(deps): update CPE dictionary index (#3599)
  • chore(deps): bump actions/setup-go from 5.2.0 to 5.3.0 (#3600)
  • feat(golang): add license parsing from vendor dirs (#3522)
  • chore: bump packageurl-go with new parsing rules (#3596)
  • chore(deps): bump marocchino/sticky-pull-request-comment (#3595)
  • feat: add cataloger for NuGet packages (#3484)
  • allow disabling all package catalogers (#3468)
  • chore(deps): bump github.com/google/go-containerregistry (#3592)
  • chore(deps): bump modernc.org/sqlite from 1.34.4 to 1.34.5 (#3593)
  • chore(deps): update tools to latest versions (#3582)
  • chore: update README.md's link to Nixpkgs (#3578)
  • chore(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.6 (#3579)
  • chore(deps): bump github.com/spf13/afero from 1.11.0 to 1.12.0 (#3580)
  • chore(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 (#3581)
  • chore(deps): update CPE dictionary index (#3583)
  • chore(deps): bump github/codeql-action from 3.28.0 to 3.28.1 (#3584)
  • chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 (#3585)
  • chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.7.1 to 4.8.0 (#3586)
  • chore(deps): bump github.com/docker/docker (#3587)
  • chore(deps): update anchore dependencies (#3571)
  • chore(deps): update tools to latest versions (#3567)
  • chore(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 (#3568)
  • fix: golang remote license search not executing when error reading local mod dir (#3549)
  • chore(deps): update tools to latest versions (#3564)
  • chore(deps): update CPE dictionary index (#3565)
  • chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.7 to 0.5.8 (#3548)
  • chore(deps): update tools to latest versions (#3560)
  • chore(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 (#3561)
  • Use reader when scanning for package versions over reading entire binary into memory (#3558)
  • chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 (#3551)
  • chore(deps): update tools to latest versions (#3556)
  • test: removes latest license list test (#3559)
  • chore(deps): bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (#3547)
  • chore(deps): update CPE dictionary index (#3550)
  • chore(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 (#3552)
  • chore(deps): update tools to latest versions (#3543)
  • chore(deps): update CPE dictionary index (#3544)
  • chore(deps): bump modernc.org/sqlite from 1.34.3 to 1.34.4 (#3545)
  • chore(deps): bump github/codeql-action from 3.27.9 to 3.28.0 (#3546)
  • chore(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 (#3541)
  • chore(deps): bump modernc.org/sqlite from 1.34.2 to 1.34.3 (#3542)
  • chore(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 (#3537)
  • chore(deps): bump github.com/docker/docker (#3538)
  • chore(deps): update CPE dictionary index (#3526)
  • chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.1 to 0.9.2 (#3530)
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.4 to 6.6.5 (#3531)
  • chore(deps): bump anchore/sbom-action from 0.17.8 to 0.17.9 (#3532)

• Update to version 1.18.1:

  • chore(deps): update anchore dependencies (#3525)
  • chore(deps): bump github/codeql-action from 3.27.7 to 3.27.9 (#3524)
  • chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#3523)
  • chore(deps): bump actions/setup-go from 5.1.0 to 5.2.0 (#3519)
  • chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#3518)
  • chore: make fixes field in PR template match auto-close regex (#3520)
  • fix: stop omitting redundantly parenthesized licenses in CDX formatter (#3517)
  • chore: migrate syft to use the anchore fork of archiver without replace (#3516)
  • Make pre-release integration PRs (#3370)
  • chore(deps): bump github.com/docker/docker (#3512)
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.3 to 6.6.4 (#3513)
  • chore(deps): bump github/codeql-action from 3.27.6 to 3.27.7 (#3514)

• Update to version 1.18.0:

  • chore(deps): update anchore dependencies (#3510)
  • fix: convert file paths for spdx formats from absolute to relative (#3509)
  • chore(deps): update CPE dictionary index (#3507)
  • chore(deps): update tools to latest versions (#3506)
  • chore(deps): bump github.com/magiconair/properties from 1.8.7 to 1.8.9 (#3508)
  • chore(deps): bump actions/cache from 4.1.2 to 4.2.0 (#3503)
  • Add relationships for rust audit binary packages (#3500)
  • fix order of rust dependencies and support git sources in Cargo.lock dependencies (#3502)
  • chore(deps): update tools to latest versions (#3501)
  • chore(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 (#3499)
  • chore: add and document target for updating unit snapshots (#3498)
  • fix: emit NOASSERTION for copyright text to fix SPDX 2.2 validation failure (#3495)
  • chore(deps): update tools to latest versions (#3496)
  • chore(deps): update tools to latest versions (#3487)
  • chore(deps): bump github/codeql-action from 3.27.5 to 3.27.6 (#3494)
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.2 to 6.6.3 (#3489)
  • feat: set max layer size (#3464)
  • chore(deps): update CPE dictionary index (#3491)
  • chore(deps): bump modernc.org/sqlite from 1.34.1 to 1.34.2 (#3492)
  • chore(deps): bump github.com/saferwall/pe from 1.5.5 to 1.5.6 (#3493)
  • chore(deps): update tools to latest versions (#3478)
  • chore(deps): update CPE dictionary index (#3479)
  • chore(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#3480)
  • chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.3 to 1.2.4 (#3482)
  • chore(deps): update stereoscope to be5deed44b7c03fcbfa6f1f42fb67202d31636a9 (#3483)
  • fix: dart classifier for 2.x and ARM (#3475)
  • Use file indexer directly when scanning with file source (#3333)
  • chore(deps): bump anchore/sbom-action from 0.17.7 to 0.17.8 (#3476)
  • chore(deps): bump github/codeql-action from 3.27.4 to 3.27.5 (#3473)

• Update to version 1.17.0:

  • chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3472)
  • chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.2 to 1.2.3 (#3467)
  • fix: bump clio to pull in logging fix (#3466)
  • 3122 valid license url characters (#3449)
  • 3030 license declared spdx correction (#3461)
  • chore(deps): update tools to latest versions (#3463)
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.1 to 6.6.2 (#3465)
  • chore(deps): bump modernc.org/sqlite from 1.33.1 to 1.34.1 (#3460)
  • chore(deps): update CPE dictionary index (#3453)
  • chore(deps): update tools to latest versions (#3454)
  • chore(deps): update tools to latest versions (#3448)
  • chore(deps): update tools to latest versions (#3444)
  • chore(deps): bump github/codeql-action from 3.27.3 to 3.27.4 (#3446)
  • feat: emit dependency relationships found in Cargo.lock (#3443)
  • chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3442)
  • chore(deps): bump github/codeql-action from 3.27.2 to 3.27.3 (#3438)
  • chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.1 to 1.2.2 (#3439)
  • chore(deps): bump github.com/saferwall/pe from 1.5.4 to 1.5.5 (#3440)
  • chore(deps): update tools to latest versions (#3413)
  • chore(deps): bump github/codeql-action from 3.27.1 to 3.27.2 (#3436)
  • chore(deps): bump golang.org/x/mod from 0.21.0 to 0.22.0 (#3426)
  • update node classifier (#3419)
  • chore(deps): update stereoscope to 120d9ea511e2f7a9887b443c52e66cd19bb80b43 (#3424)
  • chore(deps): update CPE dictionary index (#3429)
  • chore(deps): bump github/codeql-action from 3.27.0 to 3.27.1 (#3431)
  • chore(deps): bump golang.org/x/net from 0.30.0 to 0.31.0 (#3432)
  • chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.2 to 1.2.1 (#3433)
  • restore log on ui teardown (#3427)
  • doc: Add official Syft logo license information (#3421)
  • chore(deps): bump anchore/sbom-action from 0.17.6 to 0.17.7 (#3418)
  • chore: build release sbom from go.mod (#3417)

• Update to version 1.16.0:

  • chore: prevent file resolver from bubbling errors in binary cataloger (#3410)
  • chore(deps): update stereoscope to cbd43fb4e5d348fe680066ee6329385fd6a4f827 (#3411)
  • chore(deps): update CPE dictionary index (#3414)
  • chore(deps): bump github.com/adrg/xdg from 0.5.2 to 0.5.3 (#3408)
  • chore(deps): bump github.com/charmbracelet/lipgloss from 0.13.1 to 1.0.0 (#3409)
  • chore(deps): update stereoscope to 2ce1e520983b1c21d5150d7fae2b39e8e5ab9063 (#3405)
  • Issue #3143 - fixed format conversion docs link (#3407)
  • feat: support dependencies and purl for Native Image SBOMs (#3399)
  • chore(deps): update stereoscope to 9c92fe30492ffeba14ed2e23ad1fd923341dda4f (#3398)
  • feat: exclude devDependencies from package-lock.json parsing (#3371)
  • chore(deps): bump github.com/adrg/xdg from 0.5.1 to 0.5.2 (#3394)
  • chore(deps): bump anchore/sbom-action from 0.17.5 to 0.17.6 (#3393)
  • fix: stack overflow in spyingIoReadCloser (#3392)
  • fix: bad pom files may cause infinite loop (#3391)

• Update to version 1.15.0:

  • chore(deps): update stereoscope to bcc40c6817524718277256d6b774ce643f98640a (#3388)
  • chore(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (#3384)
  • chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.1 to 1.1.2 (#3385)
  • chore(deps): update tools to latest versions (#3383)
  • chore(deps): update CPE dictionary index (#3387)
  • chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#3380)
  • feat: multi-level configuration and profiles (#3337)
  • feat: Java dependency graph information (#3363)
  • Expanded dpkg cataloger globs (#3373)
  • Enable cargo-auditable-binary-cataloger for files/directories (#3376)
  • chore(deps): bump github/codeql-action from 3.26.13 to 3.27.0 (#3374)
  • chore(deps): bump github.com/charmbracelet/lipgloss (#3375)
  • chore(deps): update stereoscope to 6db3c175f1f836e552b01ee70e5d5528cc04bce4 (#3362)
  • chore(deps): bump actions/cache from 4.1.1 to 4.1.2 (#3364)
  • chore(deps): bump anchore/sbom-action from 0.17.4 to 0.17.5 (#3365)
  • chore(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#3367)

• Update to version 1.14.2:

  • Create single license scanner for all catalogers (#3348)
  • chore(deps): update stereoscope to a38c93517fc7d67ca1af826ac529a06c05b571d2 (#3357)
  • chore(deps): update CPE dictionary index (#3358)
  • chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.0 to 6.6.1 (#3361)
  • update to latest packageurl-go (#3347)
  • chore(deps): update tools to latest versions (#3342)
  • chore(deps): update stereoscope to 9e57bce5efeb0ffe27770dd0b8eb2eef8b38512f (#3338)
  • chore(deps): bump github.com/adrg/xdg from 0.5.0 to 0.5.1 (#3344)
  • fix: use official CPE for linux kernel (#3343)
  • chore(deps): bump anchore/sbom-action from 0.17.3 to 0.17.4 (#3340)
  • fix: improve mariadb binary classifer to detect older versions (#3339)