anchore/syft v1.38.0

on GitHub

Added Features

• add support for cataloging GGUF models [#4184 #4279 @spiffcs]
• Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
• Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]

Bug Fixes

• Support extras statements in Python PDM cataloger [#4352 @wagoodman]
• Preserve --from argument order [#4350 @wagoodman]
• SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
• empty PURL output in dependency snapshot format breaks sbom-action [#4311]
• Interface includes constraint elements, can only be used in type parameters [#4346]
• Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
• Upgrade to Golang 1.25.4 [#4341]

Additional Changes

• migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
• Add license enrichment from pypi to python packages [#4295 @timols]
• license file search [#4327 @kzantow]

(Full Changelog)