anchore/syft v1.51.0

on GitHub

Added Features

• detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel]
• add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman]

Bug Fixes

• Cleanup snap temporary directories [PR #5117 @spiffcs]
• add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel]
• javascript-package-cataloger creates phantom <name>@unknown packages for subpath or export-map stub package.json files [Issue #5118]
• Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #4598] [PR #5146 @ankit090701]
• When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #5019] [PR #5029 @wagoodman]
• Support deno binary latest and some old versions [Issue #5057] [PR #5084 @ychampion]
• Update install methods in README.md [Issue #3198]

Dependencies

9 dependency changes (9 updated). 2 vulnerabilities remediated.

🟢 Remediated (2)

• GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
• GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5

(Full Changelog)