Added Features
- passthrough-exact-format copies matching syft-json input unchanged [PR #5279 @juanjsebgarcia]
Bug Fixes
- bound what a compressed kernel module expands to [PR #5294 @wagoodman]
- bound the decompressed members of a .deb archive [PR #5293 @wagoodman]
- alpm mtree gzip unbounded processing [PR #5292 @wagoodman]
- graalvm unbounded allocation [PR #5291 @wagoodman]
- harden .NET PE/ELF parsing against malformed binaries [PR #5267 @wagoodman]
- bound allocations from UPX-packed binary headers [PR #5195 @wagoodman]
- Syft rpm-db-cataloger reports stale libssh version from a single-layer Rocky Linux 10 image [Issue #5247]
- java-archive-cataloger returns unknown ver for uber-jars [Issue #5163] [PR #5164 @rezmoss]
Dependencies
52 dependency changes (52 updated). 6 vulnerabilities remediated.
🟢 Remediated (6)
- GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc
- GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2
- GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc
- GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc
- GO-2026-6354 (High) — golang.org/x/crypto
- GO-2026-6355 (High) — golang.org/x/crypto
Updated (52 packages)
- cloud.google.com/go/auth
v0.22.0→v0.23.2 - cloud.google.com/go/iam
v1.11.0→v1.12.0 - cloud.google.com/go/logging
v1.18.0→v1.19.0 - cloud.google.com/go/monitoring
v1.29.0→v1.30.0 - cloud.google.com/go/storage
v1.64.0→v1.65.1 - github.com/CycloneDX/cyclonedx-go
v0.11.0→v0.12.0 - github.com/anchore/go-sync
v0.1.1→v0.1.2 - github.com/anchore/stereoscope
v0.3.1→v0.3.2 - github.com/aws/aws-sdk-go-v2
v1.43.4→v1.44.0 - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
v1.7.16→v1.7.20 - github.com/aws/aws-sdk-go-v2/config
v1.32.35→v1.32.40 - github.com/aws/aws-sdk-go-v2/credentials
v1.19.34→v1.19.39 - github.com/aws/aws-sdk-go-v2/feature/ec2/imds
v1.18.35→v1.18.40 - github.com/aws/aws-sdk-go-v2/internal/configsources
v1.4.35→v1.4.40 - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2
v2.7.35→v2.7.40 - github.com/aws/aws-sdk-go-v2/internal/v4a
v1.4.36→v1.4.41 - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding
v1.13.15→v1.13.19 - github.com/aws/aws-sdk-go-v2/service/internal/checksum
v1.9.28→v1.10.0 - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url
v1.13.35→v1.13.40 - github.com/aws/aws-sdk-go-v2/service/internal/s3shared
v1.19.36→v1.19.41 - github.com/aws/aws-sdk-go-v2/service/s3
v1.106.5→v1.108.0 - github.com/aws/aws-sdk-go-v2/service/signin
v1.5.4→v1.6.0 - github.com/aws/aws-sdk-go-v2/service/sso
v1.33.4→v1.34.0 - github.com/aws/aws-sdk-go-v2/service/ssooidc
v1.38.4→v1.39.0 - github.com/aws/aws-sdk-go-v2/service/sts
v1.45.4→v1.46.0 - github.com/aws/smithy-go
v1.27.6→v1.28.1 - github.com/containerd/containerd/v2
v2.3.4→v2.3.5(🟢 remediated GHSA-7jxh-36q5-gcqv) - github.com/docker/cli
v29.7.2+incompatible→v29.8.0+incompatible - github.com/google/go-containerregistry
v0.21.9→v0.22.1 - github.com/googleapis/enterprise-certificate-proxy
v0.3.19→v0.3.20 - github.com/googleapis/gax-go/v2
v2.23.0→v2.24.0 - github.com/gpustack/gguf-parser-go
v0.25.0→v0.26.3 - github.com/hashicorp/go-getter
v1.8.8→v1.8.9 - github.com/klauspost/compress
v1.19.2→v1.20.0 - github.com/moby/moby/api
v1.55.0→v1.56.0 - github.com/moby/moby/client
v0.5.1→v0.6.0 - github.com/terminalstatic/go-xsd-validate
v0.1.6→v0.1.8 - golang.org/x/crypto
v0.55.0→v0.56.0(🟢 remediated GO-2026-6354, GO-2026-6355) - golang.org/x/mod
v0.40.0→v0.41.0 - golang.org/x/time
v0.15.0→v0.16.0 - google.golang.org/api
v0.292.0→v0.294.0 - google.golang.org/genproto
v0.0.0-aa98bba→v0.0.0-e75dac1 - google.golang.org/genproto/googleapis/api
v0.0.0-925bb5d→v0.0.0-e75dac1 - google.golang.org/genproto/googleapis/rpc
v0.0.0-6ac0973→v0.0.0-08b0e42 - google.golang.org/grpc
v1.83.0→v1.83.2(🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc) - google.golang.org/protobuf
v1.36.12-0.f2248ac→v1.36.12 - modernc.org/cc/v4
v4.29.1→v4.29.2 - modernc.org/ccgo/v4
v4.34.6→v4.35.0 - modernc.org/gc/v3
v3.1.4→v3.1.5 - modernc.org/libc
v1.74.4→v1.75.6 - modernc.org/memory
v1.11.0→v1.12.1 - modernc.org/sqlite
v1.56.0→v1.58.0