anchore/syft v1.54.0

on GitHub

Added Features

• report the perl interpreter as a cpan package [PR #5132 @wagoodman]
• Add package cataloger for perl ecosystem [Issue #1906] [PR #5131 @wagoodman]
• Analyze with Non-Daemon podman [Issue #1173]

Bug Fixes

• write a name for the root package when the source has none [PR #5349 @DrVelvetFog]
• match opensource.org license URLs across SPDX URL forms [PR #5361 @willmurphyscode]
• Account for malformed GGUF and safetensors parameter counts [PR #5343 @wagoodman]
• don't panic on a root file without a supplier or null entries [PR #5326 @DrVelvetFog]
• do not panic on a stack.yaml rev pin [PR #5310 @arpitjain099]
• report scanner errors and raise the line cap in metadata parsers [PR #5353 @wagoodman]
• Harden cataloger parsers against truncated input (do not panic) [PR #5355 @wagoodman]
• bound CPE candidate generation for pathological package metadata [PR #5356 @wagoodman]
• account for UPX's loader padding when unpacking Go binaries [PR #5347 @huuyafwww]
• handle malformed GGUF headers without panicking [PR #5345 @wagoodman]
• bound model companion file reads and validate their contents [PR #5344 @wagoodman]
• don't fail the whole SBOM when a cataloger panics on one file [PR #5342 @wagoodman]
• release package collection lock in Ubuntu ESM detection [PR #5336 @sverrirsig]
• render TUI log lines on their own rows, with colors and a small header [PR #5324 @wagoodman]
• uv.lock: dependents are linked to every locked version of a dependency [Issue #5340] [PR #5351 @devtechedge]
• java-archive-cataloger maps Apache Groovy 4+ (org.apache.groovy) to obsolete org.codehaus.groovy [Issue #5311] [PR #5313 @texasich]
• Support traefik binary various versions [Issue #4980] [PR #5281 @mayanksekhar]
• File Digests Remain at Zero, No Hashes Available Despite .syft.yaml Settings Should Support [Issue #5325] [PR #5341 @wagoodman]
• not showing expat CVEs from syft generated sbom [Issue #4771] [PR #5259 @KR-Ravindra]
• PHP extensions are cataloged as upstream products using the PHP version [Issue #5014] [PR #5102 @pujitha24]
• Panic during scanning with gguf-cataloger/safetensors-cataloger [Issue #5327] [PR #5328 @tk1475]
• github-actions cataloger emits an invalid PURL for docker:// use statements [Issue #5299] [PR #5302 @yunaremaia]
• Crash when running syft on a directory that is the root file system of a Yocto build [Issue #5320] [PR #5321 @somaz94]
• Invalid PURLs when cataloging instrumentation classes/jars [Issue #2596]

Dependencies

79 dependency changes (48 updated, 28 added, 3 removed). 2 vulnerabilities remediated.

🟢 Remediated (2)

• GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/sdk
• GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2

Toolchains (1)

• Go minimum version: 1.26.3 → 1.26.8

(Full Changelog)