openSUSE-SU-2026:20928-1

See a problem?

Import Source

https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20928-1.json

JSON Data

https://api.test.osv.dev/v1/vulns/openSUSE-SU-2026:20928-1

Upstream

CVE-2024-39331

Related

CVE-2024-39331

Published

2026-06-08T17:34:13Z

Modified

2026-06-10T18:24:22Z

Summary

Security update for syft

Details

This update for syft fixes the following issues:

Changes in syft:

Update to version 1.45.0:
- Added Features
  - Add support for ZapAddOns as jar files [#4654 #4932 @douglasclarke]
  - MySQL binary classifier should distinguish between MySQL Cluster (ndb) and MySQL [#3297 #4907 @witchcraze]
  - Catalog ingress-nginx binary [#4818 #4857 @witchcraze]
- Bug Fixes
  - Support helm binary various versions [#4820 #4922 @witchcraze]
  - Support julia binary various versions [#4867 #4945 @witchcraze]
  - Support deno binary old versions [#4865 #4939 @witchcraze]
  - Compressed kernel modules are not scanned by the linux-kernel-cataloger [#4721 #4740 @will-bates11]
  - Yarn Berry lockfile parser incorrectly deduplicates packages with multiple resolutions [#4691 #4838 @calumleslie]
  - Possible misdetection of AWS-LC as OpenSSL 1.1.1 [#4539 #4882 @witchcraze]
  - Support elixir binary rc versions [#4819 #4851 @ChrisJr404]
  - Exclude path ending with a slash are discarded [#4839 #4892 @ChrisJr404]
  - Incorrect CPE for .NET Runtime [#4738 #4743 @PGrayCS]
  - fix parsing of debian/copyright files [#4708 #4754 @Bahtya]
  - Grype ignores python requirements in arbitrary equality (===) format [#4834 #4835 @cyphercodes]
  - valkey is detected as both of valkey and redis [#4591 #4619 @witchcraze]
  - TypeByName missing "nuget" case causes UnknownPkg when reading SPDX SBOMs [#4837 #4848 @ChrisJr404]
- Additional Changes
  - hoist name normalization regexp to package level [#4926 @matiasinsaurralde]
  - bump the actions-minor-patch group across 1 directory with 6 updates [#4946 @dependabot]
  - bump the actions-minor-patch group across 2 directories with 2 updates [#4936 @dependabot]
  - bump the actions-minor-patch group across 1 directory with 4 updates [#4927 @dependabot]
  - bump the actions-minor-patch group across 1 directory with 2 updates [#4920 @dependabot]
  - bump the actions-minor-patch group across 1 directory with 2 updates [#4897 @dependabot]
  - update CPE dictionary index [#4831 @anchore-oss-update-bot]
- Dependencies
  - chore(deps): bump github.com/containerd/containerd/v2 (#4935)
  - chore(deps): update anchore dependencies (#4821)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.19.0 to 5.19.1 (#4930)
  - chore(deps): update CPE dictionary index (#4925)
  - chore(deps): update CPE dictionary index (#4909)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.18.0 to 5.19.0 (#4911)
Update to version 1.44.0:
- Added Features
  - Add support for linux-riscv64 [#4757 @luhenry]
- Bug Fixes
  - Yarn lockfile cataloguing does not handle aliases [#4833 #4836 @cyphercodes]
  - Some snippet files are saved in the previous test directory [#4829 #4830 @witchcraze]
  - empty rockspec causes index out of range [#4824 #4827 @aki1770-del]
  - PE cataloger shows asp.net core ref assemblies using fileversion build stamp instead of productversion [#4813 #4814 @rezmoss]
  - Syft safeCopy silently swallows archive decompression errors [#4806 #4807 @SAY-5]
Update to version 1.43.0:
- Added Features
  - added deno bin classifiers [#4677 @rezmoss]
  - Support haskell old versions [#3237 #4793 @witchcraze]
  - Add support for OpenLDAP binary detection [#4768 #4755 @nadimz]
  - Support erlang ols versions [#3235 #4766 @witchcraze]
- Bug Fixes
  - improve redhat-release parsing fallback for RHEL clones [#4808 @westonsteimel]
  - fix format string in search results struct [#4775 @willmurphyscode]
  - prevent infinite recursion in Document.UnmarshalJSON with encoding/json/v2 [#4748 @benja-M-1]
  - Syft can not complete scanning golang image [#4686]
  - javascript-package-cataloger drops entire package.json when authors/contributors/maintainers is a single string [#4778 #4779 @yoav-orca]
  - pnpm lock file cataloger produces unstable output [#4648 #4765 @lawrence3699]
  - Linux Kernel bzImage and zImage not cataloged by linux-kernel-cataloger [#4769 #4751 @nadimz]
  - Support istio binary (pilot-discovery, pilot-agent) alpha,beta,rc,dev version [#4546 #4645 @witchcraze]
  - Scanning mounted ISO: duplicate entries [#4759]
- Additional Changes
  - update CPE dictionary index [#4767 @anchore-oss-update-bot]
- Dependencies
  - chore(deps): update anchore dependencies (#4797)
  - chore(deps): restore Go version to 1.25.8 (#4804)
  - chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4790)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.17.0 to 5.18.0 (#4792)
  - chore(deps): update Go version (#4798)
  - chore(deps): update tools to latest versions (#4701)
  - chore(deps): update Go version (#4773)
  - chore(deps): bump github.com/aws/aws-sdk-go-v2/service/s3 (#4750)
  - chore(deps): bump go.opentelemetry.io/otel/sdk from 1.40.0 to 1.43.0 (#4752)
  - chore(deps): bump github.com/go-jose/go-jose/v4 from 4.1.3 to 4.1.4 (#4737)
  - chore(deps): bump the actions-minor-patch group across 2 directories with 7 updates (#4763)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.8.5 to 1.8.6 (#4764)
  - chore(deps): update CPE dictionary index (#4767)
Update to version 1.42.4:
- Bug Fixes
  - Similar Packages Should Be Aggregated [#1162]
  - Support arangodb binary recent version [#4571 #4662 @witchcraze]
  - Support go binary various versions [#4687 #4694 @kzantow]
- Additional Changes
  - update CPE dictionary index [#4745 @anchore-oss-update-bot]
  - update CPE dictionary index [#4726 @anchore-oss-update-bot]
  - Add a trust boundary section [#4716 @joshbressers]
- Dependencies
  - chore(deps): update CPE dictionary index (#4745)
  - chore(deps): update CPE dictionary index (#4726)
  - chore(deps): update CPE dictionary index (#4715)
  - chore(deps): update tool versions (#4706)
  - chore(deps): bump slackapi/slack-github-action from 2.1.1 to 3.0.1 (#4684)
  - chore(deps): bump marocchino/sticky-pull-request-comment (#4685)
  - chore(deps): bump the go-minor-patch group with 2 updates (#4697)
  - chore(deps): bump actions/create-github-app-token from 2.2.1 to 3.0.0 (#4699)
  - chore(deps): update CPE dictionary index (#4689)
  - chore(deps): ignore some dependabot deps (#4696)
  - chore(deps): update tools to latest versions (#4690)
Update to version 1.42.3:
- Bug Fixes
  - Missing secondary evidence for .NET dependency in ghcr.io/open-telemetry/demo:2.0.0-accounting image [#4652]
- Additional Changes
  - centralize temp files and prefer streaming IO [#4668 @willmurphyscode]
  - chore(deps): update anchore dependencies (#4681)
  - chore(deps): bump github.com/buger/jsonsparser to v1.1.2 (#4680)
  - chore(deps): bump the go-minor-patch group with 2 updates (#4678)
  - chore(deps): bump google.golang.org/grpc from 1.78.0 to 1.79.3 (#4675)
  - chore(deps): bump the go-minor-patch group with 2 updates (#4674)
  - chore(deps): update tools to latest versions (#4663)
  - chore(deps): bump the go-minor-patch group with 3 updates (#4669)
  - chore(deps): bump github/codeql-action (#4670)
  - chore(deps): bump docker/login-action from 3.7.0 to 4.0.0 (#4671)
  - chore(deps): update CPE dictionary index (#4673)
  - chore(tests): fix test fixture build on modern ARM Mac (#4666)
Update to version 1.42.2:
- Bug Fixes
  - [BUG] Incorrect Maven PURL generation: Automatic-Module-Name should not be used as Maven groupId [#4611 #4642 @xnox]
  - Checksum is 0 for spdx files [#2307 #4620 @ppalucha]
  - Support grafana binary various versions [#4559 #4635 @witchcraze]
- Additional Changes
  - migrate fixtures to testdata [#4651 @wagoodman]
- Dependencies
  - chore(deps): update anchore dependencies (#4631)
  - chore(deps): update tools to latest versions (#4630)
  - chore(deps): update SPDX license list (#4637)
  - chore(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 (#4658)
  - chore(deps): bump github.com/cloudflare/circl from 1.6.1 to 1.6.3 (#4638)
  - chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates (#4657)
  - chore(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 (#4659)
  - chore(deps): bump go.opentelemetry.io/otel/sdk from 1.39.0 to 1.40.0 (#4646)
  - chore(deps): update CPE dictionary index (#4647)
  - chore(deps): bump the go-minor-patch group across 1 directory with 5 updates (#4661)
  - chore(deps): update CPE dictionary index (#4636)
  - chore(deps): bump github/codeql-action (#4634)
  - chore(deps): bump github.com/charmbracelet/bubbles from 0.21.1 to 1.0.0 (#4633)
  - chore(deps): bump the go-minor-patch group with 5 updates (#4632)
Update to version 1.42.1:
- Bug Fixes
  - Use redhat as namespace for hummingbird rpms [#4615 @scoheb]
  - False Positive: Emacs snap package version CVE-2024-39331 [#4485]
- Additional Changes
  - call cleanup on tmpfile and replace some io.ReadAlls with streams [#4629 @willmurphyscode]
  - bumps go mod version to 1.25; ci takes latest patch [#4628 @spiffcs]
- Dependencies
  - chore(deps): update tools to latest versions (#4614)
  - chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4622)
  - chore(deps): bump the go-minor-patch group with 2 updates (#4621)
  - chore(deps): update CPE dictionary index (#4623)
Update to version 1.42.0:
- Added Features
  - Add support for scanning GGUF models from OCI registries [#4335 @spiffcs]
  - yarn lockfile scan doesnt catch dev dependencies [#4548 #4549 @rezmoss]
- Additional Changes
  - CPE detection for APK libavif to use aomedia vendor [#4597 @naag]
- Dependencies
  - chore(deps): update anchore dependencies (#4613)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.4 to 5.16.5 (#4612)
  - chore(deps): update CPE dictionary index (#4610)
  - chore(deps): bump github.com/bmatcuk/doublestar/v4 (#4606)
  - chore(deps): bump the actions-minor-patch group across 2 directories with 2 updates (#4607)
  - chore(deps): update CPE dictionary index (#4601)
  - chore(deps): update tools to latest versions (#4594)
Update to version 1.41.2:
- Bug Fixes
  - further improve go binary classifier, including windows [#4593 @kzantow]
  - Wrong format in license [#4233 #4588 @spiffcs]
  - Cannot detect installation of Qt6 [#4467 #4550 @rezmoss]
  - bug: Syft mis-identifies binary as deb inside a snap [#4486 #4500 @popey]
- Dependencies
  - chore(deps): update tools to latest versions (#4589)
  - chore(deps): bump the go-minor-patch group with 2 updates (#4583)
  - chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4584)
Update to version 1.41.1:
- Bug Fixes
  - [Bug Report] Missing some dependencies on cyclonedx formatted SBOM using syft [#4562 #4573 @spiffcs]
- Dependencies
  - chore(deps): update tools to latest versions (#4577)
Update to version 1.41.0:
- Added Features
  - detect Debian version from /etc/debian_version [#4569 @kzantow]
- Bug Fixes
  - correctly report supporting evidence for binary packages [#4558 @kzantow]
- Dependencies
  - chore(deps): update anchore dependencies (#4575)
  - chore(deps): update tools to latest versions (#4570)
  - chore(deps): bump the actions-minor-patch group across 2 directories with 3 updates (#4568)
  - chore(deps): bump the go-minor-patch group with 6 updates (#4567)
  - chore(deps): update tools to latest versions (#4565)
  - chore(deps): bump github.com/spdx/tools-golang (#4557)
Update to version 1.40.1:
- Bug Fixes
  - mongodb binary not detected manual/source install [#4540 #4541 @rezmoss]
  - chore: sync generated file immediately (#4538)
- Dependencies
  - chore(deps): update anchore dependencies (#4552)
  - chore(deps): update tools to latest versions (#4551)
  - chore(deps): update tools to latest versions (#4545)
  - chore(deps): update tools to latest versions (#4542)
  - chore(deps): bump the go-minor-patch group with 4 updates (#4543)
  - chore(deps): bump anchore/sbom-action (#4544)
  - chore(deps): update tools to latest versions (#4537)
Update to version 1.40.0:
- Added Features
  - Exclude development or test dependencies for PNPM Package type [#4430 #4487 @rezmoss]
  - Catalog istio binary (pilot-discovery, pilot-agent) [#4508 #4521 @witchcraze]
  - Catalog envoy binary [#4506 #4530 @witchcraze]
  - Catalog grafana binary [#4505 #4516 @witchcraze]
  - Add a binary classifier for valkey [#3400 #4509 @witchcraze]
- Bug Fixes
  - old bitnami images without spdx files arent getting picked up correctly in the catalog [#4529 #4532 @rezmoss]
  - wrong traefik rc versions at binary detection [#3535 #4499 @rezmoss]
  - FromPOSIX() in internals\windows\path.go assumes that all Windows root paths must have a colon terminator [#4070 #4075 @luissantosHCIT]
  - binary cataloger is picking up the go version instead of the actual binary version in traefik experimental images [#4498 #4499 @rezmoss]
- Dependencies
  - chore(deps): update anchore dependencies (#4535)
  - chore(deps): bump the go-minor-patch group with 3 updates (#4524)
  - chore(deps): bump the actions-minor-patch group across 1 directory with 2 updates (#4525)
  - chore(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 (#4526)
  - chore(deps): bump actions/upload-artifact from 4.4.3 to 6.0.0 (#4527)
  - chore(deps): bump modernc.org/sqlite from 1.41.0 to 1.42.2 (#4513)
  - chore(deps): bump anchore/sbom-action from 0.20.11 to 0.21.0 (#4501)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.7 to 6.7.8 (#4502)
  - chore(deps): bump github.com/spdx/tools-golang from 0.5.5 to 0.5.6 (#4503)
  - chore(deps): update tools to latest versions (#4504)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.8.3 to 1.8.4 (#4518)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.18 to 0.5.19 (#4520)
Update to version 1.39.0:
- Added Features
  - add support for Gemfile.next.lock [#4457 @HatiCode]
  - Command output to give more information on what catalogers look for and what they can find [#4155 #4317 @wagoodman]
  - Support reading lzma compressed .go.buildinfo sections with upx [#4411 #4480 @wagoodman]
  - Specify specific snap revision to pull [#4389 #4439 @VictorHuu]
  - Cannot detect embedded deps.json metadata in single-file .NET binaries [#4344 #4375 @rezmoss]
  - ELF note cataloger does not pick up OS field, but should [#4384 #4438 @VictorHuu]
- Bug Fixes
  - remove debug print statement in dependency parser [#4412 @cgreeno]
  - dotnet-deps cataloger should skip project references with type "project" when building the sbom [#4423 #4436 @rezmoss]
  - File digests not computed when using --base-path [#4410 #4478 @wagoodman]
  - Syft should not define subpaths by default in PURLs [#4394 #4395 @rezmoss]
  - go: valid purl but incorrect name [#1737 #4395 @rezmoss]
  - Incorrect Go module PURL generation when module path contains /vN (e.g. /v5) [#4316 #4395 @rezmoss]
  - Failing to convert npm repository information correctly to SPDX [#4362 #4390 @kendrickm]
- Dependencies
  - chore(deps): update tools to latest versions (#4491)
  - chore(deps): bump modernc.org/sqlite from 1.40.1 to 1.41.0 (#4489)
  - chore(deps): bump github/codeql-action from 4.31.8 to 4.31.9 (#4481)
  - chore(deps): bump github.com/goccy/go-yaml from 1.19.0 to 1.19.1 (#4482)
  - chore(deps): bump actions/cache from 5.0.0 to 5.0.1 (#4476)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap (#4477)
  - chore(deps): update tools to latest versions (#4473)
  - chore(deps): update tools to latest versions (#4466)
  - chore(deps): bump github/codeql-action from 4.31.7 to 4.31.8 (#4468)
  - chore(deps): bump actions/cache from 4.3.0 to 5.0.0 (#4469)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.14 to 0.1.16 (#4470)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap (#4471)
  - chore(deps): update tools to latest versions (#4462)
  - chore(deps): update tools to latest versions (#4456)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.5 to 6.7.7 (#4460)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.11 to 8.0.0 (#4459)
  - chore(deps): bump anchore/sbom-action from 0.20.10 to 0.20.11 (#4458)
Update to version 1.38.2 (.1 was not released):
- Bug Fixes
  - drop cpe from gguf [#4383 @spiffcs]
  - emit lua rockspec dependencies in metadata [#4376 @willmurphyscode]
  - Invalid SBOMs are created when GO replace directive is used [#4415 #4419 @VictorHuu]
  - Incorrect CPE for Vercel's Next js [#4443 #4450 @willmurphyscode]
  - v1.38.0 generates empty sbom for tgz sources [#4416 #4421 @VictorHuu]
  - Syft: The dependency graph does not include all Requires-Dist relationships defined in the package's METADATA file [#4401 #4408 @willmurphyscode]
- Dependencies
  - chore(deps): update anchore dependencies (#4440)
  - chore(deps): update tools to latest versions (#4442)
  - chore(deps): bump peter-evans/create-pull-request from 7.0.8 to 7.0.11 (#4447)
  - chore(deps): bump actions/create-github-app-token from 2.1.4 to 2.2.1 (#4445)
  - chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.2 to 5.7.0 (#4448)
  - chore(deps): bump github/codeql-action from 4.31.6 to 4.31.7 (#4446)
  - chore(deps): bump golang.org/x/tools from 0.39.0 to 0.40.0 (#4453)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.4 to 2.3.5 (#4434)
  - chore(deps): bump github.com/spf13/cobra from 1.10.1 to 1.10.2 (#4435)
  - chore(deps): bump actions/checkout from 6.0.0 to 6.0.1 (#4431)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.17 to 0.5.18 (#4432)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.15 to 0.5.17 (#4413)
  - chore(deps): update tools to latest versions (#4420)
  - chore(deps): bump github.com/olekukonko/tablewriter from 1.1.1 to 1.1.2 (#4427)
  - chore(deps): bump github/codeql-action from 4.31.4 to 4.31.6 (#4424)
  - chore(deps): bump github.com/goccy/go-yaml from 1.18.0 to 1.19.0 (#4426)
  - chore(deps): bump anchore/sbom-action from 0.20.9 to 0.20.10 (#4381)
  - chore(deps): bump modernc.org/sqlite from 1.40.0 to 1.40.1 (#4382)
  - chore(deps): bump actions/checkout from 5.0.0 to 6.0.0 (#4396)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.3 to 6.7.5 (#4397)
  - chore(deps): update tools to latest versions (#4398)
  - chore(deps): bump github.com/google/go-containerregistry (#4409)
  - chore(deps): bump github/codeql-action from 4.31.3 to 4.31.4 (#4386)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.2 to 6.7.3 (#4387)
  - chore(deps): bump golang.org/x/crypto from 0.44.0 to 0.45.0 (#4391)
  - chore(deps): bump actions/setup-go from 6.0.0 to 6.1.0 (#4392)
  - chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#4393)
Update to version 1.38.0:
- Added Features
  - add support for cataloging GGUF models [#4184 #4279 @spiffcs]
  - Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
  - Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]
- Bug Fixes
  - Support extras statements in Python PDM cataloger [#4352 @wagoodman]
  - Preserve --from argument order [#4350 @wagoodman]
  - SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
  - empty PURL output in dependency snapshot format breaks sbom-action [#4311]
  - Interface includes constraint elements, can only be used in type parameters [#4346]
  - Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
  - Upgrade to Golang 1.25.4 [#4341]
- Additional Changes
  - migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
  - Add license enrichment from pypi to python packages [#4295 @timols]
  - license file search [#4327 @kzantow]
- Dependencies
  - chore(deps): update anchore dependencies (#4374)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.1 to 6.7.2 (#4372)
  - chore(deps): bump golang.org/x/tools from 0.38.0 to 0.39.0 (#4364)
  - chore(deps): update tools to latest versions (#4370)
  - chore(deps): update tools to latest versions (#4365)
  - chore(deps): bump github/codeql-action from 4.31.2 to 4.31.3 (#4366)
  - chore(deps): update tools to latest versions (#4358)
  - chore(deps): bump golang.org/x/mod from 0.29.0 to 0.30.0 (#4359)
  - chore(deps): bump github.com/olekukonko/tablewriter from 1.0.9 to 1.1.1 (#4354)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.7.0 to 6.7.1 (#4355)
  - chore(deps): update tools to latest versions (#4347)
  - chore(deps): bump github.com/opencontainers/selinux (#4349)
  - chore(deps): bump golang.org/x/time from 0.12.0 to 0.14.0 (#4348)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.9 to 6.7.0 (#4337)
  - chore(deps): bump github.com/containerd/containerd from 1.7.28 to 1.7.29 (#4340)
Update to version 1.37.0:
- Added Features
  - Refactor fileresolver to not require base path [#4298 @Rupikz]
  - Describe cataloger capabilities via test observations [#4318 @wagoodman]
  - Support Java resource adapter extension .far as a Java archive [#4183 #4193 @kyounghunJang]
  - Add Java resource adapter extension ".rar" as supported Java archive [#4136 #4137 @thomassui]
- Bug Fixes
  - fix empty PURL Github format [#4312 @rezmoss]
  - Canonicalize Ghostscript CPE/PURL for ghostscript packages from PE Binaries [#4308 @kdt523]
  - Respect "rpmmod" PURL qualifier [#4314 @willmurphyscode]
  - fix dpkg packages that are in deinstalled state should not be in SBOM [#3063 #4231 @rkirk-nos]
- Dependencies
  - chore(deps): update anchore dependencies (#4330)
  - chore(deps): bump github/codeql-action from 4.31.1 to 4.31.2 (#4325)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.8.2 to 1.8.3 (#4326)
  - chore(deps): bump modernc.org/sqlite from 1.39.1 to 1.40.0 (#4329)
  - chore(deps): bump github/codeql-action from 4.31.0 to 4.31.1 (#4321)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.8 to 6.6.9 (#4315)
  - chore(deps): bump github/codeql-action from 4.30.9 to 4.31.0 (#4310)
  - chore(deps): bump anchore/sbom-action from 0.20.8 to 0.20.9 (#4305)
  - chore(deps): update tools to latest versions (#4307)
Update to version 1.36.0 (1.35.0 was not released):
- Added Features
  - Add the ability to fetch remote licenses for pnpm-lock.yaml files [#4286 @timols]
  - support universal (fat) mach-o binary files [#4278 @JoeyShapiro]
  - pdm support [#2709 #4234 @paulslaby]
- Bug Fixes
  - Remove duplicate image source providers [#4289 @Rupikz]
  - syft can't extract go module information from executables on Windows [#4271 #4285 @JoeyShapiro]
- Dependencies
  - chore(deps): update tools to latest versions (#4302)
  - chore(deps): bump github.com/github/go-spdx/v2 from 2.3.3 to 2.3.4 (#4301)
  - chore(deps): bump github/codeql-action from 4.30.8 to 4.30.9 (#4299)
  - chore(deps): bump sigstore/cosign-installer from 3.10.0 to 4.0.0 (#4296)
  - chore(deps): bump anchore/sbom-action from 0.20.7 to 0.20.8 (#4297)
  - chore(deps): bump anchore/sbom-action from 0.20.6 to 0.20.7 (#4293)
Update to version 1.34.2:
- Bug Fixes
  - Extract zip archive with multiple entries [#4283 @Rupikz]
  - panic while resolving maven properties in archive parser [#4288 #4290 @kzantow]
- Dependencies
  - chore(deps): update tools to latest versions (#4291)
Update to version 1.34.1 (1.34.0 was not released):
- Added Features
  - feat: enhance setup.py parser to handle unquoted dependencies [#4255 @HalaAli198]
  - feat: support for identifying ffmpeg/libav libraries [#4227 @popey]
  - feat: PNPM latest lockfile (version 9.0) [#3927 #4256 @bernardoamc]
  - Add Windows ARM64 releases [#4179 #4237 @compnerd]
- Bug Fixes
  - fix: SBOM CPE mismatch for Qt5 causes Grype to miss CVE matches [#4036 #4093 @hawkaii]
  - fix: use of manifest files present in Snap packages when generating SBOMs [#4147 #4151 @popey]
  - fix: Pom xml only archive parser [#4272 @douglasclarke]
- Dependencies
  - chore(deps): bump actions/cache from 4.2.4 to 4.3.0 (#4240)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap (#4241)
  - chore(deps): bump anchore/sbom-action from 0.20.5 to 0.20.6 (#4222)
  - chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.2 to 0.9.3 (#4251)
  - chore(deps): bump github.com/charmbracelet/bubbletea (#4228)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.14 to 0.5.15 (#4225)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.2 to 5.16.3 (#4259)
  - chore(deps): bump github.com/gohugoio/hashstructure from 0.5.0 to 0.6.0 (#4267)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.8.0 to 1.8.1 (#4229)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.8.1 to 1.8.2 (#4254)
  - chore(deps): bump github.com/iancoleman/orderedmap (#4258)
  - chore(deps): bump github.com/mholt/archives from 0.1.3 to 0.1.5 (#4280)
  - chore(deps): bump github.com/quasilyte/go-ruleguard/dsl (#4245)
  - chore(deps): bump github/codeql-action from 3.30.3 to 3.30.4 (#4239)
  - chore(deps): bump github/codeql-action from 3.30.4 to 3.30.5 (#4246)
  - chore(deps): bump github/codeql-action from 3.30.5 to 3.30.6 (#4253)
  - chore(deps): bump github/codeql-action from 3.30.6 to 4.30.7 (#4262)
  - chore(deps): bump github/codeql-action from 4.30.7 to 4.30.8 (#4277)
  - chore(deps): bump golang.org/x/mod from 0.28.0 to 0.29.0 (#4266)
  - chore(deps): bump golang.org/x/net from 0.44.0 to 0.45.0 (#4263)
  - chore(deps): bump golang.org/x/net from 0.45.0 to 0.46.0 (#4268)
  - chore(deps): bump golang.org/x/tools from 0.37.0 to 0.38.0 (#4265)
  - chore(deps): bump modernc.org/sqlite from 1.39.0 to 1.39.1 (#4276)
  - chore(deps): update anchore dependencies (#4282)
  - chore(deps): update tools to latest versions (#4221)
  - chore(deps): update tools to latest versions (#4230)
  - chore(deps): update tools to latest versions (#4236)
  - chore(deps): update tools to latest versions (#4238)
  - chore(deps): update tools to latest versions (#4248)
  - chore(deps): update tools to latest versions (#4261)
  - chore(deps): update tools to latest versions (#4274)
  - chore: update ffmpeg tests (#4249)
  - chore: update to use old configuration on new cosign (#4287)
Update to version 1.33.0:
- Added Features
  - Modify RpmDBEntry to include modularityLabel for cyclonedx [#4212 @sfc-gh-rmaj]
  - Add locations onto packages read from Java native image SBOMs [#4186 @rudsberg]
- Dependencies
  - chore(deps): update anchore dependencies (#4220)
  - chore(deps): update tools to latest versions (#4215)
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.2 to 0.2.0 (#4216)
  - chore(deps): bump 8398a7/action-slack from 3.18.0 to 3.19.0 (#4217)
  - chore(deps): bump sigstore/cosign-installer from 3.9.2 to 3.10.0 (#4218)
  - chore(deps): bump modernc.org/sqlite from 1.38.2 to 1.39.0 (#4219)
  - chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.8 to 1.3.9 (#4214)
  - chore(deps): bump github.com/spf13/afero from 1.14.0 to 1.15.0 (#4202)
  - chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.6 to 1.3.8 (#4203)
  - chore(deps): bump github.com/vbatts/go-mtree from 0.5.4 to 0.6.0 (#4204)
  - chore(deps): update tools to latest versions (#4200)
  - chore(deps): bump github/codeql-action from 3.30.1 to 3.30.3 (#4210)
  - chore(deps): bump golang.org/x/tools from 0.36.0 to 0.37.0 (#4211)
  - chore(deps): update tools to latest versions (#4194)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.7.10 to 1.8.0 (#4197)
  - chore(deps): bump golang.org/x/mod from 0.27.0 to 0.28.0 (#4198)
  - chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.1 (#4182)
  - chore(deps): bump actions/setup-go from 5.5.0 to 6.0.0 (#4188)
  - chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#4189)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.7.9 to 1.7.10 (#4190)
  - chore(deps): bump github/codeql-action from 3.30.0 to 3.30.1 (#4191)
  - chore(deps): bump actions/github-script from 7 to 8 (#4192)
  - chore(deps): bump github.com/stretchr/testify from 1.11.0 to 1.11.1 (#4173)
  - chore(deps): update tools to latest versions (#4185)
  - chore(deps): bump github.com/ulikunitz/xz from 0.5.12 to 0.5.14 (#4178)
  - chore(deps): bump github.com/spf13/cobra from 1.9.1 to 1.10.0 (#4180)
  - chore(deps): bump github/codeql-action from 3.29.11 to 3.30.0 (#4181)
  - chore(deps): bump github.com/anchore/stereoscope (#4174)
  - chore(deps): bump github.com/gookit/color from 1.5.4 to 1.6.0 (#4176)
  - chore(deps): bump golang.org/x/tools from 0.35.0 to 0.36.0 (#4172)
Update to version 1.32.0:
- Added Features
  - Catalog entire build list for Go projects, not just packages listed in go.mod [#432 #4127 @spiffcs]
  - package.json authors keyword parsing [#2250 #4003 @popey]
  - Conda ecosystem support (basic) [#4002@SimeonStoykovQC]
- Bug Fixes
  - When scanning the FFmpeg binary with Syft a new package is now added [#3988 #3994 @popey]
  - Warn loudly if SQLite driver is not present when needed [#3234 #4150 @kzantow]
- Additional Changes
  - Update dependencies to use go.yaml.in/yaml [#4157 @n-bes]
  - chore(deps): update anchore dependencies (#4169)
  - chore(deps): bump github.com/diskfs/go-diskfs (#4159)
  - chore(deps): bump github.com/stretchr/testify from 1.10.0 to 1.11.0 (#4160)
  - chore(deps): update tools to latest versions (#4154)
  - chore(deps): bump github/codeql-action from 3.29.10 to 3.29.11 (#4149)
  - chore(deps): bump github/codeql-action from 3.29.9 to 3.29.10 (#4145)
  - chore(deps): update CPE dictionary index (#4143)
  - chore(deps): bump github.com/hashicorp/go-getter from 1.7.8 to 1.7.9 (#4144)
  - chore(deps): bump anchore/sbom-action from 0.20.4 to 0.20.5 (#4141)
  - chore(deps): update tools to latest versions (#4139)
Update to version 1.31.0:
- Added Features
  - Option to set PackageSupplier in root of SPDX document generated by CLI [#3098 #4131 @spiffcs]
- Bug Fixes
  - closed reader during java binary detection [#4129 @kzantow]
  - support multiple letters in openssl patch version [#4106 @honigbot]
  - Can not have license ID [#1964 #4132 @spiffcs]
  - Syft sometimes reports URL for license value when scanning JARs with a URL in Bundle-License field of manifest [#3186]
- Dependencies
  - chore(deps): bump zizmorcore/zizmor-action from 0.1.1 to 0.1.2 (#4135)
  - chore(deps): bump github/codeql-action from 3.29.8 to 3.29.9 (#4134)
  - chore(deps): bump actions/checkout from 4.2.2 to 5.0.0 (#4130)
  - chore(deps): update CPE dictionary index (#4126)
Update to version 1.30.0:
- Added Features
  - add binary classifier for hashicorp vault [#4121 @willmurphyscode]
- Bug Fixes
  - fix: update nondeterministic Java archive cataloging and improve groupID [#3521 #4118 @kzantow]
- Dependencies
  - chore(deps): bump golang.org/x/net from 0.42.0 to 0.43.0 (#4122)
  - chore(deps): bump golang.org/x/mod from 0.26.0 to 0.27.0 (#4123)
  - chore(deps): bump github/codeql-action from 3.29.7 to 3.29.8 (#4124)
  - chore(deps): bump docker/login-action from 3.4.0 to 3.5.0 (#4115)
  - chore(deps): bump actions/cache from 4.2.3 to 4.2.4 (#4119)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap (#4120)
  - chore(deps): update tools to latest versions (#4111)
  - chore(deps): update CPE dictionary index (#4112)
  - chore(deps): update tools to latest versions (#4108)
  - chore(deps): bump github/codeql-action from 3.29.4 to 3.29.5 (#4096)
Update to version 1.29.1:
- Bug Fixes
  - Missing license information for tzdata [#4102]
  - Improve JVM Scan Accuracy for JDK and JRE Detection [#4071 #4046 @kzantow]
  - Azul JDK classified as Oracle JRE [#3893 #4046 @kzantow]
- Dependencies
  - chore(deps): update anchore dependencies (#4104)
  - chore(deps): update anchore dependencies (#4098)
  - chore(deps): bump github.com/anchore/stereoscope (#4091)
  - chore(deps): bump github.com/docker/docker (#4092)
  - chore(deps): bump modernc.org/sqlite from 1.38.1 to 1.38.2 (#4088)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.13 to 0.5.14 (#4089)
  - chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.9.0 to 4.9.1 (#4087)
  - chore(deps): bump github.com/olekukonko/tablewriter from 1.0.8 to 1.0.9 (#4086)
  - chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.7 to 6.6.8 (#4085)
  - chore(deps): bump modernc.org/sqlite from 1.38.0 to 1.38.1 (#4084)
  - chore(deps): update tools to latest versions (#4082)
  - chore(deps): update CPE dictionary index (#4083)
  - chore(deps): update tools to latest versions (#4079)
  - chore(deps): bump github/codeql-action from 3.29.3 to 3.29.4 (#4080)
  - chore(deps): update tools to latest versions (#4076)
  - chore(deps): update tools to latest versions (#4072)
  - chore(deps): bump github/codeql-action from 3.29.2 to 3.29.3 (#4074)
  - chore(deps): bump anchore/sbom-action from 0.20.2 to 0.20.4 (#4073)
Update to version 1.29.0:
- Added Features
  - Catalog python uv.lock files [#3268 #3763 @jkugler]
- Additional Changes
  - Pkg Metadata type unmarshal bug [#4043 @houdini91]
- Dependencies
  - chore(deps): update anchore dependencies (#4068)
  - chore(deps): bump pygments (#4064)
  - chore(deps): update tools to latest versions (#4065)
  - chore(deps): bump sigstore/cosign-installer from 3.9.1 to 3.9.2 (#4066)
  - chore(deps): update CPE dictionary index (#4067)
  - chore(deps): bump marocchino/sticky-pull-request-comment (#4063)
  - chore(deps): update tools to latest versions (#4060)
  - chore(deps): bump github.com/go-viper/mapstructure/v2 (#4061)
  - chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.8.1 to 4.9.0 (#4059)
  - chore(deps): bump golang.org/x/mod from 0.25.0 to 0.26.0 (#4054)
  - chore(deps): update tools to latest versions (#4053)
  - chore(deps): bump golang.org/x/net from 0.41.0 to 0.42.0 (#4056)
  - chore(deps): update CPE dictionary index (#4058)
  - chore(deps): bump github.com/olekukonko/tablewriter from 1.0.7 to 1.0.8 (#4049)
  - chore(deps): update CPE dictionary index (#4050)
  - chore(deps): bump github.com/hashicorp/hcl/v2 from 2.23.0 to 2.24.0 (#4051)
  - chore(deps): bump github.com/charmbracelet/bubbletea from 1.3.5 to 1.3.6 (#4052)
  - chore(deps): bump anchore/sbom-action from 0.20.1 to 0.20.2 (#4048)
Update to version 1.28.0:
- Added Features
  - add native support for snap packages [#1088 #3929 @wagoodman]
- Additional Changes
  - upgrade tablewriter dependency to use new API [#3990 @cpanato]
- Dependencies
  - chore(deps): update anchore dependencies (#4047)
  - chore(deps): update anchore dependencies (#4045)
  - chore: upgrade tablewriter dependency to use new API (#3990)
  - chore(deps): bump github.com/Masterminds/semver/v3 from 3.3.1 to 3.4.0 (#4040)
  - chore: update tests to read from latest test-fixture-cache and fix cache publish (#4042)
  - chore(deps): bump github.com/mholt/archives from 0.1.2 to 0.1.3 (#4032)
  - chore(deps): bump marocchino/sticky-pull-request-comment (#4019)
  - chore(deps): bump sigstore/cosign-installer from 3.9.0 to 3.9.1 (#4022)
  - chore(deps): update tools to latest versions (#4035)
  - chore(deps): update CPE dictionary index (#4037)
  - chore(deps): bump github/codeql-action from 3.29.0 to 3.29.2 (#4039)
  - chore(deps): update CPE dictionary index (#4021)
  - chore(deps): update tools to latest versions (#4016)
  - chore(deps): update tools to latest versions (#4012)
  - chore(deps): bump github.com/go-viper/mapstructure/v2 (#4014)
  - chore(deps): bump sigstore/cosign-installer from 3.8.2 to 3.9.0 (#4015)
  - chore(deps): update CPE dictionary index (#4007)
  - chore(deps): bump anchore/sbom-action from 0.20.0 to 0.20.1 (#4008)
  - chore(deps): bump github.com/google/go-containerregistry (#4009)
  - chore(deps): update tools to latest versions (#3992)
  - chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0 (#4000)
Update to version 1.27.1:
- fix: provide separate nonroot image (#3998)
- account for non-import shapes (#3997)
- Allow decoding of anchorectl json files (#3973)
- chore(deps): bump github.com/anchore/stereoscope (#3991)
Update to version 1.27.0:
- Added Features
  - add syft schema version to version command [#3949 @spiffcs]
- Bug Fixes
  - Remove CPE product candidates for phf, prometheus, hyper and Rust crates [#3967 @jayvdb]
  - Remove CPE product candidates for opentelemetry and redis Rust crates [#3962 @jayvdb]
  - Harden Container Runtime with Non-Root User [#3941 @MikeTheCyberGuy]
  - terraform provider lock entries should not require constraints [#3934 @ghouscht]
  - sbom cataloger returning upstream package [#3662 #3981 @kzantow]
  - Syft missing md5 sums and list data for dpkg packages under status.d/ [#3912]
  - Failure to detect dependency relationships between Python packages [#3958 #3965 @christoph-blessing]
  - Heavy memory consumption when directory scanning deb source [#3928 #3953 @kzantow]
  - In versions 1.25.0 and later, graalvm-native-image-cataloger adds 3-6 hours to Syft [#3942 #3944 @kzantow]
  - Syft incorrectly reports multiple APKs as parents of symlinked files [#3847 #3923 @luhring]
- Dependencies
  - chore(deps): bump modernc.org/sqlite from 1.37.1 to 1.38.0 (#3979)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.1 to 5.16.2 (#3978)
  - chore(deps): update tools to latest versions (#3977)
  - chore(deps): update CPE dictionary index (#3976)
  - chore(deps): bump golang.org/x/net from 0.40.0 to 0.41.0 (#3970)
  - chore(deps): bump github.com/sergi/go-diff (#3971)
  - chore(deps): bump golang.org/x/mod from 0.24.0 to 0.25.0 (#3963)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.12 to 0.5.13 (#3964)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.16.0 to 5.16.1 (#3960)
  - chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19 (#3952)
  - chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.11 to 0.5.12 (#3943)
  - chore(deps): update tools to latest versions (#3945)
  - chore(deps): update CPE dictionary index (#3947)
  - chore(deps): bump github.com/google/go-containerregistry (#3933)
  - chore(deps): update CPE dictionary index (#3935)
  - chore(deps): bump modernc.org/sqlite from 1.37.0 to 1.37.1 (#3926)
Update to version 1.26.1:
- fix(dotnet-deps-cataloger): avoid repeated dependency resolution (#3930)
- chore(deps): update tools to latest versions (#3921)
- chore(deps): bump github.com/google/go-containerregistry (#3925)
Update to version 1.26.0:
- Added Features
  - Read version resources from non-.NET DLLs and executables [#3842 #3911 @wagoodman]
- Bug Fixes
  - pkg.JavaArchive.PomProperties is being populated even though no pom.properties file was present for analysis [#3922 @wagoodman]
  - syft 1.24.0 debug container - wget fails TLS [#3891 #3915 @spiffcs]
- Dependencies
  - chore(deps): update CPE dictionary index (#3913)
Update to version 1.25.1:
- remove go-rpmdb replace directive [#3908 @wagoodman]
Update to version 1.25.0:
- Added Features
  - Add PHP interpreter + extensions cataloger [#2585 @LaurentGoderre]
- Bug Fixes
  - update license content filtering default case to be 'none' for no content [#3903 @spiffcs]
  - Distinguish openjdk vs jdk when using file source [#3895 @adammcclenaghan]
  - Make it discoverable if Native Image contains no embedded SBOM [#3731 #3805 @sathiya06]
- Dependencies
  - chore(deps): bump github/codeql-action from 3.28.17 to 3.28.18 (#3905)
  - chore(deps): bump github.com/mholt/archives from 0.1.1 to 0.1.2 (#3898)
  - chore(deps): bump anchore/sbom-action from 0.19.0 to 0.20.0 (#3899)
Update to version 1.24.0: https://github.com/anchore/syft/compare/v1.23.1...v1.24.0
- Added Features
  - Add cataloger for Dart pubspec [#3292 @LaurentGoderre]
  - Translate Portage license strings to SPDX expressions [#1763 @wagoodman]
  - Use package ID from decoded SBOMs when provided [#1872 @jneate]
  - Annotate visible/hidden paths when all-layers scope [#3855 @wagoodman]
  - Add support for PHP Pear [#2775 @LaurentGoderre]
  - Detect whether full license text or a license name has been provided [#3088 #3876 @spiffcs #3450 @spiffcs]
  - Add Cataloger for Homebrew on macOS [#3632 #3724 @rezmoss]
  - Provide a way to get the LayerID the package was first found in [#435 #3858 @wagoodman #3138 @tomersein]
  - Go binaries that currently get (devel) as the version should instead stub UNKNOWN based on the compliance policy [#3324 #3873 @wagoodman]
  - Upgrade base Docker image to gcr.io/distroless/static-debian12 [#3840 #3862 @bgoareguer]
  - Return full license string instead of SHA256 hash when license string exceeds 64 characters [#3780 #3844 @spiffcs]
  - Detect nix dependencies [#3814 #3837 @wagoodman]
- Bug Fixes
  - update license sort to be stable with contents field [#3860 @spiffcs]
  - Improve detection of erlang binary in alpine Linux [#3839 @avodotiiets]
  - Do not search for main module versions within binary contents by default [#3874 @wagoodman]
  - dpkg license improvement for non SPDX licenses [#3090 #3888 @spiffcs]
  - CycloneDX group field not symmetrically handled by encoder/decoders [#2981 #3853 @kzantow]
  - Syft crash [signal SIGSEGV: segmentation violation code=0x80 addr=0x0 pc=0x123a0da] [#3872 #3875 @wagoodman]
  - Syft 1.23.1 shows version (devel) for grafana 12.0.0 [#3864]
  - .NET cataloger does not always pair up PE binaries and deps.json packages, resulting in duplicate packages on some runs [#3866 #3869 @wagoodman]
  - Propagate error in FileSourceProvider instead of warn log [#3831 #3845 @Rupikz]
  - Update github.com/Masterminds/semver package [#3829 #3836 @popey]
  - go-module-file-cataloger fails if symlinks in path [#3614 #3783 @VictorHuu]
  - Support fluent-bit some versions of arm/s390x images [#3793 #3817 @VictorHuu]
- Additional Changes
  - update rust test fixtures to latest [#3852 @spiffcs]
Update to version 1.23.1:
- chore(deps): update tools to latest versions (#3830)
- Resolve owned file paths when searching for overlaps (#3828)
Update to version 1.23.0:
- Added Features
  - Support skipping archive extraction with file source [#3795 @adammcclenaghan]
  - Use the R cataloger in directory scans [#3774 @spiffcs]
  - Add support for detecting javascript assets in .NET projects using libman [#3825 @wagoodman]
  - Parse GitHub actions comments [#3776 @wagoodman]
  - Support chrome binary detection [#3174 #3136 @lem-onade]
  - Add support for detecting undeclared license files scanning from python installations [#2624 #3779 @wagoodman]
- Bug Fixes
  - .NET cataloger should consider compile target paths from deps.json [#3821 @wagoodman]
  - Skip license scanner injection [#3796 @adammcclenaghan]
  - Delete collection name/type key entries when empty [#3797 @adammcclenaghan]
  - Use module name over relative paths in go.mod replace directives [#3812 @VictorHuu]
  - Correct variable names for Conan lock parsing version handling [#3802 @musangk]
  - Consider DLL claims for dependencies of .NET packages from deps.json [#3822 @wagoodman]
  - Empty source during decoding an SBOM document should not be fatal [#3791 @wagoodman]
  - Dpkg are not detected when scanning a directory [#3726 #3820 @VictorHuu]
  - Support golang tip image [#3681 #3757 @VictorHuu]
  - syft cataloger list should flatten options [#3801 #3804 @kzantow]
  - Unable to generate a correct SBOM for C++ project [#3755]
- Dependencies
  - chore(deps): update anchore dependencies (#3827)
  - chore(deps): update tools to latest versions (#3823)
  - chore(deps): bump sigstore/cosign-installer from 3.8.1 to 3.8.2 (#3818)
  - chore(deps): bump github/codeql-action from 3.28.15 to 3.28.16 (#3819)
  - chore(deps): update tools to latest versions (#3815)
  - chore(deps): update CPE dictionary index (#3813)
  - chore(deps): update tools to latest versions (#3806)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.15.0 to 5.16.0 (#3807)
  - chore(deps): bump github.com/anchore/stereoscope from 0.1.2 to 0.1.3 (#3803)
  - chore(deps): update tools to latest versions (#3798)
  - chore(deps): update CPE dictionary index (#3799)
  - chore(deps): bump github.com/mholt/archives from 0.1.0 to 0.1.1 (#3778)
  - chore(deps): bump marocchino/sticky-pull-request-comment (#3788)
  - chore(deps): bump github.com/magiconair/properties from 1.8.9 to 1.8.10 (#3789)
  - chore(deps): bump github.com/charmbracelet/bubbles from 0.20.0 to 0.21.0 (#3790)
  - chore(deps): bump github.com/go-git/go-git/v5 from 5.14.0 to 5.15.0 (#3792)
  - chore(deps): update tools to latest versions (#3785)
  - chore(deps): bump github/codeql-action from 3.28.13 to 3.28.15 (#3786)
  - chore(deps): bump golang.org/x/net from 0.38.0 to 0.39.0 (#3787)
  - chore(deps): update CPE dictionary index (#3782)
  - chore(deps): update tools to latest versions (#3775)
Update to version 1.22.0:
- Added Features
  - Improve .NET package CPE generation [#3764 @wagoodman]
  - Catalog deb archives directly [#3315 #3704 @popey]
- Bug Fixes
  - Dotnet-Portable-Executable-Cataloger uses wrong component version for dotnet runtime libraries [#3282 #3768 @wagoodman]
  - Dotnet deps cataloger returns "wrong" dotnet-framework dependencies and misses out on the runtime (for applications) [#2347 #3768 @wagoodman]
  - .NET deps.json should be considered as installation evidence [#3570 #3563 @wagoodman]
  - Dotnet PE binary cataloger is detecting false positives [#3469 #3563 @wagoodman]
  - Long Processing Time in dpkg-db-cataloger with all-layers Option (Syft 1.20.0) [#3683 #3636 @kzantow]
- Dependencies
  - chore(deps): update anchore dependencies (#3772)
  - chore(deps): bump golang.org/x/net from 0.37.0 to 0.38.0 (#3766)
  - chore(deps): bump 8398a7/action-slack from 3.16.2 to 3.18.0 (#3767)
  - chore(deps): bump modernc.org/sqlite from 1.36.1 to 1.37.0 (#3771)
  - chore(deps): update CPE dictionary index (#3769)
  - chore(deps): bump github/codeql-action from 3.28.12 to 3.28.13 (#3758)
  - chore(deps): update CPE dictionary index (#3756)
  - chore(deps): update tools to latest versions (#3747)
  - chore(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 (#3750)
  - chore(deps): bump github.com/docker/docker (#3749)
  - chore(deps): bump actions/cache from 4.2.2 to 4.2.3 (#3751)
  - chore(deps): bump actions/cache in /.github/actions/bootstrap (#3752)
  - chore(deps): bump actions/setup-go in /.github/actions/bootstrap (#3742)
  - chore(deps): bump actions/setup-go from 5.3.0 to 5.4.0 (#3743)
  - chore(deps): bump github/codeql-action from 3.28.11 to 3.28.12 (#3744)
  - chore(deps): bump github.com/BurntSushi/toml from 1.4.0 to 1.5.0 (#3740)
  - chore(deps): bump github.com/containerd/containerd from 1.7.26 to 1.7.27 (#3738)
  - chore(deps): update tools to latest versions (#3739)
Update to version 1.21.0:
- chore(deps): update anchore dependencies (#3727)
- chore(deps): update CPE dictionary index (#3735)
- chore(deps): update tools to latest versions (#3722)
- chore(deps): bump github.com/spf13/afero from 1.12.0 to 1.14.0 (#3736)
- chore(deps): bump modernc.org/sqlite from 1.36.0 to 1.36.1 (#3737)
- chore(deps): bump github.com/charmbracelet/lipgloss from 1.0.0 to 1.1.0 (#3732)
- chore(deps): bump docker/login-action from 3.3.0 to 3.4.0 (#3733)
- fix(performance): reduce memory allocation in containsPath (#3730)
- chore: upload individual binaries as artifacts (#3714)
- fix: fetch Dart package versions from sdk entries (#3572)
- chore(deps): update tools to latest versions (#3713)
- chore(deps): update CPE dictionary index (#3715)
- Add set ID to dotnet packages (#3719)
- chore(deps): bump github/codeql-action from 3.28.10 to 3.28.11 (#3716)
- Location order on packages should consider evidence annotations when sorting (#3720)
- chore: fix some function names in comment (#3717)
- fix: improve fluent-bit binary detection regex pattern (#3701)
- chore: updates for go 1.24.1 (#3712)
- chore(deps): bump golang.org/x/mod from 0.23.0 to 0.24.0 (#3708)
- Update rustaudit module name (#3689)
- chore(deps): bump golang.org/x/net from 0.35.0 to 0.37.0 (#3711)
- chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.4 to 1.3.4 (#3690)
- Add downloadLocation URI validation (#3697)
- Native Image SBOM: support extracting symbols in .dynsym section for ELF files (#3647)
- chore(deps): bump github.com/google/go-cmp from 0.6.0 to 0.7.0 (#3687)
- chore(deps): bump modernc.org/sqlite from 1.35.0 to 1.36.0 (#3692)
- chore(deps): bump github.com/go-git/go-git/v5 from 5.13.2 to 5.14.0 (#3693)
- chore(deps): bump github.com/docker/docker (#3694)
- chore(deps): bump actions/cache from 4.2.1 to 4.2.2 (#3698)
- chore(deps): bump actions/cache in /.github/actions/bootstrap (#3699)
- chore(deps): update CPE dictionary index (#3702)
- chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.6 to 6.6.7 (#3703)
- chore(deps): bump golang.org/x/net from 0.35.0 to 0.36.0 (#3709)
- chore(deps): bump peter-evans/create-pull-request from 7.0.7 to 7.0.8 (#3706)
- suppress file already closed errors (#3695)
- Fix /etc/redhat-release file parsing when resolving distro details (#3688)
- chore(deps): bump sigstore/cosign-installer from 3.8.0 to 3.8.1 (#3675)
- chore: disable line wrapping glow output (#3679)
- chore(deps): update CPE dictionary index (#3682)
- chore(deps): bump peter-evans/create-pull-request from 7.0.6 to 7.0.7 (#3684)
- chore(deps): bump github/codeql-action from 3.28.9 to 3.28.10 (#3685)
- chore(deps): bump actions/upload-artifact from 4.6.0 to 4.6.1 (#3686)
Update to version 1.20.0:
- Added Features
  - Add file catalogers to selection configuration [#3505 @wagoodman]
  - Configuration for including license contents in SBOM [#3626 #3631 @spiffcs]
  - Support Bitnami embedded SBOMs [#3065 #3341 @juan131]
- Bug Fixes
  - Version parse caused by line breaks on different platforms [#3672 @idhyt]
  - find bitnami files even when no relationships [#3676 @willmurphyscode]
  - License files which do not match an SPDX expression are erroneously handled as 'unlicensed' [#3412 #3366 @HeyeOpenSource]
  - Incorrect URL encoding of package url (purl) [#3533 #3678 @kzantow]
  - syft should not warn on known bad package.json [#3470 #3645 @kzantow]
  - Scanning a project with many DLLs is slow [#3455 #3677 @rogueai]
  - cyclone-dx presenter drops files, includes only packages [#3435 #3539 @spiffcs]
  - "syft config" output swaps comments for search-indexed-archives / search-unindexed-archives [#3624 #3630 @spiffcs]
  - dpkg license improvement for non SPDX licenses [#3090 #3366 @HeyeOpenSource]
  - RPM-based PURLs sometimes have incorrect namespace (specifically OpenSUSE) [#3534 #3615 @mprpic]
- Additional Changes
  - update to go 1.24.x [#3660 @westonsteimel]
  - replace all shorthand tags of mapstruct -> mapstructure [#3633 @spiffcs]
Update to version 1.19.0:
- chore(deps): update tools to latest versions (#3602)
- chore(deps): bump github/codeql-action from 3.28.1 to 3.28.2 (#3604)
- chore(deps): bump github.com/hashicorp/hcl/v2 from 2.22.0 to 2.23.0 (#3605)
- chore(deps): bump github.com/aquasecurity/go-pep440-version (#3606)
- chore: bump stereoscope to v0.0.13 (#3601)
- feat(cataloger): add a terraform provider cataloger (#3378)
- chore(deps): update tools to latest versions (#3597)
- chore(deps): update CPE dictionary index (#3599)
- chore(deps): bump actions/setup-go from 5.2.0 to 5.3.0 (#3600)
- feat(golang): add license parsing from vendor dirs (#3522)
- chore: bump packageurl-go with new parsing rules (#3596)
- chore(deps): bump marocchino/sticky-pull-request-comment (#3595)
- feat: add cataloger for NuGet packages (#3484)
- allow disabling all package catalogers (#3468)
- chore(deps): bump github.com/google/go-containerregistry (#3592)
- chore(deps): bump modernc.org/sqlite from 1.34.4 to 1.34.5 (#3593)
- chore(deps): update tools to latest versions (#3582)
- chore: update README.md's link to Nixpkgs (#3578)
- chore(deps): bump github.com/sanity-io/litter from 1.5.5 to 1.5.6 (#3579)
- chore(deps): bump github.com/spf13/afero from 1.11.0 to 1.12.0 (#3580)
- chore(deps): bump actions/upload-artifact from 4.5.0 to 4.6.0 (#3581)
- chore(deps): update CPE dictionary index (#3583)
- chore(deps): bump github/codeql-action from 3.28.0 to 3.28.1 (#3584)
- chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.1 to 5.6.2 (#3585)
- chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.7.1 to 4.8.0 (#3586)
- chore(deps): bump github.com/docker/docker (#3587)
- chore(deps): update anchore dependencies (#3571)
- chore(deps): update tools to latest versions (#3567)
- chore(deps): bump golang.org/x/net from 0.33.0 to 0.34.0 (#3568)
- fix: golang remote license search not executing when error reading local mod dir (#3549)
- chore(deps): update tools to latest versions (#3564)
- chore(deps): update CPE dictionary index (#3565)
- chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.7 to 0.5.8 (#3548)
- chore(deps): update tools to latest versions (#3560)
- chore(deps): bump github.com/go-git/go-git/v5 from 5.13.0 to 5.13.1 (#3561)
- Use reader when scanning for package versions over reading entire binary into memory (#3558)
- chore(deps): bump github.com/go-git/go-billy/v5 from 5.6.0 to 5.6.1 (#3551)
- chore(deps): update tools to latest versions (#3556)
- test: removes latest license list test (#3559)
- chore(deps): bump peter-evans/create-pull-request from 7.0.5 to 7.0.6 (#3547)
- chore(deps): update CPE dictionary index (#3550)
- chore(deps): bump github.com/go-git/go-git/v5 from 5.12.0 to 5.13.0 (#3552)
- chore(deps): update tools to latest versions (#3543)
- chore(deps): update CPE dictionary index (#3544)
- chore(deps): bump modernc.org/sqlite from 1.34.3 to 1.34.4 (#3545)
- chore(deps): bump github/codeql-action from 3.27.9 to 3.28.0 (#3546)
- chore(deps): bump golang.org/x/net from 0.32.0 to 0.33.0 (#3541)
- chore(deps): bump modernc.org/sqlite from 1.34.2 to 1.34.3 (#3542)
- chore(deps): bump actions/upload-artifact from 4.4.3 to 4.5.0 (#3537)
- chore(deps): bump github.com/docker/docker (#3538)
- chore(deps): update CPE dictionary index (#3526)
- chore(deps): bump github.com/CycloneDX/cyclonedx-go from 0.9.1 to 0.9.2 (#3530)
- chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.4 to 6.6.5 (#3531)
- chore(deps): bump anchore/sbom-action from 0.17.8 to 0.17.9 (#3532)
Update to version 1.18.1:
- chore(deps): update anchore dependencies (#3525)
- chore(deps): bump github/codeql-action from 3.27.7 to 3.27.9 (#3524)
- chore(deps): bump golang.org/x/crypto from 0.30.0 to 0.31.0 (#3523)
- chore(deps): bump actions/setup-go from 5.1.0 to 5.2.0 (#3519)
- chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#3518)
- chore: make fixes field in PR template match auto-close regex (#3520)
- fix: stop omitting redundantly parenthesized licenses in CDX formatter (#3517)
- chore: migrate syft to use the anchore fork of archiver without replace (#3516)
- Make pre-release integration PRs (#3370)
- chore(deps): bump github.com/docker/docker (#3512)
- chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.3 to 6.6.4 (#3513)
- chore(deps): bump github/codeql-action from 3.27.6 to 3.27.7 (#3514)
Update to version 1.18.0:
- chore(deps): update anchore dependencies (#3510)
- fix: convert file paths for spdx formats from absolute to relative (#3509)
- chore(deps): update CPE dictionary index (#3507)
- chore(deps): update tools to latest versions (#3506)
- chore(deps): bump github.com/magiconair/properties from 1.8.7 to 1.8.9 (#3508)
- chore(deps): bump actions/cache from 4.1.2 to 4.2.0 (#3503)
- Add relationships for rust audit binary packages (#3500)
- fix order of rust dependencies and support git sources in Cargo.lock dependencies (#3502)
- chore(deps): update tools to latest versions (#3501)
- chore(deps): bump golang.org/x/net from 0.31.0 to 0.32.0 (#3499)
- chore: add and document target for updating unit snapshots (#3498)
- fix: emit NOASSERTION for copyright text to fix SPDX 2.2 validation failure (#3495)
- chore(deps): update tools to latest versions (#3496)
- chore(deps): update tools to latest versions (#3487)
- chore(deps): bump github/codeql-action from 3.27.5 to 3.27.6 (#3494)
- chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.2 to 6.6.3 (#3489)
- feat: set max layer size (#3464)
- chore(deps): update CPE dictionary index (#3491)
- chore(deps): bump modernc.org/sqlite from 1.34.1 to 1.34.2 (#3492)
- chore(deps): bump github.com/saferwall/pe from 1.5.5 to 1.5.6 (#3493)
- chore(deps): update tools to latest versions (#3478)
- chore(deps): update CPE dictionary index (#3479)
- chore(deps): bump github.com/stretchr/testify from 1.9.0 to 1.10.0 (#3480)
- chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.3 to 1.2.4 (#3482)
- chore(deps): update stereoscope to be5deed44b7c03fcbfa6f1f42fb67202d31636a9 (#3483)
- fix: dart classifier for 2.x and ARM (#3475)
- Use file indexer directly when scanning with file source (#3333)
- chore(deps): bump anchore/sbom-action from 0.17.7 to 0.17.8 (#3476)
- chore(deps): bump github/codeql-action from 3.27.4 to 3.27.5 (#3473)
Update to version 1.17.0:
- chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3472)
- chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.2 to 1.2.3 (#3467)
- fix: bump clio to pull in logging fix (#3466)
- 3122 valid license url characters (#3449)
- 3030 license declared spdx correction (#3461)
- chore(deps): update tools to latest versions (#3463)
- chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.1 to 6.6.2 (#3465)
- chore(deps): bump modernc.org/sqlite from 1.33.1 to 1.34.1 (#3460)
- chore(deps): update CPE dictionary index (#3453)
- chore(deps): update tools to latest versions (#3454)
- chore(deps): update tools to latest versions (#3448)
- chore(deps): update tools to latest versions (#3444)
- chore(deps): bump github/codeql-action from 3.27.3 to 3.27.4 (#3446)
- feat: emit dependency relationships found in Cargo.lock (#3443)
- chore(deps): update stereoscope to aa3a3ef4efe8d8759c9aa87261b405cc003bfc9a (#3442)
- chore(deps): bump github/codeql-action from 3.27.2 to 3.27.3 (#3438)
- chore(deps): bump github.com/charmbracelet/bubbletea from 1.2.1 to 1.2.2 (#3439)
- chore(deps): bump github.com/saferwall/pe from 1.5.4 to 1.5.5 (#3440)
- chore(deps): update tools to latest versions (#3413)
- chore(deps): bump github/codeql-action from 3.27.1 to 3.27.2 (#3436)
- chore(deps): bump golang.org/x/mod from 0.21.0 to 0.22.0 (#3426)
- update node classifier (#3419)
- chore(deps): update stereoscope to 120d9ea511e2f7a9887b443c52e66cd19bb80b43 (#3424)
- chore(deps): update CPE dictionary index (#3429)
- chore(deps): bump github/codeql-action from 3.27.0 to 3.27.1 (#3431)
- chore(deps): bump golang.org/x/net from 0.30.0 to 0.31.0 (#3432)
- chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.2 to 1.2.1 (#3433)
- restore log on ui teardown (#3427)
- doc: Add official Syft logo license information (#3421)
- chore(deps): bump anchore/sbom-action from 0.17.6 to 0.17.7 (#3418)
- chore: build release sbom from go.mod (#3417)
Update to version 1.16.0:
- chore: prevent file resolver from bubbling errors in binary cataloger (#3410)
- chore(deps): update stereoscope to cbd43fb4e5d348fe680066ee6329385fd6a4f827 (#3411)
- chore(deps): update CPE dictionary index (#3414)
- chore(deps): bump github.com/adrg/xdg from 0.5.2 to 0.5.3 (#3408)
- chore(deps): bump github.com/charmbracelet/lipgloss from 0.13.1 to 1.0.0 (#3409)
- chore(deps): update stereoscope to 2ce1e520983b1c21d5150d7fae2b39e8e5ab9063 (#3405)
- Issue #3143 - fixed format conversion docs link (#3407)
- feat: support dependencies and purl for Native Image SBOMs (#3399)
- chore(deps): update stereoscope to 9c92fe30492ffeba14ed2e23ad1fd923341dda4f (#3398)
- feat: exclude devDependencies from package-lock.json parsing (#3371)
- chore(deps): bump github.com/adrg/xdg from 0.5.1 to 0.5.2 (#3394)
- chore(deps): bump anchore/sbom-action from 0.17.5 to 0.17.6 (#3393)
- fix: stack overflow in spyingIoReadCloser (#3392)
- fix: bad pom files may cause infinite loop (#3391)
Update to version 1.15.0:
- chore(deps): update stereoscope to bcc40c6817524718277256d6b774ce643f98640a (#3388)
- chore(deps): bump actions/setup-go from 5.0.2 to 5.1.0 (#3384)
- chore(deps): bump github.com/charmbracelet/bubbletea from 1.1.1 to 1.1.2 (#3385)
- chore(deps): update tools to latest versions (#3383)
- chore(deps): update CPE dictionary index (#3387)
- chore(deps): bump actions/checkout from 4.2.1 to 4.2.2 (#3380)
- feat: multi-level configuration and profiles (#3337)
- feat: Java dependency graph information (#3363)
- Expanded dpkg cataloger globs (#3373)
- Enable cargo-auditable-binary-cataloger for files/directories (#3376)
- chore(deps): bump github/codeql-action from 3.26.13 to 3.27.0 (#3374)
- chore(deps): bump github.com/charmbracelet/lipgloss (#3375)
- chore(deps): update stereoscope to 6db3c175f1f836e552b01ee70e5d5528cc04bce4 (#3362)
- chore(deps): bump actions/cache from 4.1.1 to 4.1.2 (#3364)
- chore(deps): bump anchore/sbom-action from 0.17.4 to 0.17.5 (#3365)
- chore(deps): bump github.com/go-git/go-billy/v5 from 5.5.0 to 5.6.0 (#3367)
Update to version 1.14.2:
- Create single license scanner for all catalogers (#3348)
- chore(deps): update stereoscope to a38c93517fc7d67ca1af826ac529a06c05b571d2 (#3357)
- chore(deps): update CPE dictionary index (#3358)
- chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.6.0 to 6.6.1 (#3361)
- update to latest packageurl-go (#3347)
- chore(deps): update tools to latest versions (#3342)
- chore(deps): update stereoscope to 9e57bce5efeb0ffe27770dd0b8eb2eef8b38512f (#3338)
- chore(deps): bump github.com/adrg/xdg from 0.5.0 to 0.5.1 (#3344)
- fix: use official CPE for linux kernel (#3343)
- chore(deps): bump anchore/sbom-action from 0.17.3 to 0.17.4 (#3340)
- fix: improve mariadb binary classifer to detect older versions (#3339)

References

https://www.suse.com/security/cve/CVE-2024-39331

Affected packages

openSUSE:Leap 16.0 / syft

Package

Name: syft
Purl: pkg:rpm/opensuse/syft&distro=openSUSE%20Leap%2016.0

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

1.45.0-bp160.1.1

Ecosystem specific

{
    "binaries": [
        {
            "syft": "1.45.0-bp160.1.1",
            "syft-bash-completion": "1.45.0-bp160.1.1",
            "syft-fish-completion": "1.45.0-bp160.1.1",
            "syft-zsh-completion": "1.45.0-bp160.1.1"
        }
    ]
}

Database specific

source

"https://ftp.suse.com/pub/projects/security/osv/openSUSE-SU-2026:20928-1.json"