syft Files

Added Features

• Add purl types to cataloger info cmd [PR #4984 @wagoodman]
• Python cataloger misses uv PEP 723 script lockfiles (*.py.lock) [Issue #4949] [PR #4950 @ktopcuoglu]
• Add bin classifier for Elastic agen [Issue #4973] [PR #4968 @rezmoss]
• SPDX 3 Support [Issue #4250] [PR #4269 @kzantow]
• Add Deno support [Issue #4417] [PR #4523 @rezmoss]
• Catalog Elastic Beats binary [Issue #4961] [PR #4969 @rezmoss]
• Add binary classifiers for Elastic Beats [Issue #4972] [PR #4969 @rezmoss]
• Catalog elastic-agent binary [Issue #4962]
• Add support for Bun lockfile (bun.lock) [Issue #4617] [PR #4625 @hnnynh]
• Add .bpl file support to the PE / DLL cataloger [Issue #4664] [PR #4954 @jfjrh2014]

Bug Fixes

• respect arch qualifier [PR #4987 @willmurphyscode]
• Preserve dependency edges when a compliance stub changes a package ID [PR #4993 @wagoodman]
• Support envoy binary various versions [Issue #4590] [PR #4605 @rezmoss]
• .net deps.json cataloger shows phantom pkgs for reference assembly library entries [Issue #4970] [PR #4971 @rezmoss]
• Syft does not extract package licenses from opkg manager [Issue #4940] [PR #4963 @Dashtid]
• squashfs breaks with godisk-fs 1.8.0 [Issue #4718]
• requirements.txt cataloger silently drops PEP 440 local version identifiers, producing incorrect PURL [Issue #4958] [PR #4959 @kzantow]

Dependencies

34 dependency changes (31 updated, 3 added). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
• GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
• GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
• GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
• GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

(Full Changelog)