syft Files

Added Features

• emit dependency relationships from mix.lock [PR #4985 @cgreeno]
• add safe tensor model type to SBOM output [PR #4844 @spiffcs]
• Capture golang binary symbols [PR #4988 @spiffcs]
• Detect Ubuntu Pro/ESM extended support [PR #5028 @wagoodman]
• Add scan duration timer to Syft [Issue #4587] [PR #4858 @ChrisJr404]
• Support for vcpkg [Issue #2110] [PR #4081 @gabetrau]
• Add macOS .app cataloger [Issue #4010] [PR #4490 @rezmoss]
• Add support for Kerberos 5 library cataloging [Issue #4780] [PR #4781 @nadimz]
• Include date of scan in results [Issue #3910]

Bug Fixes

• use printf instead of echo to fix ANSI color output [PR #4978 @Jouini-Mohamed-Chaker]
• Strip peer-dep suffix from deno.lock npm keys [PR #5055 @Synvoya]
• Allow more PEP440-compliant characters in python versions [PR #4964 @kzantow]
• PE case-insensitive extensions (Win32/ISO 9660 compatibility) [PR #4996 @activeobd]
• Fix panic parsing a rockspec comment that ends at EOF [PR #5053 @arpitjain099]
• Fix Debian point release detection [PR #4997 @OsamaSE]
• Fix mix.lock git/path deps mislabeled as hex.pm packages with bogus PURLs [PR #5041 @Synvoya]
• npm redis client generates no CPE [Issue #5011] [PR #5012 @rezmoss]
• Debug Docker images are running as nonroot user [Issue #4113] [PR #4608 @spiffcs]
• libxml2 gets the wrong cpe vendor [Issue #5015] [PR #5016 @rezmoss]
• wrong purl for spring-ldap-core dependency [Issue #4030] [PR #4908 @jonasboos]
• Swift: CVEs missed by Grype when using Syft-generated SBOMs – missing group field breaks PURL matching [Issue #3961] [PR #4785 @SAY-5]
• conanfile.txt: dependencies after a comment line in [requires] are not detected [Issue #5017] [PR #5020 @jfjrh2014]
• dotnet cataloger can't find packages from deps.json in linux elf single-file bundles [Issue #4514] [PR #4517 @rezmoss]
• Go template sprig date functions not defined [Issue #2372] [PR #4644 @sputnik-mac]
• CycloneDX BOM contains invalid externalReferences URL from unresolved Ruby gemspec interpolation (e.g. #{s.name}) [Issue #4720] [PR #4782 @SAY-5]

Dependencies

9 dependency changes (8 updated, 1 added).

(Full Changelog)