Added Features
- detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel]
- add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman]
Bug Fixes
- Cleanup snap temporary directories [PR #5117 @spiffcs]
- add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel]
- javascript-package-cataloger creates phantom
<name>@unknownpackages for subpath or export-map stub package.json files [Issue #5118] - Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #4598] [PR #5146 @ankit090701]
- When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #5019] [PR #5029 @wagoodman]
- Support deno binary latest and some old versions [Issue #5057] [PR #5084 @ychampion]
- Update install methods in README.md [Issue #3198]
Dependencies
9 dependency changes (9 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
- GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5