Releases: anchore/syft
Releases · anchore/syft
v0.80.0
Changelog
v0.80.0 (2023-05-05)
Added Features
- Improve pnpm support [Issue #1535] [PR #1752] [Shanedell]
Bug Fixes
- chore: add more detail on SPDX file IDs [PR #1769] [kzantow]
- chore: do not HTML escape PackageURLs [PR #1782] [kzantow]
- RPM database not found on ostree-managed systems [Issue #1755] [PR #1756] [fpytloun]
- Unable to use syft for private azure container registry [Issue #1777]
- linux-kernel-cataloger produces thousands of version-less components. [Issue #1781] [PR #1784] [kzantow]
Deprecated Features
v0.79.0
Changelog
v0.79.0 (2023-04-21)
Added Features
- Add ALPM Metadata to CYCLONEDX and SPDX output formats [Issue #1037] [PR #1747] [Shanedell]
- consul binary classifier [Issue #1590] [PR #1738] [Shanedell]
Bug Fixes
- Syft missing direct dependencies from the gemfile.lock [Issue #1660] [PR #1749] [Shanedell]
Additional Changes
- chore: bump stereoscope to latest version [PR #1741] [westonsteimel]
v0.78.0
Changelog
v0.78.0 (2023-04-17)
Added Features
- Add Linux Kernel cataloger [PR #1694] [deitch & wagoodman]
- Support scanning license files in golang packages over the network [Issue #1056] [PR #1630] [deitch & kzantow]
- Add consul binary classifier [Issue #1590] [PR #1738] [Shanedell]
- Add annotations for evidence on package locations [PR #1723] [wagoodman]
Bug Fixes
- Decoding of the syft-json format does not handle files [Issue #1534] [PR #1698] [wagoodman]
v0.77.0
Changelog
v0.77.0 (2023-04-11)
Added Features
- feat: gradle lockfile support [PR #1719] [henrysachs]
- feat: support for java "nar" files [PR #1727] [Shanedell]
v0.76.1
Changelog
v0.76.1 (2023-04-05)
Added Features
- Capture file ownership relationships from portage ecosystem [PR #1702] [wagoodman]
- Add Nix Cataloger [Issue #462] [PR #1107] [juliosueiras] [PR #1696] [wagoodman] [flokli]
v0.76.0
Changelog
v0.76.0 (2023-03-31)
Added Features
- Scan local go mod licenses for golang packages [PR #1645] [deitch]
- update and clean license list generation to return more SPDXID for more inputs [PR #1691] [spiffcs]
- argocd binary classifier [Issue #1606] [PR #1663] [y12studio]
- Add config option to allow user to select the default image source location [Issue #1703] [spiffcs]
Bug Fixes
- Defer closing the opened file when using FileScheme [PR #1668] [Noxsios]
- fix: remove author contributing to javascript CPEs [PR #1669] [kzantow]
- fix: reduce logging for bad dpkg lines [PR #1675] [kzantow]
- Broken shell completion - Bash [Issue #962] [PR #1688] [DanHam]
- syft produces different output when run with sudo [Issue #1391] [PR #1693] [anchore-actions-token-generator]
- some binary ruby are not detected [Issue #1677] [PR #1678] [witchcraze]
- Documentation says that output is SPDX 2.2 [Issue #1679] [PR #1680] [vargenau]
- fix: move defer after error to protect panic case [PR #1670] [spiffcs]
Additional Changes
- Deprecate config.yaml as valid config source; Add unit regression for correct config paths [PR #1640] [AidanDelaney]
- Remove more side effects from application config testing [PR #1684] [wagoodman]
- chore: tweak some workflow text [PR #1685] [kzantow]
- chore: fix flaky license sorting [PR #1690] [kzantow]
v0.75.0
Changelog
v0.75.0 (2023-03-13)
Added Features
- Catalog ruby binary [Issue #1650] [PR #1665] [witchcraze]
Bug Fixes
v0.74.1
Changelog
v0.74.1 (2023-03-09)
Bug Fixes
- purl for apk packages missing when installed db file is not in root [Issue #1572] [PR #1615] [deitch]
- invalid package url type: dotnet [Issue #1622] [PR #1649] [kzantow]
- Go tests detecting race cataloging packages [Issue #1633] [PR #1639] [kzantow]
- Improve Python binary scanning [Issue #1643] [PR #1648] [kzantow]
- Update haproxy binary matcher [Issue #1646] [PR #1648] [kzantow]
- SPDX tag-value SBOM value format is incorrect for LicenseID [Issue #1651] [PR #1657] [kzantow]
v0.74.0
Changelog
(v0.74.0) (2023-03-02)
Added Features
- rust toolchain binary cataloger [PR #1601] [westonsteimel]
- Add support for SUPPORT_END in distro [PR #1612] [noqcks]
- Catalog haproxy binary [Issue #1512] [PR #1591] [noqcks]
- Handle cataloger panics [Issue #1624] [PR #1636] [kzantow]
- set cosign attest predicate type based on Syft output type [PR #1598] [Nirusu]
- retain go package info when no module declared [PR #1632] [westonsteimel]
Bug Fixes
- improve CPE generation for curl APK [PR #1608] [westonsteimel]
- determine upstream for apk version streams [PR #1610] [westonsteimel]
- decoding null apk metadata pullDependencies [PR #1614] [kzantow]
- correct apk purls for other distros [PR #1620] [westonsteimel]
- further improvements to CPE generation for apk packages [PR #1623] [westonsteimel]
- improved CPE-generation for several more APK packages [PR #1631] [westonsteimel]
- apk product/vendor generation for old metadata [PR #1635] [westonsteimel]
- Encountering "cycle during symlink resolution" with syft version 0.71.0 onwards [Issue #1586] [PR #1604] [wagoodman]
- syft erlang cataloger can segfault when analyzing an erlang project containing rebar.lock with nested deps [Issue #1621] [PR #1628] [kzantow]
- Go tests detecting race cataloging packages [Issue #1633] [PR #1639] [kzantow]
v0.73.0
Changelog
v0.73.0 (2023-02-22)
Added Features
- Update SPDX license list to 3.20 [PR #1600] [vargenau]
- Catalog perl binary [Issue #1587] [PR #1592] [noqcks]
Bug Fixes
- Fix issue when matching format versions [PR #1585] [kzantow]
- Cataloger filtering cross matches wrong catalogers [Issue #1573] [PR #1582] [wagoodman]
- Python binary detected multiple times when only installed once [Issue #1579] [PR #1583] [kzantow]
- Encountering "cycle during symlink resolution" with syft version 0.71.0 onwards [Issue #1586]