Changelog

v0.83.0 (2023-06-05)

Full Changelog

Added Features

• Add new '--source-version' and '--source-name' options to set the name and version of the target being analyzed for reference in resulting syft-json format SBOMs (more formats will support these flags soon). [Issue #1399] [PR #1859] [kzantow]
• Add scope to POM properties [PR #1779] [jneate]
• Accept main.version ldflags even without vcs [PR #1855] [deitch]

Bug Fixes

• Fix directory resolver to consider CWD and root path input correctly [PR #1840] [wagoodman]
• Show all error messages if there is a failure retrieving an image with a specified scheme [Issue #1569] [PR #1801] [FrimIdan]
• v0.81.0 crashing parsing some images [Issue #1837] [PR #1839] [spiffcs]

Deprecated Features

• Migrate location-related structs to the file package [PR #1751] [wagoodman]

Additional Changes

• chore: code cleanup [PR #1865] [spiffcs]

Changelog

v0.82.0 (2023-05-23)

Full Changelog

Added Features

• Improve Go main module version detection by attempting to parse available ldflags [Issue #1785] [PR #1832] [wagoodman]

Bug Fixes

• Fix a problem in the license parsing logic that may result in a panic [PR #1839]
• Return all relevant error messages if an image retrieval fails when a scheme is specified [PR #1801] [FrimIdan]
• Fix a problem with PNPM scanning where v6 lockfiles might result in duplicated packages [Issue #1762] [PR #1778] [kzantow]

Changelog

v0.81.0 (2023-05-22)

Full Changelog

Added Features

• Support cataloging R packages [Issue #730] [PR #1790] [willmurphyscode]
• Support describing license properties and SPDX expression assertions [Issue #1577] [PR #1743] [spiffcs]
• Warn if parsing a newer SBOM [PR #1810] [willmurphyscode]

Bug Fixes

• Retain cataloged SBOM relationships [PR #1509] [houdini91]
• fix: update field plurality of 8.0.0 schema before release [PR #1820] [spiffcs]
• fix: remove spurious warnings - unknown relationship type: evident-by form-lib=syft [Issue #1812] [PR #1797] [willmurphyscode]
• CycloneDX Dependencies Relationships Inverted [Issue #1815] [PR #1816] [shanealv]
• Alpine: license expression should be complete and not parsed out [Issue #1817] [PR #1819] [spiffcs]

Additional Changes

• Print package list when extra packages found [PR #1791] [willmurphyscode]
• update cosign to v2 release (different go module) [PR #1805] [bobcallaway]

Changelog

v0.80.0 (2023-05-05)

Full Changelog

Added Features

• Improve pnpm support [Issue #1535] [PR #1752] [Shanedell]

Bug Fixes

• chore: add more detail on SPDX file IDs [PR #1769] [kzantow]
• chore: do not HTML escape PackageURLs [PR #1782] [kzantow]
• RPM database not found on ostree-managed systems [Issue #1755] [PR #1756] [fpytloun]
• Unable to use syft for private azure container registry [Issue #1777]
• linux-kernel-cataloger produces thousands of version-less components. [Issue #1781] [PR #1784] [kzantow]

Deprecated Features

• Rename pkg.Catalog to pkg.Collection [PR #1764] [wagoodman]

Changelog

v0.79.0 (2023-04-21)

Full Changelog

Added Features

• Add ALPM Metadata to CYCLONEDX and SPDX output formats [Issue #1037] [PR #1747] [Shanedell]
• consul binary classifier [Issue #1590] [PR #1738] [Shanedell]

Bug Fixes

• Syft missing direct dependencies from the gemfile.lock [Issue #1660] [PR #1749] [Shanedell]

Additional Changes

• chore: bump stereoscope to latest version [PR #1741] [westonsteimel]

Changelog

v0.78.0 (2023-04-17)

Full Changelog

Added Features

• Add Linux Kernel cataloger [PR #1694] [deitch & wagoodman]
• Support scanning license files in golang packages over the network [Issue #1056] [PR #1630] [deitch & kzantow]
• Add consul binary classifier [Issue #1590] [PR #1738] [Shanedell]
• Add annotations for evidence on package locations [PR #1723] [wagoodman]

Bug Fixes

• Decoding of the syft-json format does not handle files [Issue #1534] [PR #1698] [wagoodman]

Changelog

v0.77.0 (2023-04-11)

Full Changelog

Added Features

• feat: gradle lockfile support [PR #1719] [henrysachs]
• feat: support for java "nar" files [PR #1727] [Shanedell]

Changelog

v0.76.1 (2023-04-05)

Full Changelog

Added Features

• Capture file ownership relationships from portage ecosystem [PR #1702] [wagoodman]
• Add Nix Cataloger [Issue #462] [PR #1107] [juliosueiras] [PR #1696] [wagoodman] [flokli]

Changelog

v0.76.0 (2023-03-31)

Full Changelog

Added Features

• Scan local go mod licenses for golang packages [PR #1645] [deitch]
• update and clean license list generation to return more SPDXID for more inputs [PR #1691] [spiffcs]
• argocd binary classifier [Issue #1606] [PR #1663] [y12studio]
• Add config option to allow user to select the default image source location [Issue #1703] [spiffcs]

Bug Fixes

• Defer closing the opened file when using FileScheme [PR #1668] [Noxsios]
• fix: remove author contributing to javascript CPEs [PR #1669] [kzantow]
• fix: reduce logging for bad dpkg lines [PR #1675] [kzantow]
• Broken shell completion - Bash [Issue #962] [PR #1688] [DanHam]
• syft produces different output when run with sudo [Issue #1391] [PR #1693] [anchore-actions-token-generator]
• some binary ruby are not detected [Issue #1677] [PR #1678] [witchcraze]
• Documentation says that output is SPDX 2.2 [Issue #1679] [PR #1680] [vargenau]
• fix: move defer after error to protect panic case [PR #1670] [spiffcs]

Additional Changes

• Deprecate config.yaml as valid config source; Add unit regression for correct config paths [PR #1640] [AidanDelaney]
• Remove more side effects from application config testing [PR #1684] [wagoodman]
• chore: tweak some workflow text [PR #1685] [kzantow]
• chore: fix flaky license sorting [PR #1690] [kzantow]

Changelog

v0.75.0 (2023-03-13)

Full Changelog

Added Features

• Catalog ruby binary [Issue #1650] [PR #1665] [witchcraze]

Bug Fixes

• more python matching support [PR #1667] [kzantow]

Changelog

v0.74.1 (2023-03-09)

Full Changelog

Bug Fixes

• purl for apk packages missing when installed db file is not in root [Issue #1572] [PR #1615] [deitch]
• invalid package url type: dotnet [Issue #1622] [PR #1649] [kzantow]
• Go tests detecting race cataloging packages [Issue #1633] [PR #1639] [kzantow]
• Improve Python binary scanning [Issue #1643] [PR #1648] [kzantow]
• Update haproxy binary matcher [Issue #1646] [PR #1648] [kzantow]
• SPDX tag-value SBOM value format is incorrect for LicenseID [Issue #1651] [PR #1657] [kzantow]

Changelog

(v0.74.0) (2023-03-02)

Full Changelog

Added Features

• rust toolchain binary cataloger [PR #1601] [westonsteimel]
• Add support for SUPPORT_END in distro [PR #1612] [noqcks]
• Catalog haproxy binary [Issue #1512] [PR #1591] [noqcks]
• Handle cataloger panics [Issue #1624] [PR #1636] [kzantow]
• set cosign attest predicate type based on Syft output type [PR #1598] [Nirusu]
• retain go package info when no module declared [PR #1632] [westonsteimel]

Bug Fixes

• improve CPE generation for curl APK [PR #1608] [westonsteimel]
• determine upstream for apk version streams [PR #1610] [westonsteimel]
• decoding null apk metadata pullDependencies [PR #1614] [kzantow]
• correct apk purls for other distros [PR #1620] [westonsteimel]
• further improvements to CPE generation for apk packages [PR #1623] [westonsteimel]
• improved CPE-generation for several more APK packages [PR #1631] [westonsteimel]
• apk product/vendor generation for old metadata [PR #1635] [westonsteimel]
• Encountering "cycle during symlink resolution" with syft version 0.71.0 onwards [Issue #1586] [PR #1604] [wagoodman]
• syft erlang cataloger can segfault when analyzing an erlang project containing rebar.lock with nested deps [Issue #1621] [PR #1628] [kzantow]
• Go tests detecting race cataloging packages [Issue #1633] [PR #1639] [kzantow]

Changelog

v0.72.1 (2023-02-22)

Full Changelog

Added Features

• Update SPDX license list to 3.20 [PR #1600] [vargenau]

Bug Fixes

• Encountering "cycle during symlink resolution" with syft version 0.71.0 onwards [Issue #1586]

Changelog

v0.73.0 (2023-02-22)

Full Changelog

Added Features

• Update SPDX license list to 3.20 [PR #1600] [vargenau]
• Catalog perl binary [Issue #1587] [PR #1592] [noqcks]

Bug Fixes

• Fix issue when matching format versions [PR #1585] [kzantow]
• Cataloger filtering cross matches wrong catalogers [Issue #1573] [PR #1582] [wagoodman]
• Python binary detected multiple times when only installed once [Issue #1579] [PR #1583] [kzantow]
• Encountering "cycle during symlink resolution" with syft version 0.71.0 onwards [Issue #1586]

Changelog

v0.72.0 (2023-02-16)

Full Changelog

Added Features

• Enable SBOM conversions from STDIN [PR #1570] [wagoodman]

Bug Fixes

• fix: python CPE generation for alpine [PR #1564] [westonsteimel]
• fix: improve CPE and upstream generation logic for Alpine packages [PR #1567] [westonsteimel]

Changelog

v0.71.0 (2023-02-09)

Full Changelog

Added Features

• Catalog postgres binary [Issue #1456] [PR #1536] [witchcraze]
• Improve Syft performance [Issue #1328] [PR #1510] [wagoodman]
• Export specific format versions (SPDX) [Issue #1519] [PR #1543] [kzantow]

Bug Fixes

• source: when base is set, responsePath should be absolute [PR #1542] [jedevc]
• Licenses missing in most report format [Issue #933] [PR #1540] [deitch]
• apk packages with simplified license show NOASSERTION [Issue #1529] [PR #1540] [deitch]

Changelog

v0.70.0 (2023-02-03)

Full Changelog

Added Features

• Catalog traefik binary [Issue #1460] [PR #1504] [witchcraze]

Bug Fixes

• Syft hardcodes custom attestation type [Issue #1532] [PR #1533] [Nirusu]

Security

• Prevent leaking attestation password or key path to console or SBOM contents [PR #1538] [GHSA-jp7v-3587-2956] [CVE-2023-24827]

Changelog

v0.69.1 (2023-01-31)

Full Changelog

Changes

• update golang to 1.19 [PR #1526] [bradleyjones]
• update spdx/tools-golang to v0.5.0-rc1 [PR #1503] [kzantow]

Changelog

v0.69.0 (2023-01-30)

Full Changelog

Added Features

• Allow scanning unpacked container filesystems if using Syft as a library [Issue #1359] [PR #1485] [jedevc]

Bug Fixes

• Syft convert now works properly with template output [Issue #1409] [PR #1521] [kzantow]
• Attestation with a private key [Issue #1465] [PR #1502] [spiffcs]

Changelog

v0.68.1 (2023-01-25)

Full Changelog

Bug Fixes

• Add relevant CPEs to python and busybox classifiers [PR #1517] [westonsteimel]

Additional Changes

• Bump github.com/spdx/tools-golang to v0.4.0 [PR #1450] [lucacome]