v1.16.0

Added Features

• omit devDependencies for package-lock.json files by default [#2348 #3371 @njv299]

Bug Fixes

• add support for dependencies and purl for Native Image SBOMs [#3399 @rudsberg]
• stop bubbling fileResolver errors from binary cataloger [#3410 @spiffcs]
• malformed pom.xml may cause recursive loop [#3391 @kzantow]
• syft convert: broken link in help - documentation no longer existing [#3143 #3407 @Makefolder]

(Full Changelog)

v1.15.0

Added Features

• Merge config files hierarchically and add support for config profiles [#3337 @kzantow]
• Enable cargo-auditable-binary-cataloger for files/directories [#3376 @ariel-miculas]
• Improve mariadb binary classifer to detect older versions [#3052]
• Look for dpkg status file at additional globs [#2692 #3373 @njv299]
• Emit relationships for Java dependencies [#3189 #3363 @kzantow]

(Full Changelog)

v1.14.2

Bug Fixes

• Use single license scanner for all catalogers [#3348 @wagoodman]
• use official CPE for linux kernel [#3343 @westonsteimel]
• improve mariadb binary classifer to detect older versions [#3339 @westonsteimel]

Additional Changes

• Update to latest packageurl-go [#3347 @wagoodman]

(Full Changelog)

v1.14.1

Bug Fixes

• stop some log.Warn spam due parsing an empty string as a CPE [#3330 @willmurphyscode]
• improve go binary semver extraction for traefik [#3325 @westonsteimel]

(Full Changelog)

v1.14.0

Added Features

• Report known unknowns directly in the output SBOM [#518 #2998 @kzantow]
• Identify bash.preinst [#3191 #3228 @wagoodman]
• Support HAProxy rc and some old versions [#3233 #3277 @witchcraze]
• Support Redis arm/v5, arm/v7, 386 in 7.2, 7.4, 8.0 [#3279 #3281 @witchcraze]
• Support node old versions [#3236 #3284 @witchcraze]
• Support rubylang/ruby dev versions [#3239 #3285 @witchcraze]
• Support ruby rc, preview [#3238 #3285 @witchcraze]

Bug Fixes

• performance: instantiate license check scanner to prevent memory leak [#3290 @govrin]
• Parse package.json with non-standard fields in 'author' section [#3300 @nuada]
• make failed CPE validation correctly return error [#2762 @willmurphyscode]
• Improve subpath to mount matching [#3269 @cdupuis]

Additional Changes

• add pull request template [#3294 @willmurphyscode]

(Full Changelog)

v1.13.0

Added Features

• --enrich flag for data enrichment feature enablement [#3182 @kzantow]
• Add classifier for Dart lang [#3265 @LaurentGoderre]
• add binary classifiers for lighttp, proftpd, zstd, xz, gzip, jq, and sqlcipher [#3252 @krysgor]
• Catalog JDKs more completely [#3188 #3217 @wagoodman]
• Show richer information for JVM installations [#1426 #3217 @wagoodman]
• Allow for stubbing unknown versions over dropping packages [#2652 #3257 @wagoodman]
• Name and Version empty for Java package when scanning provided image [#2132 #3257 @wagoodman]
• Support bitnami/mysql:8.x [#3025]

Bug Fixes

• OpenJDK CPEs [#2422 #3217 @wagoodman]
• SBOM generated from poetry lock file contains no license information on any dependencies [#3204]
• Scanning a folder with a jar archive with no metadata creates a SPDX package without versionInfo (Non-NTIA compliant) [#2039 #3257 @wagoodman]
• Using replace in a go.mod creates a SPDX package without versionInfo (Non-NTIA compliant) [#2038 #3257 @wagoodman]
• Command make add-snippet can fail in some cases [#3249]

(Full Changelog)

v1.12.2

Added Features

• Detect curl binaries [#3146 @krysgor]
• Add haskell binaries cataloger [#3078 @LaurentGoderre]
• add the Ocaml ecosystem [#3112 @LaurentGoderre]
• Support HAProxy dev [#3134 #3180 @witchcraze]

Bug Fixes

• Fix improper decoding of SPDX license expressions in the CycloneDX format [#3175 @NyanKiyoshi]
• improve generated cpes for binaries with existing classifiers [#3169 @westonsteimel]
• improve known CPEs and set NVD as source for all current binary classifiers [#3167 @westonsteimel]
• Respond to authoratative CPEs from catalogers [#3166 @wagoodman]
• Set cataloger names within package cataloger task [#3165 @wagoodman]
• use official CPE for curl binary cataloger [#3164 @westonsteimel]
• Fix ELF package correlations [#3151 @wagoodman]
• no space left and Could not retrieve mirrorlist in test [#3181 #3190 @wagoodman]
• Multiple versions of libssl3 and libcrypto3 present in SBOM while only one version is installed [#3195]
• CycloneDX convertion into Syft improperly handles SPDX licenses [#3172]
• Syft Cause stack overflow [goroutine stack exceeds 1000000000-byte limit] [#3163 #3170 @kzantow]
• Mysql binary detection version incorrect for 8.0.x [#3141 #3142 @kzantow]

Additional Changes

• Less verbose java logging when non-fatal issues arise [#3208 @wagoodman]

(Full Changelog)

v1.11.1

Bug Fixes

• support .kar files [#3113 @tomersein]
• logging for remote network calls [#3140 @kzantow]
• Pick up CycloneDX BOM components from metadata as well [#3092 @dervoeti]
• improve groupid extraction for Jenkins plugins [#2815 @westonsteimel]

(Full Changelog)

v1.11.0

Added Features

• Added the SWI Prolog (swipl) ecosystem [#3076 @LaurentGoderre]
• Improved java cataloging [#2769 @GijsCalis]

Bug Fixes

• Empty version field on some dependencies when reading pom.xml [#1129 #2769 @GijsCalis]
• Support Maven multi-level configuration file / parent POM [#2017 #2769 @GijsCalis]
• DependencyManagement ignored in pom.xml [#1813 #2769 @GijsCalis]
• Version parsing regression for Go binaries [#3086 #3087 @spiffcs]

Additional Changes

• rather than have a hard max recursive depth - syft should detect parent pom cycles [#2284 #2769 @GijsCalis]
• increase java purl generation test coverage [#3110 @westonsteimel]
• Updated PackageSupplier to type Organization for JAR files [#3093 @harippriyas]
• Ensure accurate java main artifact name retrieval for multi-JARs and refine fallback approach [#3054 @dor-hayun]

(Full Changelog)

v1.10.0

Added Features

• Detect go main module from partial package builds [#3060 @wagoodman]
• Support traefik in linux/arm/v6, linux/riscv64 [#3038 #3077 @witchcraze]
• Catalog TiDB binary [#2763]
• Generate a Maven friendly CPE [#3042 #3045 @kzantow]

Bug Fixes

• Only match ldflag version if it matches the main module or targets main.version [#3062 @LaurentGoderre]
• python requirements.txt cataloger: allow dots in python package names [#3070 @Mikcl]
• SPDX output performance with many relationships [#3053 @kzantow]
• Order CPEs deterministically for SBOM reproducibility [#2967 #3085 @kzantow]
• Python packages: name normalization [#3064 #3069 @Mikcl]
• Syft report panics with the golang cataloger [#3037 #3043 @willmurphyscode]

Additional Changes

• add debug logging for errors reading RPM files [#3051 @kzantow]

(Full Changelog)