https://github.com/anchore/syft

containers cyclonedx docker go golang hacktoberfest oci sbom spdx static-analysis tool

Score: 34.08946750570335

Last synced: about 5 hours ago
JSON representation

Repository metadata:

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Host: GitHub
URL: https://github.com/anchore/syft
Owner: anchore
License: apache-2.0
Created: 2020-05-07T18:19:29.000Z (over 6 years ago)
Default Branch: main
Last Pushed: 2026-08-07T14:38:16.000Z (5 days ago)
Last Synced: 2026-08-07T17:23:29.277Z (5 days ago)
Topics: containers, cyclonedx, docker, go, golang, hacktoberfest, oci, sbom, spdx, static-analysis, tool
Language: Go
Homepage:
Size: 24.5 MB
Stars: 9,365
Watchers: 67
Forks: 918
Open Issues: 613
Metadata Files:
- Readme: README.md
- Contributing: CONTRIBUTING.md
- License: LICENSE
- Code of conduct: CODE_OF_CONDUCT.md
- Security: SECURITY.md

Owner metadata:

Name: Anchore, Inc.
Login: anchore
Email: info@anchore.com
Kind: organization
Description:
Website: https://anchore.com/
Location:
Twitter:
Company:
Icon url: https://avatars.githubusercontent.com/u/16208487?v=4
Repositories: 96
Last Synced at: 2026-08-07T14:34:15.826Z
Profile URL: https://github.com/anchore

Committers metadata

Last synced: 5 days ago

Total Commits: 3,328
Total Committers: 251
Avg Commits per committer: 13.259
Development Distribution Score (DDS): 0.757

Commits in past year: 573
Committers in past year: 79
Avg Commits per committer in past year: 7.253
Development Distribution Score (DDS) in past year: 0.621

Name	Email	Commits
dependabot[bot]	4****]	809
Alex Goodman	w****n	736
anchore-actions-token-generator[bot]	1****]	383
Christopher Angelo Phillips	3****s	216
Keith Zantow	k**w@g**m	195
Alfredo Deza	a**a@a**m	107
Dan Luhring	l****g	100
Weston Steimel	w**l@a**m	86
William Murphy	w**y@a**m	84
witchcraze	6****e	37
Laurent Goderre	l**e@d**m	37
Jonas Xavier	j**x@g**m	28
Rez Moss	h**i@r**m	24
anchore-oss-update-bot	a**t@a**m	22
Colm O hEigeartaigh	c****a	20
cpendery	3****y	15
Alan Pope	a**e@a**m	13
Toure Dunnon	t**n@a**m	13
VictorHuu	v**3@g**m	10
Benji Visser	b**i@0**g	9
Sambhav Kothari	s**4@b**t	8
Avi Deitcher	d****h	8
Justin Chadwell	m**e@j**m	7
Shane Dell	3****l	7
Samuel Dacanay	s**y@a**m	7
Marc-Etienne Vargenau	m**u@n**m	7
mikey strauss	m**1@g**m	7
Tom Fay	t**y@m**m	6
mikcl	4****l	6
GGMU	4****n	6
and 221 more...

Issue and Pull Request metadata

Last synced: 5 days ago

Total issues: 761
Total pull requests: 2,348
Average time to close issues: 5 months
Average time to close pull requests: 11 days
Total issue authors: 398
Total pull request authors: 185
Average comments per issue: 2.09
Average comments per pull request: 0.54
Merged pull request: 1,746
Bot issues: 11
Bot pull requests: 1,211

Past year issues: 45
Past year pull requests: 154
Past year average time to close issues: about 1 month
Past year average time to close pull requests: 17 days
Past year issue authors: 36
Past year pull request authors: 51
Past year average comments per issue: 0.82
Past year average comments per pull request: 0.71
Past year merged pull request: 68
Past year bot issues: 1
Past year bot pull requests: 62

More stats: https://issues.ecosyste.ms/repositories/lookup?url=https://github.com/anchore/syft

Top Issue Authors

wagoodman (75)
kzantow (42)
witchcraze (33)
spiffcs (20)
willmurphyscode (16)
tomerse-sg (11)
westonsteimel (10)
joshbressers (8)
luhring (8)
vargenau (8)
tomersein (8)
popey (7)
rezmoss (6)
anchore-actions-token-generator[bot] (6)
deitch (6)

Top Pull Request Authors

dependabot[bot] (819)
anchore-actions-token-generator[bot] (392)
wagoodman (251)
kzantow (131)
spiffcs (118)
willmurphyscode (79)
LaurentGoderre (56)
westonsteimel (51)
coheigea (20)
popey (19)
witchcraze (19)
VictorHuu (18)
tomersein (15)
adammcclenaghan (13)
BlowMeMike (12)

Top Issue Labels

bug (382)
enhancement (303)
good-first-issue (34)
changelog-ignore (28)
new-cataloger (23)
question (16)
breaking-change (16)
license (13)
good first issue (13)
binary-analysis (13)
needs-investigation (11)
dependencies (11)
needs-discussion (8)
ecosystem:java (7)
format:spdx (6)
needs-research (6)
release (5)
ecosystem:python (5)
ecosystem:windows (5)
documentation (4)
json (4)
ecosystem:go (4)
format:cyclonedx (4)
blocked (3)
online (3)
I/O (3)
unknowns (3)
duplicate (3)
new-source (3)
ecosystem:dotnet (3)

Top Pull Request Labels

dependencies (1,212)
bug (137)
enhancement (118)
changelog-ignore (109)
go (108)
json-schema (66)
github_actions (56)
pre-release (21)
release (12)
breaking-change (12)
documentation (12)
python (11)
WIP (9)
automation (6)
performance (6)
needs-manual-review (6)
blocked (4)
ecosystem:php (3)
ecosystem:dotnet (2)
help-wanted (2)
.NET (2)
question (2)
needs-discussion (2)
license (2)
detected-breaking-change (2)
ecosystem:java (1)
needs-tests (1)
breaking change (1)
java (1)
binny (1)

Package metadata

Total packages: 39
Total downloads:
- homebrew: 3,368 last-month
Total docker downloads: 254,767,141
Total dependent packages: 217 (may contain duplicates)
Total dependent repositories: 180 (may contain duplicates)
Total versions: 1,330
Total maintainers: 4
Total advisories: 2

proxy.golang.org: github.com/anchore/syft

Homepage: https://github.com/anchore/syft
Documentation: https://pkg.go.dev/github.com/anchore/syft#section-documentation
Licenses: Apache-2.0
Latest release: v1.48.0 (published 27 days ago)
Last Synced: 2026-07-21T00:02:23.346Z (23 days ago)
Versions: 267
Dependent Packages: 217
Dependent Repositories: 179
Docker Downloads: 254,767,141
Rankings:
- Docker downloads count: 0.211%
- Dependent packages count: 0.334%
- Dependent repos count: 0.472%
- Average: 0.72%
- Stargazers count: 1.064%
- Forks count: 1.521%
Advisories:
- Syft improper temporary file cleanup
- Credential disclosure in syft when SYFT_ATTEST_PASSWORD environment variable set

alpine-v3.18: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published over 2 years ago)
Last Synced: 2026-04-03T04:40:29.159Z (4 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

alpine-v3.18: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published over 2 years ago)
Last Synced: 2026-04-08T18:07:25.767Z (4 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

alpine-v3.18: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published over 2 years ago)
Last Synced: 2026-04-17T13:05:03.096Z (4 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

alpine-v3.18: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.84.1-r4 (published over 2 years ago)
Last Synced: 2026-04-09T03:02:45.282Z (4 months ago)
Versions: 7
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 1.913%
- Stargazers count: 3.491%
- Forks count: 4.159%
Maintainers (1)
- michal@polanski.me

proxy.golang.org: github.com/ANCHORE/syft

Homepage:
Documentation: https://pkg.go.dev/github.com/ANCHORE/syft#section-documentation
Licenses: apache-2.0
Latest release: v1.50.0 (published 16 days ago)
Last Synced: 2026-08-07T22:14:15.744Z (5 days ago)
Versions: 266
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent packages count: 5.017%
- Average: 5.186%
- Dependent repos count: 5.354%

proxy.golang.org: github.com/Anchore/syft

Homepage:
Documentation: https://pkg.go.dev/github.com/Anchore/syft#section-documentation
Licenses: apache-2.0
Latest release: v1.50.0 (published 16 days ago)
Last Synced: 2026-08-07T22:14:19.003Z (5 days ago)
Versions: 266
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent packages count: 5.255%
- Average: 5.431%
- Dependent repos count: 5.608%

alpine-edge: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published about 1 month ago)
Last Synced: 2026-07-14T03:29:03.525Z (30 days ago)
Versions: 79
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Stargazers count: 3.698%
- Forks count: 5.636%
- Average: 5.994%
- Dependent packages count: 14.641%
Maintainers (1)
- michal@polanski.me

alpine-edge: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published about 1 month ago)
Last Synced: 2026-07-14T03:29:06.093Z (30 days ago)
Versions: 69
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Average: 7.303%
- Dependent packages count: 14.607%
Maintainers (1)
- michal@polanski.me

alpine-edge: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published about 1 month ago)
Last Synced: 2026-07-14T03:29:07.677Z (30 days ago)
Versions: 69
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Average: 7.303%
- Dependent packages count: 14.607%
Maintainers (1)
- michal@polanski.me

alpine-edge: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.46.0-r0 (published about 1 month ago)
Last Synced: 2026-07-14T03:29:09.275Z (30 days ago)
Versions: 69
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Average: 7.303%
- Dependent packages count: 14.607%
Maintainers (1)
- michal@polanski.me

alpine-v3.17: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.77.0-r1 (published over 3 years ago)
Last Synced: 2026-04-01T03:49:06.013Z (4 months ago)
Versions: 6
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Stargazers count: 3.48%
- Forks count: 4.115%
- Average: 8.712%
- Dependent packages count: 27.254%
Maintainers (1)
- michal@polanski.me

formulae.brew.sh: syft

CLI for generating a Software Bill of Materials from container images

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.50.0 (published 5 days ago)
Last Synced: 2026-08-07T22:14:13.592Z (5 days ago)
Versions: 103
Dependent Packages: 0
Dependent Repositories: 1
Downloads: 3,368 Last month
Rankings:
- Stargazers count: 5.845%
- Forks count: 6.004%
- Downloads: 14.327%
- Average: 14.787%
- Dependent packages count: 18.441%
- Dependent repos count: 29.317%

alpine-v3.22: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 7 months ago)
Last Synced: 2026-04-01T01:56:19.551Z (4 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:07:16.102Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.21: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:46:28.014Z (4 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:06:15.632Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.21: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:42:35.352Z (4 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:04:40.041Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.21: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:46:29.143Z (4 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.21: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.19.0-r5 (published over 1 year ago)
Last Synced: 2026-04-01T01:45:49.036Z (4 months ago)
Versions: 8
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.20: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.4.1-r2 (published about 2 years ago)
Last Synced: 2026-04-01T02:08:19.965Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.22: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 7 months ago)
Last Synced: 2026-04-01T01:56:18.675Z (4 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.19: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:26:04.224Z (4 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.23: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 6 months ago)
Last Synced: 2026-04-13T00:08:18.415Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.19: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:23:31.062Z (4 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.22: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 7 months ago)
Last Synced: 2026-04-01T01:57:14.724Z (4 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.22: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.31.0-r4 (published 7 months ago)
Last Synced: 2026-04-01T01:55:50.841Z (4 months ago)
Versions: 9
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.19: syft-fish-completion

Fish completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:26:47.573Z (4 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

pkgsrc-netbsd-x86_64-10.1-all: devel/syft

Generate Software Bill of Materials from container images and file systems

Homepage: https://github.com/anchore/syft/
Documentation: https://pkgsrc.se/devel/syft
Licenses: apache-2.0
Latest release: 0.65.0nb32 (published 4 months ago)
Last Synced: 2026-05-27T06:49:08.054Z (3 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%

nixpkgs-23.05: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-23.05/pkgs/tools/admin/syft/default.nix#L71
Licenses: Apache-2.0
Latest release: 0.80.0 (published 7 months ago)
Last Synced: 2026-04-13T11:29:35.423Z (4 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (2)
- 06kellyjac
- developer-guy

alpine-v3.23: syft-bash-completion

Bash completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 6 months ago)
Last Synced: 2026-04-09T01:08:56.568Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

nixpkgs-unstable: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-unstable/pkgs/by-name/sy/syft/package.nix#L78
Licenses: Apache-2.0
Latest release: 1.42.1 (published 5 months ago)
Last Synced: 2026-04-12T17:03:45.537Z (4 months ago)
Versions: 3
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

nixpkgs-24.11: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-24.11/pkgs/by-name/sy/syft/package.nix#L77
Licenses: Apache-2.0
Latest release: 1.18.0 (published 6 months ago)
Last Synced: 2026-03-06T18:23:47.054Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

alpine-v3.23: syft

Generate a Software Bill of Materials (SBOM) from container images and filesystems

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 6 months ago)
Last Synced: 2026-04-09T01:08:30.799Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

alpine-v3.19: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 0.98.0-r3 (published over 2 years ago)
Last Synced: 2026-04-01T03:27:41.934Z (4 months ago)
Versions: 4
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

nixpkgs-23.11: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-23.11/pkgs/tools/admin/syft/default.nix#L71
Licenses: Apache-2.0
Latest release: 0.97.1 (published 6 months ago)
Last Synced: 2026-03-05T15:03:20.907Z (5 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

nixpkgs-24.05: syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

Homepage: https://github.com/anchore/syft
Documentation: https://github.com/NixOS/nixpkgs/blob/nixos-24.05/pkgs/by-name/sy/syft/package.nix#L77
Licenses: Apache-2.0
Latest release: 1.5.0 (published 6 months ago)
Last Synced: 2026-04-20T18:03:36.713Z (4 months ago)
Versions: 1
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (3)

alpine-v3.23: syft-zsh-completion

Zsh completions for syft

Homepage: https://github.com/anchore/syft
Licenses: Apache-2.0
Latest release: 1.38.0-r3 (published 6 months ago)
Last Synced: 2026-04-09T01:08:56.658Z (4 months ago)
Versions: 2
Dependent Packages: 0
Dependent Repositories: 0
Rankings:
- Dependent repos count: 0.0%
- Dependent packages count: 0.0%
- Average: 100%
Maintainers (1)
- michal@polanski.me

Dependencies

.github/actions/bootstrap/action.yaml actions

actions/cache 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/setup-go 93397bea11091df50f3d7e59dc26a7711a8bcfbe composite

.github/workflows/codeql-analysis.yml actions

actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
actions/setup-go 93397bea11091df50f3d7e59dc26a7711a8bcfbe composite
github/codeql-action/analyze 6a28655e3dcb49cb0840ea372fd6d17733edd8a4 composite
github/codeql-action/autobuild 6a28655e3dcb49cb0840ea372fd6d17733edd8a4 composite
github/codeql-action/init 6a28655e3dcb49cb0840ea372fd6d17733edd8a4 composite

.github/workflows/oss-project-board-add.yaml actions

.github/workflows/release.yaml actions

./.github/actions/bootstrap * composite
8398a7/action-slack fbd6aa58ba854a740e11a35d0df80cb5d12101d8 composite
actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
anchore/sbom-action 78fc58e266e87a38d4194b2137a3d4e9bcaf7ca1 composite
docker/login-action 343f7c4344506bcbf9b4de18042ae17996df046d composite
fountainhead/action-wait-for-check 297be350cf8393728ea4d4b39435c7d7ae167c93 composite

.github/workflows/update-bootstrap-tools.yml actions

actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
actions/setup-go 93397bea11091df50f3d7e59dc26a7711a8bcfbe composite
peter-evans/create-pull-request 153407881ec5c347639a548ade7d8ad1d6740e38 composite
tibdex/github-app-token 3beb63f4bd073e61482598c45c71c1019b59b73a composite

.github/workflows/update-cpe-dictionary-index.yml actions

actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
actions/setup-go 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite
peter-evans/create-pull-request 153407881ec5c347639a548ade7d8ad1d6740e38 composite
tibdex/github-app-token 3beb63f4bd073e61482598c45c71c1019b59b73a composite

.github/workflows/validations.yaml actions

./.github/actions/bootstrap * composite
actions/cache 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/cache/restore 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/cache/save 704facf57e6136b1bc63b828d79edcd491f0ee84 composite
actions/checkout 3df4ab11eba7bda6032a0b82a6bb43b11571feac composite

syft/pkg/cataloger/githubactions/test-fixtures/glob/.github/actions/bootstrap/action.yaml actions

syft/pkg/cataloger/githubactions/test-fixtures/glob/.github/actions/unbootstrap/action.yml actions

syft/pkg/cataloger/rust/test-fixtures/Cargo.lock cargo

ansi_term 0.12.1
matches 0.1.8
memchr 2.3.3
natord 1.0.9
nom 4.2.3
unicode-bidi 0.3.4
version_check 0.1.5
winapi 0.3.9
winapi-i686-pc-windows-gnu 0.4.0
winapi-x86_64-pc-windows-gnu 0.4.0

syft/pkg/cataloger/rust/test-fixtures/glob-paths/src/Cargo.lock cargo

syft/pkg/cataloger/swift/test-fixtures/Podfile.lock cocoapods

GlossButtonNode 3.1.2
PINCache 3.0.3
PINOperation 1.2.1
PINRemoteImage 3.0.3
Reveal-SDK 33
SwiftGen 6.5.1
Texture 3.1.0
TextureSwiftSupport 3.13.0
TinyConstraints 4.0.2

syft/pkg/cataloger/swift/test-fixtures/glob-paths/src/Podfile.lock cocoapods

syft/pkg/cataloger/r/test-fixtures/DESCRIPTION cran

R >= 3.3 depends
cli * imports
glue >= 1.6.1 imports
lifecycle >= 1.0.3 imports
magrittr * imports
rlang >= 1.0.0 imports
stringi >= 1.5.3 imports
vctrs >= 0.4.0 imports
covr * suggests
dplyr * suggests
gt * suggests
htmltools * suggests
htmlwidgets * suggests
knitr * suggests
rmarkdown * suggests
testthat >= 3.0.0 suggests
tibble * suggests

syft/pkg/cataloger/r/test-fixtures/installed/base/DESCRIPTION cran

methods * suggests

syft/pkg/cataloger/r/test-fixtures/installed/stringr/DESCRIPTION cran

R >= 3.3 depends
cli * imports
glue >= 1.6.1 imports
lifecycle >= 1.0.3 imports
magrittr * imports
rlang >= 1.0.0 imports
stringi >= 1.5.3 imports
vctrs >= 0.4.0 imports
covr * suggests
dplyr * suggests
gt * suggests
htmltools * suggests
htmlwidgets * suggests
knitr * suggests
rmarkdown * suggests
testthat >= 3.0.0 suggests
tibble * suggests

Dockerfile docker

gcr.io/distroless/static-debian11 debug@sha256 build
scratch latest build

syft/file/cataloger/filedigest/test-fixtures/image-file-type-mix/Dockerfile docker

busybox 1.28.1@sha256 build

syft/file/cataloger/filemetadata/test-fixtures/image-file-type-mix/Dockerfile docker

busybox 1.28.1@sha256 build

syft/file/cataloger/internal/test-fixtures/image-file-type-mix/Dockerfile docker

busybox 1.28.1@sha256 build

syft/internal/fileresolver/test-fixtures/image-duplicate-path/Dockerfile docker

scratch latest build

syft/internal/fileresolver/test-fixtures/image-files-deleted/Dockerfile docker

alpine 3.17.1@sha256 build
scratch latest build

syft/internal/fileresolver/test-fixtures/image-simple/Dockerfile docker

scratch latest build

syft/internal/fileresolver/test-fixtures/image-symlinks/Dockerfile docker

busybox 1.34.0@sha256 build

syft/pkg/cataloger/binary/test-fixtures/image-busybox/Dockerfile docker

busybox 1.35@sha256 build

syft/pkg/cataloger/kernel/test-fixtures/image-kernel-and-modules/Dockerfile docker

fedora 37@sha256 build
scratch latest build

syft/pkg/cataloger/rust/test-fixtures/image-audit/Dockerfile docker

docker.io/tofay/hello-rust-auditable latest@sha256 build

syft/source/test-fixtures/image-simple/Dockerfile docker

scratch latest build

test/cli/test-fixtures/image-bad-binaries/Dockerfile docker

debian sid@sha256 build

test/cli/test-fixtures/image-hidden-packages/Dockerfile docker

centos 7.9.2009@sha256 build

test/cli/test-fixtures/image-java-spdx-tools/Dockerfile docker

openjdk 11@sha256 build

test/cli/test-fixtures/image-node-binary/Dockerfile docker

node 19-alpine3.15@sha256 build

test/cli/test-fixtures/registry/Dockerfile docker

alpine@sha256 c5c5fda71656f28e49ac9c5416b3643eaa6a108a8093151d6d1afc9463be8e33 build

go.mod go

dario.cat/mergo v1.0.0
github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20221215162035-5330a85ea652
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1
github.com/CycloneDX/cyclonedx-go v0.7.2
github.com/DataDog/zstd v1.4.5
github.com/Masterminds/goutils v1.1.1
github.com/Masterminds/semver v1.5.0
github.com/Masterminds/semver/v3 v3.2.0
github.com/Masterminds/sprig/v3 v3.2.3
github.com/Microsoft/go-winio v0.6.1
github.com/Microsoft/hcsshim v0.10.0-rc.7
github.com/ProtonMail/go-crypto v0.0.0-20230828082145-3c4c8a2d2371
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
github.com/acobaugh/osrelease v0.1.0
github.com/acomagu/bufpipe v1.0.4
github.com/adrg/xdg v0.4.0
github.com/anchore/bubbly v0.0.0-20230801194016-acdb4981b461
github.com/anchore/clio v0.0.0-20230823172630-c42d666061af
github.com/anchore/fangs v0.0.0-20230818131516-2186b10924fe
github.com/anchore/go-logger v0.0.0-20230725134548-c21dafa1ec5a
github.com/anchore/go-macholibre v0.0.0-20220308212642-53e6d0aaf6fb
github.com/anchore/go-struct-converter v0.0.0-20221118182256-c68fdcfa2092
github.com/anchore/go-testutils v0.0.0-20200925183923-d5f45b0d3c04
github.com/anchore/go-version v1.2.2-0.20200701162849-18adb9c92b9b
github.com/anchore/packageurl-go v0.1.1-0.20230104203445-02e0a6721501
github.com/anchore/stereoscope v0.0.0-20230919183137-5841b53a0375
github.com/andybalholm/brotli v1.0.4
github.com/aquasecurity/go-pep440-version v0.0.0-20210121094942-22b2f8951d46
github.com/aquasecurity/go-version v0.0.0-20210121072130-637058cfe492
github.com/aymanbagabas/go-osc52/v2 v2.0.1
github.com/becheran/wildmatch-go v1.0.0
github.com/bmatcuk/doublestar/v4 v4.6.0
github.com/charmbracelet/bubbles v0.16.1
github.com/charmbracelet/bubbletea v0.24.2
github.com/charmbracelet/harmonica v0.2.0
github.com/charmbracelet/lipgloss v0.8.0
github.com/cloudflare/circl v1.3.3
github.com/containerd/cgroups v1.1.0
github.com/containerd/console v1.0.4-0.20230313162750-1ae8d489ac81
github.com/containerd/containerd v1.7.0
github.com/containerd/continuity v0.3.0
github.com/containerd/fifo v1.1.0
github.com/containerd/stargz-snapshotter/estargz v0.14.3
github.com/containerd/ttrpc v1.2.1
github.com/containerd/typeurl/v2 v2.1.0
github.com/cyphar/filepath-securejoin v0.2.4
github.com/dave/jennifer v1.7.0
github.com/davecgh/go-spew v1.1.1
github.com/deitch/magic v0.0.0-20230404182410-1ff89d7342da
github.com/docker/cli v24.0.0+incompatible
github.com/docker/distribution v2.8.2+incompatible
github.com/docker/docker v24.0.6+incompatible
github.com/docker/docker-credential-helpers v0.7.0
github.com/docker/go-connections v0.4.0
github.com/docker/go-events v0.0.0-20190806004212-e31b211e4f1c
github.com/docker/go-units v0.5.0
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5
github.com/dustin/go-humanize v1.0.1
github.com/edsrzf/mmap-go v1.1.0
github.com/emirpasic/gods v1.18.1
github.com/facebookincubator/nvdtools v0.1.5
github.com/felixge/fgprof v0.9.3
github.com/fsnotify/fsnotify v1.6.0
github.com/gabriel-vasile/mimetype v1.4.0
github.com/github/go-spdx/v2 v2.2.0
github.com/gkampitakis/ciinfo v0.2.5
github.com/gkampitakis/go-diff v1.3.2
github.com/gkampitakis/go-snaps v0.4.10
github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376
github.com/go-git/go-billy/v5 v5.5.0
github.com/go-git/go-git/v5 v5.9.0
github.com/go-logr/logr v1.2.3
github.com/go-logr/stdr v1.2.2
github.com/go-restruct/restruct v1.2.0-alpha
github.com/go-test/deep v1.1.0
github.com/gogo/protobuf v1.3.2
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da
github.com/golang/protobuf v1.5.3
github.com/golang/snappy v0.0.4
github.com/google/go-cmp v0.5.9
github.com/google/go-containerregistry v0.16.1
github.com/google/licensecheck v0.3.1
github.com/google/pprof v0.0.0-20221118152302-e6195bd50e26
github.com/google/uuid v1.3.1
github.com/gookit/color v1.5.4
github.com/hashicorp/errwrap v1.1.0
github.com/hashicorp/go-multierror v1.1.1
github.com/hashicorp/hcl v1.0.0
github.com/huandu/xstrings v1.3.3
github.com/iancoleman/orderedmap v0.0.0-20190318233801-ac98e3ecb4b0
github.com/iancoleman/strcase v0.3.0
github.com/imdario/mergo v0.3.15
github.com/inconshreveable/mousetrap v1.1.0
github.com/invopop/jsonschema v0.7.0
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
github.com/jinzhu/copier v0.4.0
github.com/kastenhq/goversion v0.0.0-20230811215019-93b2f8823953
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
github.com/kevinburke/ssh_config v1.2.0
github.com/klauspost/compress v1.16.5
github.com/klauspost/pgzip v1.2.5
github.com/knqyf263/go-rpmdb v0.0.0-20230301153543-ba94b245509b
github.com/kr/pretty v0.3.1
github.com/kr/text v0.2.0
github.com/logrusorgru/aurora v0.0.0-20200102142835-e9ef32dff381
github.com/lucasb-eyer/go-colorful v1.2.0
github.com/magiconair/properties v1.8.7
github.com/mattn/go-colorable v0.1.13
github.com/mattn/go-isatty v0.0.18
github.com/mattn/go-localereader v0.0.2-0.20220822084749-2491eb6c1c75
github.com/mattn/go-runewidth v0.0.14
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
github.com/mholt/archiver/v3 v3.5.1
github.com/microsoft/go-rustaudit v0.0.0-20220730194248-4b17361d90a5
github.com/mitchellh/copystructure v1.2.0
github.com/mitchellh/go-homedir v1.1.0
github.com/mitchellh/hashstructure/v2 v2.0.2
github.com/mitchellh/mapstructure v1.5.0
github.com/mitchellh/reflectwalk v1.0.2
github.com/moby/locker v1.0.1
github.com/moby/sys/mountinfo v0.6.2
github.com/moby/sys/sequential v0.5.0
github.com/moby/sys/signal v0.7.0
github.com/muesli/ansi v0.0.0-20211031195517-c9f0611b6c70
github.com/muesli/cancelreader v0.2.2
github.com/muesli/reflow v0.3.0
github.com/muesli/termenv v0.15.2
github.com/nwaples/rardecode v1.1.0
github.com/olekukonko/tablewriter v0.0.5
github.com/opencontainers/go-digest v1.0.0
github.com/opencontainers/image-spec v1.1.0-rc3
github.com/opencontainers/runc v1.1.5
github.com/opencontainers/runtime-spec v1.1.0-rc.1
github.com/opencontainers/selinux v1.11.0
github.com/pborman/indent v1.2.1
github.com/pelletier/go-toml v1.9.5
github.com/pelletier/go-toml/v2 v2.0.8
github.com/pierrec/lz4/v4 v4.1.15
github.com/pjbgf/sha1cd v0.3.0
github.com/pkg/errors v0.9.1
github.com/pkg/profile v1.7.0
github.com/pmezard/go-difflib v1.0.0
github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec
github.com/rivo/uniseg v0.2.0
github.com/rogpeppe/go-internal v1.11.0
github.com/saferwall/pe v1.4.5
github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d
github.com/sanity-io/litter v1.5.5
github.com/sassoftware/go-rpmutils v0.2.0
github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e
github.com/sergi/go-diff v1.3.1
github.com/shopspring/decimal v1.2.0
github.com/sirupsen/logrus v1.9.3
github.com/skeema/knownhosts v1.2.0
github.com/spdx/tools-golang v0.5.3
github.com/spf13/afero v1.9.5
github.com/spf13/cast v1.5.1
github.com/spf13/cobra v1.7.0
github.com/spf13/jwalterweatherman v1.1.0
github.com/spf13/pflag v1.0.5
github.com/spf13/viper v1.16.0
github.com/stretchr/testify v1.8.4
github.com/subosito/gotenv v1.4.2
github.com/sylabs/sif/v2 v2.11.5
github.com/sylabs/squashfs v0.6.1
github.com/therootcompany/xz v1.0.1
github.com/tidwall/gjson v1.16.0
github.com/tidwall/match v1.1.1
github.com/tidwall/pretty v1.2.1
github.com/tidwall/sjson v1.2.5
github.com/ulikunitz/xz v0.5.10
github.com/vbatts/go-mtree v0.5.3
github.com/vbatts/tar-split v0.11.3
github.com/vifraa/gopom v1.0.0
github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651
github.com/wagoodman/go-progress v0.0.0-20230911172108-cf810b7e365c
github.com/xanzy/ssh-agent v0.3.3
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415
github.com/xeipuuv/gojsonschema v1.2.0
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
github.com/xo/terminfo v0.0.0-20210125001918-ca9a967f8778
github.com/zyedidia/generic v1.2.2-0.20230320175451-4410d2372cb1
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352
go.opencensus.io v0.24.0
go.opentelemetry.io/otel v1.14.0
go.opentelemetry.io/otel/trace v1.14.0
golang.org/x/crypto v0.13.0
golang.org/x/mod v0.12.0
golang.org/x/net v0.15.0
golang.org/x/sync v0.3.0
golang.org/x/sys v0.12.0
golang.org/x/term v0.12.0
golang.org/x/text v0.13.0
golang.org/x/tools v0.13.0
golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
google.golang.org/genproto v0.0.0-20230410155749-daa745c078e1
google.golang.org/grpc v1.55.0
google.golang.org/protobuf v1.30.0
gopkg.in/ini.v1 v1.67.0
gopkg.in/warnings.v0 v0.1.2
gopkg.in/yaml.v3 v3.0.1
lukechampine.com/uint128 v1.2.0
modernc.org/cc/v3 v3.40.0
modernc.org/ccgo/v3 v3.16.13
modernc.org/libc v1.24.1
modernc.org/mathutil v1.5.0
modernc.org/memory v1.6.0
modernc.org/opt v0.1.3
modernc.org/sqlite v1.25.0
modernc.org/strutil v1.1.3
modernc.org/token v1.0.1
retract (

go.sum go

1126 dependencies

syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod go

syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod go

syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod go

github.com/CycloneDX/cyclonedx-go v0.7.0
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d

syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.sum go

github.com/CycloneDX/cyclonedx-go v0.6.0
github.com/CycloneDX/cyclonedx-go v0.7.0
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d
github.com/bradleyjkemp/cupaloy/v2 v2.7.0
github.com/davecgh/go-spew v1.1.0
github.com/davecgh/go-spew v1.1.1
github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b
github.com/mgutz/ansi v0.0.0-20200706080929-d51e80ef957d
github.com/pmezard/go-difflib v1.0.0
github.com/stretchr/objx v0.1.0
github.com/stretchr/objx v0.1.1
github.com/stretchr/testify v1.6.1
github.com/stretchr/testify v1.7.1
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405
gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c

syft/pkg/cataloger/elixir/test-fixtures/glob-paths/src/mix.lock hex

syft/pkg/cataloger/elixir/test-fixtures/mix.lock hex

syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml maven

syft/pkg/cataloger/java/test-fixtures/gradle/build.gradle maven

joda-time:joda-time 2.2 implementation
junit:junit 4.12 testImplementation

syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle maven

joda-time:joda-time 2.2 implementation
junit:junit 4.12 testImplementation

syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml maven

joda-time:joda-time 2.9.2
junit:junit 4.12 test

syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml maven

io.jenkins.tools.bom:bom-2.164.x 3 import
org.jenkins-ci.plugins:structs
org.jenkins-ci.plugins.workflow:workflow-basic-steps test
org.jenkins-ci.plugins.workflow:workflow-cps test
org.jenkins-ci.plugins.workflow:workflow-durable-task-step test
org.jenkins-ci.plugins.workflow:workflow-job test

syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml maven

org.springframework.boot:spring-boot-starter-actuator
org.springframework.boot:spring-boot-starter-web
org.springframework.boot:spring-boot-starter-test test

syft/pkg/cataloger/javascript/test-fixtures/glob-paths/src/package-lock.json npm

syft/pkg/cataloger/javascript/test-fixtures/glob-paths/src/package.json npm

syft/pkg/cataloger/javascript/test-fixtures/glob-paths/src/pnpm-lock.yaml npm

syft/pkg/cataloger/javascript/test-fixtures/glob-paths/src/yarn.lock npm

bogus

syft/pkg/cataloger/javascript/test-fixtures/pkg-json/package.json npm

deep-equal ^1.0.1 development
get-stream ^4.1.0 development
licensee ^7.0.3 development
marked ^0.6.3 development
marked-man ^0.6.0 development
npm-registry-couchapp ^2.7.4 development
npm-registry-mock ^1.3.1 development
require-inject ^1.4.4 development
sprintf-js ^1.1.2 development
standard ^11.0.1 development
tacks ^1.3.0 development
tap ^12.7.0 development
tar-stream ^2.1.0 development
JSONStream ^1.3.5
abbrev ~1.1.1
ansicolors ~0.3.2
ansistyles ~0.1.3
aproba ^2.0.0
archy ~1.0.0
bin-links ^1.1.7
bluebird ^3.5.5
byte-size ^5.0.1
cacache ^12.0.3
call-limit ^1.1.1
chownr ^1.1.4
ci-info ^2.0.0
cli-columns ^3.1.2
cli-table3 ^0.5.1
cmd-shim ^3.0.3
columnify ~1.5.4
config-chain ^1.1.12
detect-indent ~5.0.0
detect-newline ^2.1.0
dezalgo ~1.0.3
editor ~1.0.0
figgy-pudding ^3.5.1
find-npm-prefix ^1.0.2
fs-vacuum ~1.2.10
fs-write-stream-atomic ~1.0.10
gentle-fs ^2.3.0
glob ^7.1.6
graceful-fs ^4.2.4
has-unicode ~2.0.1
hosted-git-info ^2.8.8
iferr ^1.0.2
infer-owner ^1.0.4
inflight ~1.0.6
inherits ^2.0.4
ini ^1.3.5
init-package-json ^1.10.3
is-cidr ^3.0.0
json-parse-better-errors ^1.0.2
lazy-property ~1.0.0
libcipm ^4.0.7
libnpm ^3.0.1
libnpmaccess ^3.0.2
libnpmhook ^5.0.3
libnpmorg ^1.0.1
libnpmsearch ^2.0.2
libnpmteam ^1.0.2
libnpx ^10.2.2
lock-verify ^2.1.0
lockfile ^1.0.4
lodash._baseuniq ~4.6.0
lodash.clonedeep ~4.5.0
lodash.union ~4.6.0
lodash.uniq ~4.5.0
lodash.without ~4.4.0
lru-cache ^5.1.1
meant ~1.0.1
mississippi ^3.0.0
mkdirp ^0.5.5
move-concurrently ^1.0.1
node-gyp ^5.1.0
nopt ^4.0.3
normalize-package-data ^2.5.0
npm-audit-report ^1.3.2
npm-cache-filename ~1.0.2
npm-install-checks ^3.0.2
npm-lifecycle ^3.1.4
npm-package-arg ^6.1.1
npm-packlist ^1.4.8
npm-pick-manifest ^3.0.2
npm-profile ^4.0.4
npm-registry-fetch ^4.0.5
npm-user-validate ~1.0.0
npmlog ~4.1.2
once ~1.4.0
opener ^1.5.1
osenv ^0.1.5
pacote ^9.5.12
path-is-inside ~1.0.2
promise-inflight ~1.0.1
qrcode-terminal ^0.12.0
query-string ^6.8.2
qw ~1.0.1
read ~1.0.7
read-cmd-shim ^1.0.5
read-installed ~4.0.3
read-package-json ^2.1.1
read-package-tree ^5.3.1
readable-stream ^3.6.0
readdir-scoped-modules ^1.1.0
request ^2.88.0
retry ^0.12.0
rimraf ^2.7.1
safe-buffer ^5.1.2
semver ^5.7.1
sha ^3.0.0
slide ~1.1.6
sorted-object ~2.0.1
sorted-union-stream ~2.1.3
ssri ^6.0.1
stringify-package ^1.0.1
tar ^4.4.13
text-table ~0.2.0
tiny-relative-date ^1.3.0
uid-number 0.0.6
umask ~1.1.0
unique-filename ^1.1.1
unpipe ~1.0.0
update-notifier ^2.5.0
uuid ^3.3.3
validate-npm-package-license ^3.0.4
validate-npm-package-name ~3.0.0
which ^1.3.1
worker-farm ^1.7.0
write-file-atomic ^2.4.3

syft/pkg/cataloger/javascript/test-fixtures/pkg-lock/node_modules/@actions/core/package.json npm

@types/node ^12.0.2 development
@actions/http-client ^1.0.11

syft/pkg/cataloger/javascript/test-fixtures/pkg-lock/node_modules/cowsay/package.json npm

nodeunit ~0.11.1 development
rollup ^0.48.2 development
rollup-plugin-commonjs ^8.2.0 development
rollup-plugin-node-resolve ^3.0.0 development
rollup-plugin-string ^2.0.2 development
get-stdin ^5.0.1
optimist ~0.6.1
string-width ~2.1.1
strip-eof ^1.0.0

syft/pkg/cataloger/javascript/test-fixtures/pkg-lock/package-lock.json npm

@actions/core 1.6.0
ansi-regex 3.0.0
cowsay 1.4.0
get-stdin 5.0.1
is-fullwidth-code-point 2.0.0
minimist 0.0.10
optimist 0.6.1
string-width 2.1.1
strip-ansi 4.0.0
strip-eof 1.0.0
wordwrap 0.0.3

syft/pkg/cataloger/javascript/test-fixtures/pnpm/pnpm-lock.yaml npm

@bcoe v8-coverage development

syft/pkg/cataloger/javascript/test-fixtures/pnpm-v6/pnpm-lock.yaml npm

@babel core@7.21.4
@testing-library jest-dom@5.16.5
@testing-library react@13.4.0(react-dom@18.2.0)(react@18.2.0)
@testing-library user-event@13.5.0(@testing-library
@types eslint@8.37.0
react-dom@18.2.0(react@18.2.0)
react@18.2.0
read-cache@1.0.0
schema-utils@3.1.2
web-vitals@2.1.4

syft/pkg/cataloger/javascript/test-fixtures/yarn/yarn.lock npm

@babel/code-frame 7.10.4
@types/minimatch 3.0.3
@types/qs 6.9.4
ajv 6.12.3
asn1.js 4.10.1
atob 2.1.2
aws-sdk 2.706.0
c0n-fab_u.laTION 7.7.7
jhipster-core 7.3.4

syft/pkg/cataloger/javascript/test-fixtures/yarn-berry/yarn.lock npm

@babel/code-frame 7.10.4
@types/minimatch 3.0.3
@types/qs 6.9.4
ajv 6.12.3
asn1.js 4.10.1
atob 2.1.2
aws-sdk 2.706.0
c0n-fab_u.laTION 7.7.7
jhipster-core 7.3.4

syft/pkg/cataloger/php/test-fixtures/composer.lock packagist

behat/gherkin v4.6.2 development
codeception/codeception 4.1.6 development
adoy/fastcgi-client 1.0.2
alcaeus/mongo-php-adapter 1.1.11

syft/pkg/cataloger/php/test-fixtures/glob-paths/src/composer.lock packagist

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/1-requirements-dev.txt pypi

examplearchive * development

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/Pipfile.lock pypi

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/extra-requirements.txt pypi

examplearchive * test

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/poetry.lock pypi

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/requirements-dev.txt pypi

examplearchive * development

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/requirements.txt pypi

examplearchive * test

syft/pkg/cataloger/python/test-fixtures/glob-paths/src/setup.py pypi

syft/pkg/cataloger/python/test-fixtures/pipfile-lock/Pipfile.lock pypi

astroid ==2.5.2 develop
autopep8 ==1.5.6 develop
aio-pika ==6.8.0
aiodns ==2.0.0
aiohttp ==3.7.4.post0
aiohttp-jinja2 ==1.4.2

syft/pkg/cataloger/python/test-fixtures/requires/requirements.txt pypi

Mopidy-Dirble * test
SomeProject ==5.4 test
argh ==0.26.3 test
argh ==0.26.2 test
bar >=1.0.0,<=2.0.0, test
celery ==4.4.7 test
coverage * test
flask ==4.0.0 test
foo ==1.0.0 test
numpy >=3.4.1 test
numpyNew * test
requests ==2.8. test
sqlalchemy >=1.0.0,<=2.0.0, test

syft/pkg/cataloger/python/test-fixtures/setup/setup.py pypi

syft/pkg/cataloger/ruby/test-fixtures/Gemfile.lock rubygems

actionmailer 4.1.1
actionpack 4.1.1
actionview 4.1.1
activemodel 4.1.1
activerecord 4.1.1
activesupport 4.1.1
arel 5.0.1.20140414130214
bad-entry 5.5.5
bootstrap-sass 3.1.1.1
builder 3.2.2
coffee-rails 4.0.1
coffee-script 2.2.0
coffee-script-source 1.7.0
erubis 2.7.0
execjs 2.0.2
google-cloud-errors 1.3.0
hike 1.2.3
i18n 0.6.9
jbuilder 2.0.7
jquery-rails 3.1.0
json 1.8.1
kgio 2.9.2
libv8 3.16.14.3
mail 2.5.4
mime-types 1.25.1
minitest 5.3.4
multi_json 1.10.1
mysql2 0.3.16
polyglot 0.3.4
rack 1.5.2
rack-test 0.6.2
rails 4.1.1
railties 4.1.1
raindrops 0.13.0
rake 10.3.2
rdoc 4.1.1
ref 1.0.5
sass 3.2.19
sass-rails 4.0.3
sdoc 0.4.0
spring 1.1.3
sprockets 2.11.0
sprockets-rails 2.1.3
sqlite3 1.3.9
therubyracer 0.12.1
thor 0.19.1
thread_safe 0.3.3
tilt 1.4.1
treetop 1.4.15
turbolinks 3.0.0
tzinfo 1.2.0
uglifier 2.5.0
unicorn 4.8.3

syft/pkg/cataloger/ruby/test-fixtures/bundler.gemspec rubygems

syft/pkg/cataloger/ruby/test-fixtures/glob-paths/specifications/pkg/nested.gemspec rubygems

syft/pkg/cataloger/ruby/test-fixtures/glob-paths/specifications/root.gemspec rubygems

syft/pkg/cataloger/ruby/test-fixtures/glob-paths/src/Gemfile.lock rubygems

syft/pkg/cataloger/swift/test-fixtures/Package.resolved swiftpm

github.com/apple/swift-algorithms 1.0.0
github.com/apple/swift-async-algorithms 0.1.0
github.com/apple/swift-atomics 1.1.0
github.com/apple/swift-collections 1.0.4
github.com/apple/swift-numerics 1.0.2

.github/workflows/detect-schema-changes.yaml actions

actions/checkout b4ffde65f46336ab88eb53be808477a3936bae11 composite
marocchino/sticky-pull-request-comment efaaab3fd41a9c3de579aba759d2552635e590fd composite

syft/format/internal/testutil/test-fixtures/image-simple/Dockerfile docker

scratch latest build

syft/format/syftjson/test-fixtures/image-alpine/Dockerfile docker

alpine 3.18.4@sha256 build

syft/pkg/cataloger/debian/test-fixtures/image-distroless-deb/Dockerfile docker

scratch latest build

syft/pkg/cataloger/debian/test-fixtures/image-dpkg/Dockerfile docker

scratch latest build

syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-all/pom.xml maven

${project.groupId}:api-asn1-api
${project.groupId}:api-asn1-ber
${project.groupId}:api-dsml-engine
${project.groupId}:api-dsml-parser
${project.groupId}:api-i18n
${project.groupId}:api-ldap-client-api
${project.groupId}:api-ldap-codec-core
${project.groupId}:api-ldap-codec-standalone
${project.groupId}:api-ldap-extras-aci
${project.groupId}:api-ldap-extras-codec
${project.groupId}:api-ldap-extras-codec-api
${project.groupId}:api-ldap-extras-sp
${project.groupId}:api-ldap-extras-trigger
${project.groupId}:api-ldap-extras-util
${project.groupId}:api-ldap-model
${project.groupId}:api-ldap-net-mina
${project.groupId}:api-ldap-schema-converter
${project.groupId}:api-ldap-schema-data
${project.groupId}:api-util

syft/pkg/cataloger/java/test-fixtures/jar-metadata/api-all-2.0.0-sources/META-INF/maven/org.apache.directory.api/api-asn1-api/pom.xml maven

${project.groupId}:api-i18n
log4j:log4j test
org.junit.jupiter:junit-jupiter-engine test
org.slf4j:slf4j-api test
org.slf4j:slf4j-log4j12 test

syft/pkg/cataloger/java/test-fixtures/jar-metadata/com.fasterxml.jackson.core.jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml maven

ch.randelshofer:fastdoubleparser 0.9.0
org.junit.jupiter:junit-jupiter test
org.junit.vintage:junit-vintage-engine test

syft/pkg/cataloger/java/test-fixtures/jar-metadata/jackson-core-2.15.2/META-INF/maven/com.fasterxml.jackson.core/jackson-core/pom.xml maven

ch.randelshofer:fastdoubleparser 0.9.0
org.junit.jupiter:junit-jupiter test
org.junit.vintage:junit-vintage-engine test

syft/pkg/cataloger/java/test-fixtures/jar-metadata/opensaml-core-3.4.6/META-INF/maven/org.opensaml/opensaml-core/pom.xml maven

io.dropwizard.metrics:metrics-core
joda-time:joda-time

syft/pkg/cataloger/javascript/test-fixtures/yarn-remote/yarn.lock npm

@babel/code-frame 7.10.4

syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-2/pom.xml maven

syft/pkg/cataloger/golang/test-fixtures/image-not-a-module/go.sum go

github.com/anchore/archiver/v3 v3.5.3-0.20241210171143-5b1d8d1c7c51
github.com/andybalholm/brotli v1.1.1
github.com/dsnet/compress v0.0.2-0.20210315054119-f66993602bf5
github.com/dsnet/golib v0.0.0-20171103203638-1ea166775780
github.com/golang/snappy v0.0.4
github.com/google/go-cmp v0.5.5
github.com/klauspost/compress v1.4.1
github.com/klauspost/compress v1.17.11
github.com/klauspost/cpuid v1.2.0
github.com/klauspost/pgzip v1.2.6
github.com/nwaples/rardecode v1.1.3
github.com/pierrec/lz4/v4 v4.1.21
github.com/ulikunitz/xz v0.5.8
github.com/ulikunitz/xz v0.5.12
github.com/xi2/xz v0.0.0-20171230120015-48954b6210f8
github.com/xyproto/randomstring v1.0.5
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543

syft/pkg/cataloger/lua/test-fixtures/rockspec/kong-pgmoon-1.16.2-1.rockspec luarocks

cqueues *
lpeg *
lua >= 5.1
lua-resty-openssl *
luaossl *
luasec *
luasocket *

syft/pkg/cataloger/dotnet/test-fixtures/image-net8-app-with-runtime-nodepsjson/src/dotnetapp.csproj nuget

Humanizer 2.14.1
Newtonsoft.Json 13.0.3

syft/pkg/cataloger/dart/test-fixtures/corrupt/pubspec.lock pub

syft/pkg/cataloger/python/test-fixtures/poetry/multiple-extras/poetry.lock pypi

anyio 4.3.0
brotli 1.1.0
brotlicffi 1.1.0.0
certifi 2024.2.2
cffi 1.16.0
h11 0.14.0
h2 4.1.0
hpack 4.0.0
httpcore 1.0.5
httpx 0.27.0
hyperframe 6.0.1
idna 3.7
pycparser 2.22
sniffio 1.3.1
socksio 1.0.0

cmd/syft/internal/test/integration/test-fixtures/image-photon-all-layers/Dockerfile docker

photon 5.0-20230729@sha256 build
scratch latest build

syft/pkg/cataloger/internal/pe/test-fixtures/image-dotnet31-single-file/Dockerfile docker

busybox latest build
mcr.microsoft.com/dotnet/core/sdk 3.1 build

syft/pkg/cataloger/redhat/test-fixtures/image-minimal/Dockerfile docker

rockylinux 9.3.20231119@sha256 build
scratch latest build

syft/pkg/cataloger/erlang/test-fixtures/glob-paths/src/rebar.lock hex

syft/pkg/cataloger/java/internal/maven/test-fixtures/local/child-3/pom.xml maven

syft/pkg/cataloger/java/internal/maven/test-fixtures/local/circular-2/pom.xml maven