Repository Issue Activity (beta)

#5247 Syft rpm-db-cataloger reports stale libssh version from a single-layer Rocky Linux 10 image

#5163 java-archive-cataloger returns unknown ver for uber-jars

#3071 Dependency graph of BOMs generated with Syft is incomplete due to missing root node

#4747 Syft does not use parent pom.xml for license detection if MANIFEST.MF contains Bundle-License

#5248 Detect licenses from comments in embedded Maven POMs

#4163 dotnet-deps-binary-cataloger DLL to package version matching is too precise

#2285 Syft cli.Command() panics when invoked multiple times

#5172 Potential source RPM license aggregation resulting in overly broad license expressions for RPM packages

#5241 pnpm cataloger: a devEngines.runtime entry aborts the whole document, yielding an empty SBOM

#4011 Add ability to catalog Electron applications

#5235 Add catalogers for FreeBSD

#5059 Support grafana binary various version

#3258 Excluded paths are still scanned and cause syft to crash.

#5232 --exclude is not honored for paths reached via a symlink target

#5083 An alternative to the ordered rule list for overlap precedence: dominance

#5190 feat: inventory X.509 certificates for CycloneDX CBOM output

#5129 Add catalogers for Ansible collections and roles

#5173 Language-ecosystem packages in image SBOMs carry no dependency relationships (and CycloneDX/SPDX disagree on the same image)

#3497 [DOCS] Document your CycloneDX properties

#5177 pe-binary-package-cataloger selects an unexpected language block from multi-language VERSIONINFO resources

#5211 dotnet: packages.lock.json packages collapse per-target-framework type and requested into one value

#5224 Multiple packages generate the same CPE, resulting in loss of package identity

#5075 Incorrect CPE values

#5214 exclude-binary-overlap-by-ownership suppresses vendored libraries owned by unrelated RPMs

#5222 perm-probe-do-not-use