Issues

• Gradle lockfile comment line is catalogued as a package

  anchore/syft#5371 · Filter by author sdl-eng opened on Oct 2, 2026

• Python dependency targets are nondeterministic on name collisions

  bugecosystem:python
  anchore/syft#5357 · Filter by author grgalex opened on Sep 30, 2026

• Proposal: correlate SRAC safety-relevance assertions with generated SBOMs

  needs-discussion
  anchore/syft#5339 · Filter by author devashridatta-dotcom opened on Sep 27, 2026

• "Zip read limit hit" bug (potential decompression bomb attack) in vllm_vllm-openai_v0.30.0.tar

  bug
  anchore/syft#5338 · Filter by author pig837 opened on Sep 27, 2026
  1

• Kernel module parameters lose either their type/their description

  bug
  anchore/syft#5318 · Filter by author rezmoss opened on Sep 22, 2026

• CPE generation attributes the umbrella project's product to unrelated artifacts under a nested groupIDs

  bug
  anchore/syft#5316 · Filter by author rezmoss opened on Sep 21, 2026
  1

• CHANGELOG.md has wrong file permissions in the released .tar.gz

  bug
  anchore/syft#5305 · Filter by author mkauf opened on Sep 18, 2026

• java-pom-cataloger reports dependencies from profiles that cannot be active

  anchore/syft#5269 · Filter by author Eljees opened on Sep 11, 2026
  3

• Reconsider dependency on archived fork https://github.com/anchore/go-version

  enhancement
  anchore/syft#5266 · Filter by author jas4711 opened on Sep 10, 2026

• Detect licenses from comments in embedded Maven POMs

  enhancement
  anchore/syft#5248 · Filter by author chrisrueger opened on Sep 3, 2026

• pnpm cataloger: a devEngines.runtime entry aborts the whole document, yielding an empty SBOM

  anchore/syft#5241 · Filter by author Brian-Bowyer opened on Aug 28, 2026
  1

• Add catalogers for FreeBSD

  enhancementnew-cataloger
  anchore/syft#5235 · Filter by author danhuang-ixia opened on Aug 27, 2026

• --exclude is not honored for paths reached via a symlink target

  bug
  anchore/syft#5232 · Filter by author spiffcs opened on Aug 26, 2026

• Multiple packages generate the same CPE, resulting in loss of package identity

  bug
  anchore/syft#5224 · Filter by author sumankDev opened on Aug 24, 2026
  1

• exclude-binary-overlap-by-ownership suppresses vendored libraries owned by unrelated RPMs

  bug
  anchore/syft#5214 · Filter by author sekveaja opened on Aug 21, 2026
  2

• dotnet: packages.lock.json packages collapse per-target-framework type and requested into one value

  bug
  anchore/syft#5211 · Filter by author spiffcs opened on Aug 21, 2026
  1

• yarn.lock (v1) cataloger silently returns 118 of 745 packages — most entries dropped without error

  bug
  anchore/syft#5204 · Filter by author c-schmitz opened on Aug 21, 2026
  2

• Support for concurrent package registry requests when using --enrich

  enhancement
  anchore/syft#5193 · Filter by author winwinashwin opened on Aug 18, 2026
  1

• feat: inventory X.509 certificates for CycloneDX CBOM output

  anchore/syft#5190 · Filter by author AAH20 opened on Aug 17, 2026
  3

• Support enriching catalogs with build-time in-toto attestations (SBOMit)

  enhancement
  anchore/syft#5180 · Filter by author Marc-cn opened on Aug 13, 2026
  5

• pe-binary-package-cataloger selects an unexpected language block from multi-language VERSIONINFO resources

  bug
  anchore/syft#5177 · Filter by author alasdraco opened on Aug 13, 2026
  1

• Support Palantir's gradle-consistent-versions lockfile (versions.lock)

  enhancement
  anchore/syft#5176 · Filter by author TvdBrink opened on Aug 13, 2026

• Language-ecosystem packages in image SBOMs carry no dependency relationships (and CycloneDX/SPDX disagree on the same image)

  anchore/syft#5173 · Filter by author alibek-git opened on Aug 12, 2026
  1

• Paths that could not be accessed are recorded in errPaths and never reach the SBOM

  anchore/syft#5153 · Filter by author siliroid opened on Aug 5, 2026
  1

  

• Adding GitHub attestations

  enhancementrelease
  anchore/syft#5149 · Filter by author igor-makarov opened on Aug 3, 2026
  1