syft
v1.57.1CLI tool and library for generating a Software Bill of Materials from container images and filesystems
- Maintenance
- ActiveBased on the last push: commit history is not collected yet
- License
- Apache-2.0Permissive · OSI-approved
- Security
- 3 advisories3 medium · Scorecard 8.5/10
- Supported versions
- No scheduleendoflife.date does not track this project
9.9k stars · 1.1k forks · 723 open issues · last release 6 days ago · data checked 2 hours ago
Release history
All releases on GitHubAtom feed/feed/anchore/syft
Badge
[](/p/anchore/syft)
Dependencies
7 dependency changes (7 updated). 3 vulnerabilities remediated.
🟢 Remediated (3)
- GO-2026-6860 (High) — golang.org/x/net
- GO-2026-6866 (Medium) — golang.org/x/net
- GO-2026-6888 (Critical) — github.com/andybalholm/brotli
Updated (7 packages)
- github.com/andybalholm/brotli
v1.2.0→v1.2.8(🟢 remediated GO-2026-6888) - github.com/bmatcuk/doublestar/v4
v4.10.3→v4.10.4 - github.com/gkampitakis/go-snaps
v0.5.24→v0.5.25 - github.com/gpustack/gguf-parser-go
v0.27.0→v0.28.1 - github.com/moby/sys/mountinfo
v0.7.2→v0.7.3 - go.yaml.in/yaml/v3
v3.0.5→v3.0.6 - golang.org/x/net
v0.61.0→v0.62.0(🟢 remediated GO-2026-6860, GO-2026-6866)