Issues

• Windows build: binary-classifier packages not de-duplicated against dpkg-owned files (false openssl CVEs vs Linux, same DB)

  anchore/syft#5466 · Filter by author mfwisely-wisetech opened on Oct 24, 2026

• security: document checksum-verified install alongside curl-pipe method in README and Taskfile

  anchore/syft#5456 · Filter by author javier20dev25 opened on Oct 22, 2026

• Detect ZIP payloads in extensionless and self-extracting files in the file source

  anchore/syft#5455 · Filter by author loganrosen opened on Oct 22, 2026
  1

• dotnet-deps-binary-cataloger finds no packages in a Windows (PE) single-file bundle

  anchore/syft#5454 · Filter by author Albasha0x0 opened on Oct 22, 2026

• Container images bundle CA roots distrusted after the eMudhra/Sectigo incident

  anchore/syft#5451 · Filter by author stefanobaghino opened on Oct 21, 2026

• Bump Go toolchain from 1.26.8 to >= 1.26.10 in release builds to resolve stdlib CVEs (GO-2026-6604, GO-2026-6612, GO-2026-6809)

  anchore/syft#5450 · Filter by author gaurav-chaurasia opened on Oct 21, 2026

• syft not able to scan rootless podman image (containers-storage)

  bug
  anchore/syft#5449 · Filter by author wkbrd opened on Oct 20, 2026

• SPDX package verification code is the SHA1 of empty input when files are hashed without SHA1

  anchore/syft#5441 · Filter by author eriknordmark opened on Oct 17, 2026
  2

• SPDX supplier/originator dropped when the maintainer email domain has a hyphen or a subdomain

  anchore/syft#5439 · Filter by author eriknordmark opened on Oct 17, 2026
  2

• Universal (fat) Mach-O Go binaries: only the first slice's stdlib version is reported

  anchore/syft#5430 · Filter by author jmountifield opened on Oct 16, 2026

• apple-app-bundle packages get CPEs built from the display name, which never match NVD (e.g. Google Chrome)

  anchore/syft#5429 · Filter by author jmountifield opened on Oct 16, 2026

• Detect macOS version from SystemVersion.plist (distro is empty for macOS filesystems)

  anchore/syft#5428 · Filter by author jmountifield opened on Oct 16, 2026

• Support for detecting ARM64 Linux images with EFI stubs- #5392

  enhancement
  anchore/syft#5424 · Filter by author nadimz opened on Oct 14, 2026

• SBOMs do not always capture package signatures

  bug
  anchore/syft#5421 · Filter by author sfackler opened on Oct 13, 2026
  1

• Record CocoaPods EXTERNAL SOURCES (:path:, :git:, :podspec:) on Podfile.lock packages

  anchore/syft#5418 · Filter by author az-catch opened on Oct 13, 2026

• fix(java): Tomcat embedded EL filter misses official JARs without Maven metadata

  anchore/syft#5412 · Filter by author bisswanger opened on Oct 12, 2026

• chrome-binary classifier misses Chrome for Testing 153.0.8010.12: version not followed by \x00Default

  anchore/syft#5379 · Filter by author InfiniteSemicolon opened on Oct 5, 2026
  1

• bun.lock cataloger: production packages nondeterministically dropped as "dev-only" when a package name appears more than once

  anchore/syft#5378 · Filter by author mohamedalaa253695 opened on Oct 5, 2026

• Allow disabling local JavaScript license-file discovery

  anchore/syft#5376 · Filter by author akbast opened on Oct 5, 2026

• Gradle lockfile comment line is catalogued as a package

  anchore/syft#5371 · Filter by author sdl-eng opened on Oct 2, 2026

• Python dependency targets are nondeterministic on name collisions

  bugecosystem:python
  anchore/syft#5357 · Filter by author grgalex opened on Sep 30, 2026
  2

• Proposal: correlate SRAC safety-relevance assertions with generated SBOMs

  needs-discussion
  anchore/syft#5339 · Filter by author devashridatta-dotcom opened on Sep 27, 2026

• "Zip read limit hit" bug (potential decompression bomb attack) in vllm_vllm-openai_v0.30.0.tar

  bug
  anchore/syft#5338 · Filter by author pig837 opened on Sep 27, 2026
  1

• Kernel module parameters lose either their type/their description

  bug
  anchore/syft#5318 · Filter by author rezmoss opened on Sep 22, 2026

• CPE generation attributes the umbrella project's product to unrelated artifacts under a nested groupIDs

  bug
  anchore/syft#5316 · Filter by author rezmoss opened on Sep 21, 2026
  1