Issues

• Support for detecting ARM64 Linux images with EFI stubs- #5392

  enhancement
  anchore/syft#5424 · Filter by author nadimz opened on Oct 14, 2026

• SBOMs do not always capture package signatures

  bug
  anchore/syft#5421 · Filter by author sfackler opened on Oct 13, 2026
  1

• Record CocoaPods EXTERNAL SOURCES (:path:, :git:, :podspec:) on Podfile.lock packages

  anchore/syft#5418 · Filter by author az-catch opened on Oct 13, 2026

• fix(java): Tomcat embedded EL filter misses official JARs without Maven metadata

  anchore/syft#5412 · Filter by author bisswanger opened on Oct 12, 2026

• chrome-binary classifier misses Chrome for Testing 153.0.8010.12: version not followed by \x00Default

  anchore/syft#5379 · Filter by author InfiniteSemicolon opened on Oct 5, 2026
  1

• bun.lock cataloger: production packages nondeterministically dropped as "dev-only" when a package name appears more than once

  anchore/syft#5378 · Filter by author mohamedalaa253695 opened on Oct 5, 2026

• Allow disabling local JavaScript license-file discovery

  anchore/syft#5376 · Filter by author akbast opened on Oct 5, 2026

• Gradle lockfile comment line is catalogued as a package

  anchore/syft#5371 · Filter by author sdl-eng opened on Oct 2, 2026

• Python dependency targets are nondeterministic on name collisions

  bugecosystem:python
  anchore/syft#5357 · Filter by author grgalex opened on Sep 30, 2026
  2

• Proposal: correlate SRAC safety-relevance assertions with generated SBOMs

  needs-discussion
  anchore/syft#5339 · Filter by author devashridatta-dotcom opened on Sep 27, 2026

• "Zip read limit hit" bug (potential decompression bomb attack) in vllm_vllm-openai_v0.30.0.tar

  bug
  anchore/syft#5338 · Filter by author pig837 opened on Sep 27, 2026
  1

• Kernel module parameters lose either their type/their description

  bug
  anchore/syft#5318 · Filter by author rezmoss opened on Sep 22, 2026

• CPE generation attributes the umbrella project's product to unrelated artifacts under a nested groupIDs

  bug
  anchore/syft#5316 · Filter by author rezmoss opened on Sep 21, 2026
  1

• CHANGELOG.md has wrong file permissions in the released .tar.gz

  bug
  anchore/syft#5305 · Filter by author mkauf opened on Sep 18, 2026

• java-pom-cataloger reports dependencies from profiles that cannot be active

  anchore/syft#5269 · Filter by author Eljees opened on Sep 11, 2026
  3

• Reconsider dependency on archived fork https://github.com/anchore/go-version

  enhancement
  anchore/syft#5266 · Filter by author jas4711 opened on Sep 10, 2026

• Detect licenses from comments in embedded Maven POMs

  enhancement
  anchore/syft#5248 · Filter by author chrisrueger opened on Sep 3, 2026

• pnpm cataloger: a devEngines.runtime entry aborts the whole document, yielding an empty SBOM

  anchore/syft#5241 · Filter by author Brian-Bowyer opened on Aug 28, 2026
  1

• Add catalogers for FreeBSD

  enhancementnew-cataloger
  anchore/syft#5235 · Filter by author danhuang-ixia opened on Aug 27, 2026

• --exclude is not honored for paths reached via a symlink target

  bug
  anchore/syft#5232 · Filter by author spiffcs opened on Aug 26, 2026

• Multiple packages generate the same CPE, resulting in loss of package identity

  bug
  anchore/syft#5224 · Filter by author sumankDev opened on Aug 24, 2026
  1

• exclude-binary-overlap-by-ownership suppresses vendored libraries owned by unrelated RPMs

  bug
  anchore/syft#5214 · Filter by author sekveaja opened on Aug 21, 2026
  2

• dotnet: packages.lock.json packages collapse per-target-framework type and requested into one value

  bug
  anchore/syft#5211 · Filter by author spiffcs opened on Aug 21, 2026
  1

• yarn.lock (v1) cataloger silently returns 118 of 745 packages — most entries dropped without error

  bug
  anchore/syft#5204 · Filter by author c-schmitz opened on Aug 21, 2026
  2

• Support for concurrent package registry requests when using --enrich

  enhancement
  anchore/syft#5193 · Filter by author winwinashwin opened on Aug 18, 2026
  1