Issues

• Binary classifier nodejs-binary does not catalog Windows node.exe

  anchore/syft#5533 · Filter by author HengYangDS opened on Nov 6, 2026

• python-package-cataloger misses pip requirement files in requirements/dirs

  bug
  anchore/syft#5530 · Filter by author rezmoss opened on Nov 5, 2026

• Rename json field layerid to filesystemid

  anchore/syft#5529 · Filter by author wagoodman opened on Nov 5, 2026 · Syft 2.0

• Unable to extract and analyze a file compressed with recent 7-zip

  bug
  anchore/syft#5528 · Filter by author larsbjornfot opened on Nov 5, 2026
  2

• Exclude patterns do not match paths reached through symlinks under a common scan root

  bug
  anchore/syft#5527 · Filter by author Corina-cisiaa opened on Nov 5, 2026

• sbom-cataloger merges packages from different SBOM documents that share an SPDX ID

  anchore/syft#5525 · Filter by author mprpic opened on Nov 4, 2026

• Wrong namespace in purl for hibernate-commons-annotations

  bug
  anchore/syft#5522 · Filter by author daniel-kuehltau opened on Nov 4, 2026

• fix(source): relative directory scan includes sibling packages with a symlinked PWD

  anchore/syft#5519 · Filter by author coygeek opened on Nov 3, 2026
  1

• pe-binary-package-cataloger reports php ext dlls as the php interpreter

  bug
  anchore/syft#5516 · Filter by author rezmoss opened on Nov 3, 2026
  1

• Use the JVM implementor for the purl namespace of OpenJDK builds (Red Hat, Eclipse Adoptium)

  anchore/syft#5505 · Filter by author torsten-liermann opened on Oct 30, 2026
  3

• yarn.lock dev-dependency filtering only works when the lock file is at the scan root

  bug
  anchore/syft#5489 · Filter by author simonetej opened on Oct 29, 2026

• Support detecting uncompressed ELF Linux kernels (vmlinux)

  enhancement
  anchore/syft#5484 · Filter by author lisasgoh opened on Oct 27, 2026

• PE cataloger reads the assembly’s product name from the DLL metadata instead of NuGet package id

  bug
  anchore/syft#5480 · Filter by author Sigurd-Holhjem-Laerdal opened on Oct 27, 2026
  1

• --source-supplier is applied to all packages

  bug
  anchore/syft#5472 · Filter by author barnes-c opened on Oct 25, 2026
  2

• syft drops information about vulnerable golang versions in go.mod

  bug
  anchore/syft#5471 · Filter by author markus-noga opened on Oct 25, 2026

• Windows build: binary-classifier packages not de-duplicated against dpkg-owned files (false openssl CVEs vs Linux, same DB)

  anchore/syft#5466 · Filter by author mfwisely-wisetech opened on Oct 24, 2026

• security: document checksum-verified install alongside curl-pipe method in README and Taskfile

  anchore/syft#5456 · Filter by author javier20dev25 opened on Oct 22, 2026

• Detect ZIP payloads in extensionless and self-extracting files in the file source

  anchore/syft#5455 · Filter by author loganrosen opened on Oct 22, 2026
  1

• dotnet-deps-binary-cataloger finds no packages in a Windows (PE) single-file bundle

  anchore/syft#5454 · Filter by author Albasha0x0 opened on Oct 22, 2026

• Container images bundle CA roots distrusted after the eMudhra/Sectigo incident

  anchore/syft#5451 · Filter by author stefanobaghino opened on Oct 21, 2026

• Bump Go toolchain from 1.26.8 to >= 1.26.10 in release builds to resolve stdlib CVEs (GO-2026-6604, GO-2026-6612, GO-2026-6809)

  anchore/syft#5450 · Filter by author gaurav-chaurasia opened on Oct 21, 2026

• syft not able to scan rootless podman image (containers-storage)

  bug
  anchore/syft#5449 · Filter by author wkbrd opened on Oct 20, 2026

• SPDX package verification code is the SHA1 of empty input when files are hashed without SHA1

  anchore/syft#5441 · Filter by author eriknordmark opened on Oct 17, 2026
  2

• SPDX supplier/originator dropped when the maintainer email domain has a hyphen or a subdomain

  anchore/syft#5439 · Filter by author eriknordmark opened on Oct 17, 2026
  2

• Universal (fat) Mach-O Go binaries: only the first slice's stdlib version is reported

  anchore/syft#5430 · Filter by author jmountifield opened on Oct 16, 2026