Issues

• git bin not detected by bin classifier

  enhancement
  anchore/syft#5573 · Filter by author rezmoss opened on Nov 13, 2026
  1

• Debian cataloger: add udeb, ddeb package extensions

  enhancement
  anchore/syft#5567 · Filter by author xoneca-bilerro opened on Nov 13, 2026

• Option to emit one package per module when the same Go module is compiled into several binaries

  enhancementneeds-discussion
  anchore/syft#5566 · Filter by author vibbix opened on Nov 12, 2026

• Replace unmaintained github.com/blakesmith/ar (GO-2026-6905)

  anchore/syft#5562 · Filter by author alrex5401 opened on Nov 12, 2026
  1

  

• windows node.exe gets the wrong cpe vendor Node.js

  bug
  anchore/syft#5555 · Filter by author rezmoss opened on Nov 10, 2026
  1

• feat(directory): add an opt-in mode to skip macOS dataless files

  anchore/syft#5554 · Filter by author coygeek opened on Nov 10, 2026

• fix(binary): Bun classifier reports historical version text before the runtime banner

  anchore/syft#5553 · Filter by author coygeek opened on Nov 10, 2026

• fix(golang): hyphenated GOEXPERIMENT suffix prevents stdlib version normalization

  anchore/syft#5551 · Filter by author coygeek opened on Nov 10, 2026

• feat(binary): identify Python runtimes in macOS frameworks and dylibs

  anchore/syft#5550 · Filter by author coygeek opened on Nov 10, 2026

• feat(binary): identify Node.js in macOS shared-library builds

  anchore/syft#5549 · Filter by author coygeek opened on Nov 10, 2026

• pnpm lockfile document silently dropped when it contains a runtime entry with resolution type: variations

  bug
  anchore/syft#5544 · Filter by author mbanga11 opened on Nov 7, 2026
  1

• javascript-package-cataloger effectively hangs on pnpm workspace images (license search in searchByParentBasename / firstPathToNode)

  anchore/syft#5542 · Filter by author mebibite opened on Nov 6, 2026

• python-package-cataloger misses pip requirement files in requirements/dirs

  bug
  anchore/syft#5530 · Filter by author rezmoss opened on Nov 5, 2026

• Rename json field layerid to filesystemid

  anchore/syft#5529 · Filter by author wagoodman opened on Nov 5, 2026 · Syft 2.0

• Unable to extract and analyze a file compressed with recent 7-zip

  bug
  anchore/syft#5528 · Filter by author larsbjornfot opened on Nov 5, 2026
  4

• Exclude patterns do not match paths reached through symlinks under a common scan root

  bug
  anchore/syft#5527 · Filter by author Corina-cisiaa opened on Nov 5, 2026

• sbom-cataloger merges packages from different SBOM documents that share an SPDX ID

  anchore/syft#5525 · Filter by author mprpic opened on Nov 4, 2026

• Wrong namespace in purl for hibernate-commons-annotations

  bug
  anchore/syft#5522 · Filter by author daniel-kuehltau opened on Nov 4, 2026

• fix(source): relative directory scan includes sibling packages with a symlinked PWD

  anchore/syft#5519 · Filter by author coygeek opened on Nov 3, 2026
  1

• pe-binary-package-cataloger reports php ext dlls as the php interpreter

  bug
  anchore/syft#5516 · Filter by author rezmoss opened on Nov 3, 2026
  1

• Use the JVM implementor for the purl namespace of OpenJDK builds (Red Hat, Eclipse Adoptium)

  anchore/syft#5505 · Filter by author torsten-liermann opened on Oct 30, 2026
  3

• yarn.lock dev-dependency filtering only works when the lock file is at the scan root

  bug
  anchore/syft#5489 · Filter by author simonetej opened on Oct 29, 2026
  2

• Support detecting uncompressed ELF Linux kernels (vmlinux)

  enhancement
  anchore/syft#5484 · Filter by author lisasgoh opened on Oct 27, 2026

• PE cataloger reads the assembly’s product name from the DLL metadata instead of NuGet package id

  bug
  anchore/syft#5480 · Filter by author Sigurd-Holhjem-Laerdal opened on Oct 27, 2026
  1

• --source-supplier is applied to all packages

  bug
  anchore/syft#5472 · Filter by author barnes-c opened on Oct 25, 2026
  2