Added Features

• Add the ability to fetch remote licenses for pnpm-lock.yaml files [#4286 @timols]
• support universal (fat) mach-o binary files [#4278 @JoeyShapiro]
• pdm support [#2709 #4234 @paulslaby]

Bug Fixes

• Remove duplicate image source providers [#4289 @Rupikz]
• syft can't extract go module information from executables on Windows [#4271 #4285 @JoeyShapiro]

(Full Changelog)

Bug Fixes

• Extract zip archive with multiple entries [#4283 @Rupikz]
• panic while resolving maven properties in archive parser [#4288 #4290 @kzantow]

(Full Changelog)

Added Features

• feat: enhance setup.py parser to handle unquoted dependencies [#4255 @HalaAli198]
• feat: support for identifying ffmpeg/libav libraries [#4227 @popey]
• feat: PNPM latest lockfile (version 9.0) [#3927 #4256 @bernardoamc]
• Add Windows ARM64 releases [#4179 #4237 @compnerd]

Bug Fixes

• fix: SBOM CPE mismatch for Qt5 causes Grype to miss CVE matches [#4036 #4093 @hawkaii]
• fix: use of manifest files present in Snap packages when generating SBOMs [#4147 #4151 @popey]
• fix: Pom xml only archive parser [#4272 @douglasclarke]

(Full Changelog)

Added Features

• Modify RpmDBEntry to include modularityLabel for cyclonedx [#4212 @sfc-gh-rmaj]
• Add locations onto packages read from Java native image SBOMs [#4186 @rudsberg]

(Full Changelog)

Added Features

• Catalog entire build list for Go projects, not just packages listed in go.mod [#432 #4127 @spiffcs]
• package.json authors keyword parsing [#2250 #4003 @popey]
• Conda ecosystem support (basic) [#4002@SimeonStoykovQC]

Bug Fixes

• When scanning the FFmpeg binary with Syft a new package is now added [#3988 #3994 @popey]
• Warn loudly if SQLite driver is not present when needed [#3234 #4150 @kzantow]

Additional Changes

• Update dependencies to use go.yaml.in/yaml [#4157 @n-bes]

(Full Changelog)

Added Features

• Option to set PackageSupplier in root of SPDX document generated by CLI [#3098 #4131 @spiffcs]

Bug Fixes

• closed reader during java binary detection [#4129 @kzantow]
• support multiple letters in openssl patch version [#4106 @honigbot]
• Can not have license ID [#1964 #4132 @spiffcs]
• Syft sometimes reports URL for license value when scanning JARs with a URL in Bundle-License field of manifest [#3186]

(Full Changelog)

Added Features

• add binary classifier for hashicorp vault [#4121 @willmurphyscode]

Bug Fixes

• fix: update nondeterministic Java archive cataloging and improve groupID [#3521 #4118 @kzantow]

(Full Changelog)

Bug Fixes

• Missing license information for tzdata [#4102]
• Improve JVM Scan Accuracy for JDK and JRE Detection [#4071 #4046 @kzantow]
• Azul JDK classified as Oracle JRE [#3893 #4046 @kzantow]

(Full Changelog)

Added Features

• Catalog python uv.lock files [#3268 #3763 @jkugler]

Additional Changes

• Pkg Metadata type unmarshal bug [#4043 @houdini91]

(Full Changelog)

Added Features

• add native support for snap packages [#1088 #3929 @wagoodman]

Additional Changes

• upgrade tablewriter dependency to use new API [#3990 @cpanato]

(Full Changelog)