Syft
CLI tool and library for generating a Software Bill of Materials from container images and filesystems
v1.51.0
28.1 MBscanned clean
Verify your download
Select the file you downloaded to check it against the hash we published — the check runs in your browser, nothing is uploaded.
Screenshots
About
Syft examines container images, filesystems, and archives to produce a Software Bill of Materials (SBOM) showing the software components and dependencies inside them. As both a command-line program and a Go library, it lets engineers generate this inventory in scripts or embed SBOM creation in their own applications. This gives development and operations teams a concrete basis for vulnerability investigation, license compliance, and software supply-chain security.
It accepts OCI, Docker, Singularity, and other image formats, along with filesystem and archive targets. Results can be emitted as CycloneDX, SPDX, Syft JSON, and other formats, and Syft can convert between SBOM formats. It can also create signed SBOM attestations under the in-toto specification. Used with Grype, it supports vulnerability scanning against the generated SBOM.
Developers commonly use Syft to inspect a container or directory during build and release workflows, while security and compliance teams use the results to assess dependencies and component licensing. The open-source Syft release from Anchore is a Windows application for x64 systems running Windows 10 or later or Windows Server 2016 or later.
Version 1.51.0 adds detection of native Go FIPS 140 mode in binaries and introduces extended-stdlib scope and module patterns for symbol capture. It also fixes incorrect package URLs for legacy JARs lacking Maven metadata and improves handling of hard-linked files during image scans.
Requires Windows 10+ · Server 2016+ · Architecture: x64
What's new in v1.51.0
Added Features - detect native Go FIPS 140 mode in binaries [PR #5155 @gunnypatel] - add extended-stdlib scope and module patterns for symbol capture [PR #5154 @wagoodman]
Bug Fixes - Cleanup snap temporary directories [PR #5117 @spiffcs] - add correct CPE vendor/product candidates for Git for Windows PE binary [PR #5156 @westonsteimel] - javascript-package-cataloger creates phantom <name>@unknown packages for subpath or export-map stub package.json files [Issue #5118] - Syft generates incorrect PURLs for legacy JARs missing Maven metadata, causing Grype false negatives [Issue #4598] [PR #5146 @ankit090701] - When scanning an image, syft only reports one file per set of hardlinks, leading to wrong SPDX packageVerificationCode [Issue #5019] [PR #5029 @wagoodman] - Support deno binary latest and some old versions [Issue #5057] [PR #5084 @ychampion] - Update install methods in README.md [Issue #3198]
Dependencies 9 dependency changes (9 updated). 2 vulnerabilities remediated. 🟢 Remediated (2) - GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5 - GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5 Updated (9 packages) - github.com/diskfs/go-diskfs v1.9.3 → v1.9.4 - github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1 - github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j) - github.com/jedib0t/go-pretty/v6 v6.8.1 → v6.8.3 - github.com/klauspost/compress v1.19.0 → v1.19.1 - github.com/magiconair/properties v1.8.10 → v1.18.11 - github.com/ulikunitz/xz v0.5.15 → v0.5.16 - go.yaml.in/yaml/v3 v3.0.4 → v3.0.5 - modernc.org/sqlite v1.54.0 → v1.55.0 (Full Changelog)
Details
SHA-256
Does this still work for you?
Badge for your website
Developers can show that Syft is available on MirrorNest. Copy the code below: the badge links to this page and updates itself.
<a href="https://mirrornest.com/software/syft-b38689da"><img src="https://mirrornest.com/badge/syft-b38689da.svg" alt="Syft on MirrorNest" height="20"></a>[](https://mirrornest.com/software/syft-b38689da)Reviews
No reviews yet — be the first.
Syft alternatives
ShareX
ShareX is a free and open-source application that enables users to capture or record any area of their screen with a single keystroke. It also supports uploading images, text, and various file types to a wide range of destinations.
dotMemory Unit Standalone Launcher
Effective memory usage in .NET applications with dotMemory Unit
CPU-Z
System information software
cerebro-es (Install)
elasticsearch web admin tool
Vantage
Vantage
GamebarHandler
Gets rid of those pesky 'open ms-gamebar' and 'open ms-gamingoverlay' popups.