Commit Graph

  • 0cebb58eff
    fix(dotnet): bound PE resource parsing by what the file actually holds fix/dotnet-unbounded-alloc Alex Goodman 2026-08-18 17:47:34 -04:00
  • b927b7c664
    fix(dotnet): stop a truncated version resource from spinning forever Alex Goodman 2026-08-18 17:46:49 -04:00
  • 57f54350da
    fix(dotnet): bound the bundle signature search by the file, not the headers Alex Goodman 2026-08-18 17:45:51 -04:00
  • f20b0955b8
    fix(golang): report UPX binaries we cannot unpack as unknowns fix/upx-issue Alex Goodman 2026-08-18 15:29:05 -04:00
  • ffb691b0fe
    fix(golang): bound UPX decompression by what the input can justify Alex Goodman 2026-08-18 15:28:25 -04:00
  • 360dbc04aa
    chore(deps): update CPE dictionary index (#5189) main anchore-oss-update-bot 2026-08-18 11:44:00 -04:00
  • 58a033f924
    Prevent unnecessary allocations when parsing compressed ELF sections (#5187) Alex Goodman 2026-08-14 16:08:58 -04:00
  • 04a6fa1b41
    fix(unionreader): honor the io.ReaderAt contract in readerAtAdapter (#5186) Alex Goodman 2026-08-14 14:09:10 -04:00
  • 6f512803d2
    chore(lint): catch mholt/archives decompressors too fix/add-ruleguard-for-unguarded-allocations Alex Goodman 2026-08-14 10:28:20 -04:00
  • dcf051fbf1
    fix(arch): apply the mtree bounds while streaming fix/alpm-mtree-gzip-bomb Alex Goodman 2026-08-14 10:22:35 -04:00
  • c0d37d130a
    fix(arch): bound mtree entry count, not just decompressed bytes Alex Goodman 2026-08-14 10:03:38 -04:00
  • cd57b0704e
    chore(lint): add ruleguard rules for unguarded reads in binary parsers Alex Goodman 2026-08-14 09:53:52 -04:00
  • 084bc033f5
    fix(java): stop at the first format that parses a native image fix/graalvm-unbounded-alloc Alex Goodman 2026-08-13 15:07:46 -04:00
  • def9bc2e16
    fix(java): bound user-controlled reads in the graalvm native-image cataloger Alex Goodman 2026-08-13 15:07:05 -04:00
  • 26370e7afa
    chore(deps): bump github.com/gohugoio/hashstructure from 0.6.0 to 1.0.0 dependabot/go_modules/github.com/gohugoio/hashstructure-1.0.0 dependabot[bot] 2026-08-14 13:35:54 +00:00
  • d63c774fa9
    chore(deps): bump modernc.org/sqlite from 1.55.0 to 1.56.0 (#5183) dependabot[bot] 2026-08-14 13:34:28 +00:00
  • 3eee102f63
    chore(deps): bump github.com/google/go-containerregistry (#5184) dependabot[bot] 2026-08-14 13:34:24 +00:00
  • 20cc3df387
    chore(deps): bump zizmorcore/zizmor-action from 0.6.1 to 0.6.2 (#5181) dependabot[bot] 2026-08-14 13:33:58 +00:00
  • 4782a94029
    chore(deps): bump github.com/klauspost/compress from 1.19.1 to 1.19.2 (#5182) dependabot[bot] 2026-08-14 13:33:38 +00:00
  • b8381670d6
    fix(arch): bound the decompressed mtree listing Alex Goodman 2026-08-14 09:20:57 -04:00
  • 83dfbcc24a
    fix(binary): require gzip identity evidence in gzip classifier 5171-gzip-binary-classifier-fp Christopher Phillips 2026-08-13 13:35:48 -04:00
  • 2293641e3b
    fix: add correct CPE vendor/product candidates for Git for Windows PE binary (#5156) v1.51.0 Weston Steimel 2026-08-10 15:26:29 +01:00
  • 9dd9ce0bdd
    chore(deps): update CPE dictionary index (#5166) anchore-oss-update-bot 2026-08-10 10:24:51 -04:00
  • 949ac70369
    fix(java): map legacy Jackson 1.x (-asl) artifacts to org.codehaus.jackson (#5146) Ankit 2026-08-07 20:08:14 +05:30
  • 07fb23487f
    feat(golang): detect native Go FIPS 140 mode in binaries (#5155) Gunny Patel 2026-08-07 10:36:09 -04:00
  • f45586b457
    Remove Go Report Card badge from README (#5130) Timo 2026-08-07 16:31:27 +02:00
  • 0fe98ed1f2
    chore(deps): bump github.com/go-git/go-git/v5 from 5.19.1 to 5.19.2 (#5159) dependabot[bot] 2026-08-07 13:32:31 +00:00
  • 5f67883fe8
    chore(deps): bump go.yaml.in/yaml/v3 from 3.0.4 to 3.0.5 (#5158) dependabot[bot] 2026-08-07 13:31:31 +00:00
  • d288dd67ae
    chore(deps): bump docker/login-action from 4.5.1 to 4.6.0 (#5157) dependabot[bot] 2026-08-07 13:30:56 +00:00
  • da745b13e8
    feat(golang): add extended-stdlib scope and module patterns for symbol capture (#5154) Alex Goodman 2026-08-07 08:44:42 -04:00
  • 68da404bd7
    fix(make): don't let ambient RACE leak into raceEnabled test (#5152) Alex Goodman 2026-08-05 10:00:17 -04:00
  • 29d4816575
    feat: report the perl interpreter as a cpan package add-perl-capabilities/perl-interpreter-purl Alex Goodman 2026-08-04 11:01:06 -04:00
  • 1827ce2f4f
    feat: catalog CPAN distributions installed by perl clients add-perl-capabilities/cpan-cataloging Alex Goodman 2026-08-04 11:30:30 -04:00
  • 35bf33bcf0
    fix(make): explicit integration test timeout + single race switch (#5151) Alex Goodman 2026-08-04 10:46:35 -04:00
  • 7f73d6a603
    chore(deps): update CPE dictionary index (#5148) anchore-oss-update-bot 2026-08-03 13:20:36 -04:00
  • ef40eec38d
    chore(deps): bump github.com/klauspost/compress from 1.19.0 to 1.19.1 (#5140) dependabot[bot] 2026-07-31 13:50:21 +00:00
  • 80212d87c2
    chore(deps): bump github.com/go-git/go-billy/v5 from 5.9.0 to 5.9.1 (#5139) dependabot[bot] 2026-07-31 13:35:46 +00:00
  • b14123ecc1
    chore(deps): bump github.com/magiconair/properties (#5141) dependabot[bot] 2026-07-31 13:34:20 +00:00
  • e00aeb16e4
    chore(deps): bump github.com/ulikunitz/xz from 0.5.15 to 0.5.16 (#5142) dependabot[bot] 2026-07-31 13:32:58 +00:00
  • fa6f6d70f0
    chore(deps): bump modernc.org/sqlite from 1.54.0 to 1.55.0 (#5138) dependabot[bot] 2026-07-31 13:29:04 +00:00
  • 0975d80dc0
    chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.8.2 to 6.8.3 (#5137) dependabot[bot] 2026-07-31 13:28:49 +00:00
  • 4d823eaaa7
    chore(deps): bump github.com/diskfs/go-diskfs from 1.9.3 to 1.9.4 (#5136) dependabot[bot] 2026-07-31 13:27:56 +00:00
  • 138e42b428
    chore(deps): bump zizmorcore/zizmor-action from 0.6.0 to 0.6.1 (#5134) dependabot[bot] 2026-07-31 13:27:32 +00:00
  • ecd8fb7740
    chore(deps): bump docker/login-action from 4.4.0 to 4.5.1 (#5135) dependabot[bot] 2026-07-31 13:27:08 +00:00
  • dd639c09b2
    chore(deps): update tool versions (#5124) anchore-oss-update-bot 2026-07-30 06:59:36 -04:00
  • 31a352d030
    fix(snap): release temp directories on every snap failure path Christopher Angelo Phillips 2026-07-29 14:50:20 -04:00
  • 08e913a2ce
    Report each hardlink as its own file when scanning images (#5029) Alex Goodman 2026-07-29 13:50:43 -04:00
  • 5ef5b1badc
    chore(deps): bump anchore/workflows/.github/workflows/check-version-available.yaml (#5033) dependabot[bot] 2026-07-29 17:33:37 +00:00
  • b236f8c1f7
    chore(deps): bump github.com/jedib0t/go-pretty/v6 from 6.8.1 to 6.8.2 (#5051) dependabot[bot] 2026-07-29 17:30:07 +00:00
  • 476ce60768
    fix(binary): detect Deno 1.11 and 2.9 versions Yashas Gunderia 2026-07-29 22:03:46 +05:30
  • 16223e6dd7
    fix: consider vendored golang packages in module attribution (#5093) v1.50.0 Keith Zantow 2026-07-27 15:20:49 -04:00
  • 1286689419
    Fix missing nested packages in package-lock.json v1 (#5108) Eljees 2026-07-27 22:18:48 +03:00
  • 295454945c
    fix: strip publisher URL from RPM CPE vendor (#5081) Eljees 2026-07-27 22:18:27 +03:00
  • 86baeeb481
    fix(rust): omit Cargo PURLs for local packages (#5105) Enes Deniz 2026-07-27 17:50:13 +03:00
  • 2dcf5163b8
    fix(apk): allow large installed db fields (#5100) Rayan Salhab 2026-07-27 17:36:56 +03:00
  • 12b8ba47fb
    Fix inverted bounds check dropping every Erlang string with a backslash (#5110) Arpit Jain 2026-07-27 23:22:41 +09:00
  • 138d9ce2a0
    added bun binary classifier (#5103) Rez Moss 2026-07-27 10:18:50 -04:00
  • 8a229b16c4
    chore(deps): update CPE dictionary index (#5109) anchore-oss-update-bot 2026-07-27 10:04:27 -04:00
  • 9af0098a68
    chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 (#5099) dependabot[bot] 2026-07-24 13:48:24 +00:00
  • 2840ea6653
    chore(deps): bump modernc.org/sqlite from 1.53.0 to 1.54.0 (#5098) dependabot[bot] 2026-07-24 13:29:49 +00:00
  • b38e40e3e6
    chore(deps): bump zizmorcore/zizmor-action from 0.5.7 to 0.6.0 (#5096) dependabot[bot] 2026-07-24 13:29:21 +00:00
  • a6eedecd31
    chore(deps): bump github.com/gpustack/gguf-parser-go (#5097) dependabot[bot] 2026-07-24 13:29:04 +00:00
  • 691b1357b2
    chore(deps): bump actions/checkout from 7.0.0 to 7.0.1 (#5095) dependabot[bot] 2026-07-24 13:27:48 +00:00
  • c890e7f17f
    decode golang symbols (#5089) Alex Goodman 2026-07-23 15:03:36 -04:00
  • 29fd7d0dec
    chore(deps): update anchore dependencies (#5022) v1.49.0 anchore-oss-update-bot 2026-07-20 14:04:57 -04:00
  • 289137ff3c
    Avoid duplicate packages for replaced Go modules (#5069) Yashas Gunderia 2026-07-20 22:00:56 +05:30
  • 22ffd5209d
    chore(deps): bump github.com/gkampitakis/go-snaps from 0.5.22 to 0.5.23 (#5079) dependabot[bot] 2026-07-20 15:28:53 +00:00
  • a0852ebf98
    Add multi-platform OCI image support (#5074) Jason Paulos 2026-07-20 11:28:29 -04:00
  • d380ad08b5
    chore(deps): update CPE dictionary index (#5082) anchore-oss-update-bot 2026-07-20 11:21:24 -04:00
  • ae9534203d
    chore(deps): bump golang.org/x/mod from 0.37.0 to 0.38.0 (#5078) dependabot[bot] 2026-07-17 13:52:25 +00:00
  • dc1ef98237
    chore(deps): bump golang.org/x/tools from 0.47.0 to 0.48.0 (#5077) dependabot[bot] 2026-07-17 13:52:22 +00:00
  • 36a3af41d9
    chore(deps): bump golang.org/x/net from 0.56.0 to 0.57.0 (#5076) dependabot[bot] 2026-07-17 13:32:07 +00:00
  • 3e2bc6ed09
    ci: add docker-container driver (#5071) v1.48.0 Christopher Angelo Phillips 2026-07-16 10:21:22 -04:00
  • 5e11775c8b
    feat: detect unpackaged Firefox in software inventories (#5068) v1.47.0 Yashas Gunderia 2026-07-16 07:39:58 +05:30
  • 8ed534c32b
    fix: NPM redis.js CPE (#5012) Rez Moss 2026-07-15 20:55:42 -04:00
  • aff2c247db
    feat: add safe tensor model type to SBOM output (#4844) Christopher Angelo Phillips 2026-07-15 17:14:03 -04:00
  • ed499fd2d0
    chore: migrate .goreleaser config to use docker_v2 (#4608) Christopher Angelo Phillips 2026-07-15 16:52:46 -04:00
  • ad828d659f
    fix: conan libxml2 CPE (#5016) Rez Moss 2026-07-15 15:29:03 -04:00
  • 2805655ab0
    feat(cmd): log total scan duration at info level (#4858) ChrisJr404 2026-07-14 08:49:53 -04:00
  • 552ddbfadb
    fix: map NuGet PURLs to dotnet package type (#4861) Monibee-Fudgekins 2026-07-13 16:43:34 -04:00
  • f6b5d3e736
    perf: group golang symbols by package path to reduce the sbom size (#5064) Christopher Angelo Phillips 2026-07-13 16:40:16 -04:00
  • 4312699dd6
    cyclonedx: import firmware-typed components as packages (#4855) ChrisJr404 2026-07-13 15:33:51 -04:00
  • fabd760914
    fix: correct Spring LDAP group ID in purl generation (#4908) Jonas Boos 2026-07-13 21:31:35 +02:00
  • e854078fb0
    fix: use printf instead of echo to fix ANSI color output (#4978) M_C_J 2026-07-13 20:29:30 +01:00
  • 987ae7f26a
    fix: PE case-insensitive extensions (Win32/ISO 9660 compatibility) (#4996) Mike Zolotarov 2026-07-13 21:25:31 +02:00
  • 76ede661db
    fix: allow more PEP440-compliant characters in python versions (#4964) Keith Zantow 2026-07-13 15:10:12 -04:00
  • da77ea388a
    docs: fix stale commands in binary cataloger README (#5047) Ali Asghar 2026-07-13 20:15:01 +05:00
  • 3cc3ecb003
    Fix panic on cabal.project.freeze 'installed' boot-lib constraints (#5040) Synvoya 2026-07-14 00:57:32 +10:00
  • 7745e450fa
    fix panic parsing a rockspec comment that ends at EOF (#5053) Arpit Jain 2026-07-13 23:45:12 +09:00
  • bd0917fe93
    fix(javascript): strip peer-dep suffix from deno.lock npm keys (#5055) Synvoya 2026-07-14 00:38:32 +10:00
  • 1dcac54b0e
    feat: optionally capture golang binary symbols (#4988) Christopher Angelo Phillips 2026-07-13 10:30:23 -04:00
  • 3252b6f806
    chore(deps): update CPE dictionary index (#5063) anchore-oss-update-bot 2026-07-13 10:07:00 -04:00
  • c4a0b6f647
    chore(deps): bump github.com/klauspost/compress from 1.18.6 to 1.19.0 (#5050) dependabot[bot] 2026-07-10 13:31:42 +00:00
  • 5b630ec61c
    chore(deps): bump docker/login-action from 4.2.0 to 4.4.0 (#5049) dependabot[bot] 2026-07-10 13:29:34 +00:00
  • e8abab2e77
    swift: emit canonical purls without .git suffix or repeated name (#4785) Sai Asish Y 2026-07-08 09:55:13 -07:00
  • 002a326c41
    detect Ubuntu Pro/ESM extended support (#5028) Alex Goodman 2026-07-07 10:11:15 -04:00
  • 3e399256b3
    fix(debian): supplement point release from /etc/debian_version (#4997) OsamaSE 2026-07-06 19:18:37 +04:00
  • ebac92a86e
    fix: conanfile comments in [requires] no longer stop dependency detection (#5020) Marcus 2026-07-06 15:17:42 +00:00
  • aebdf4bff4
    Fix mix.lock git/path deps mislabeled as hex.pm with bogus PURL (#5041) Synvoya 2026-07-07 01:13:20 +10:00
  • f1457f2554
    pin php apache fixture to debian snapshot (#5043) Alex Goodman 2026-07-06 11:01:44 -04:00