This is the multi-page printable view of this section. Click here to print.

Return to the regular view of this page.

Capabilities

Summary of package analysis and vulnerability scanning capabilities across ecosystems

Capabilities describe the cross-cutting features available across Anchore’s tools:

  • Package analysis: What Syft can catalog from package manifests, lock files, and installed packages
  • Vulnerability scanning: What Grype can detect using vulnerability databases and matching rules

These capabilities are ecosystem-specific. For example, Python’s capabilities differ from Go’s, and Ubuntu’s capabilities differ from Alpine’s.

Default capabilities do not require to be online or have special configuration (other than having a vulnerability DB downloaded). Some capabilities may be conditionally supported, requiring additional configuration or online access to function.

Vulnerability scanning capabilities

Operating system support

Syft and Grype support several operating systems for package cataloging and vulnerability detection. The table below shows which OS versions are supported and where Grype’s vulnerability data comes from.

Operating System Supported Versions Vunnel Provider Data Source
Alpine Linux 3.2+, edge alpine Alpine SecDB
Amazon Linux 2, 2022, 2023 amazon Amazon Linux Security Center
Azure Linux 3.0 mariner Microsoft CBL-Mariner OVAL
CentOS 5, 6, 7, 8 rhel Red Hat Security Data API
Chainguard OS rolling chainguard Chainguard Security
Debian 7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstable debian Debian Security Tracker
Echo OS rolling echo ECHO Security
CBL-Mariner 1.0, 2.0 mariner Microsoft CBL-Mariner OVAL
MinimOS rolling minimos MINIMOS Security
Oracle Linux 5, 6, 7, 8, 9, 10 oracle Oracle Linux Security
Raspberry Pi OS 7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstable debian Debian Security Tracker
Red Hat Enterprise Linux 5, 6, 7, 8, 9, 10
EUS: 5.9, 6.4+, 7, 8.1, 8.2, 8.4, 8.6, 8.8, 9		 rhel Red Hat Security Data API
Rocky Linux 5, 6, 7, 8, 9, 10 rhel Red Hat Security Data API
SUSE Linux Enterprise Server 11, 12, 15 sles SUSE Security OVAL
Ubuntu 12.04 (precise), 12.10 (quantal), 13.04 (raring), 14.04 (trusty), 14.10 (utopic), 15.04 (vivid), 15.10 (wily), 16.04 (xenial), 16.10 (yakkety), 17.04 (zesty), 17.10 (artful), 18.04 (bionic), 18.10 (cosmic), 19.04 (disco), 19.10 (eoan), 20.04 (focal), 20.10 (groovy), 21.04 (hirsute), 21.10 (impish), 22.04 (jammy), 22.10 (kinetic), 23.04 (lunar), 23.10 (mantic), 24.04 (noble), 24.10 (oracular), 25.04 (plucky), 25.10 ubuntu Ubuntu CVE Tracker
Wolfi rolling wolfi Wolfi Security

Data sources

Vulnerability data sources vary in the information they provide. Grype uses these capabilities when available to provide more accurate and comprehensive vulnerability detection:

  • Independent Disclosure: Whether the advisory discloses the vulnerability regardless of fix availability. Sources with this capability report vulnerabilities even when no fix is available yet.

  • Disclosure Date: Whether the data source provides the date when a vulnerability was first publicly disclosed. This helps you understand the timeline of vulnerability exposure.

  • Fix Versions: Whether the data source specifies which package versions contain fixes for a vulnerability. This allows Grype to determine if an installed package version is vulnerable or fixed.

  • Fix Date: Whether the advisory includes a date when the fix was made available. This helps you understand the timeline of vulnerability remediation.

Package analysis capabilities

The table below shows which ecosystems support package analysis and vulnerability scanning.

Ecosystem Cataloger + Evidence Licenses Dependencies Files
ALPM
alpm-db-cataloger
var/lib/pacman/local/**/desc
APK
apk-db-cataloger
lib/apk/db/installed
Binary
binary-classifier-cataloger
arangodb-binaryarangosh bash-binarybash busybox-binarybusybox chrome-binarychrome consul-binaryconsul curl-binarycurl dart-binarydart erlang-alpine-binarybeam.smp erlang-binaryerlexec erlang-libraryliberts_internal.a ffmpeg-binaryffmpeg ffmpeg-librarylibav*, libswresample* fluent-bit-binaryfluent-bit gcc-binarygcc go-binarygo go-binary-hintVERSION* gzip-binarygzip haproxy-binaryhaproxy hashicorp-vault-binaryvault haskell-cabal-binarycabal haskell-ghc-binaryghc* haskell-stack-binarystack helmhelm httpd-binaryhttpd java-binaryjava java-jdb-binaryjdb jq-binaryjq julia-binarylibjulia-internal.so lighttpd-binarylighttpd mariadb-binary{mariadb,mysql} memcached-binarymemcached mysql-binarymysql nginx-binarynginx nodejs-binarynode openssl-binaryopenssl perl-binaryperl php-composer-binarycomposer* postgresql-binarypostgres proftpd-binaryproftpd pypy-binary-liblibpypy*.so* python-binarypython* python-binary-liblibpython*.so* redis-binaryredis-server ruby-binaryruby rust-standard-library-linuxlibstd-????????????????.so rust-standard-library-macoslibstd-????????????????.dylib sqlcipher-binarysqlcipher swipl-binaryswipl traefik-binarytraefik util-linux-binarygetopt wordpress-cli-binarywp xtrabackup-binaryxtrabackup xz-binaryxz zstd-binaryzstd
elf-binary-package-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
pe-binary-package-cataloger
*.dll, *.exe
Bitnami
bitnami-cataloger
/opt/bitnami/**/.spdx-*.spdx
C/C++
conan-cataloger
conan.lock
conan-cataloger
conanfile.txt
conan-info-cataloger
conaninfo.txt
Conda
conda-meta-cataloger
conda-meta/*.json
Dart
dart-pubspec-cataloger
pubspec.yml, pubspec.yaml
dart-pubspec-lock-cataloger
pubspec.lock
DPKG
deb-archive-cataloger
*.deb
dpkg-db-cataloger
lib/dpkg/status, lib/dpkg/status.d/*, lib/opkg/info/*.control, lib/opkg/status
Elixir
elixir-mix-lock-cataloger
mix.lock
Erlang
erlang-otp-application-cataloger
*.app
erlang-rebar-lock-cataloger
rebar.lock
GitHub Actions
github-action-workflow-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml
github-actions-usage-cataloger
.github/actions/*/action.yml, .github/actions/*/action.yaml
github-actions-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml
Go
go-module-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
go-module-file-cataloger
go.mod
Haskell
haskell-cataloger
cabal.project.freeze
haskell-cataloger
stack.yaml.lock
haskell-cataloger
stack.yaml
Homebrew
homebrew-cataloger
Cellar/*/*/.brew/*.rb, Library/Taps/*/*/Formula/*.rb
Java
graalvm-native-image-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
java-archive-cataloger
*.jar, *.war, *.ear, *.par, *.sar, *.nar, *.jpi, *.hpi, *.kar, *.lpkg
java-archive-cataloger
*.zip
java-archive-cataloger
*.tar, *.tar.gz, *.tgz, *.tar.bz, *.tar.bz2, *.tbz, *.tbz2, *.tar.br, *.tbr, *.tar.lz4, *.tlz4, *.tar.sz, *.tsz, *.tar.xz, *.txz, *.tar.zst, *.tzst, *.tar.zstd, *.tzstd
java-gradle-lockfile-cataloger
gradle.lockfile*
java-jvm-cataloger
release
java-pom-cataloger
*pom.xml
JavaScript
javascript-lock-cataloger
pnpm-lock.yaml
javascript-lock-cataloger
yarn.lock
javascript-lock-cataloger
package-lock.json
javascript-package-cataloger
package.json
Linux
linux-kernel-cataloger
kernel, kernel-*, vmlinux, vmlinux-*, vmlinuz, vmlinuz-*, lib/modules/**/*.ko
Lua
lua-rock-cataloger
*.rockspec
.NET
dotnet-deps-binary-cataloger
*.deps.json, *.dll, *.exe
dotnet-deps-cataloger
*.deps.json
dotnet-packages-lock-cataloger
packages.lock.json
dotnet-portable-executable-cataloger
*.dll, *.exe
Nix
nix-cataloger
nix/var/nix/db/db.sqlite, nix/store/*, nix/store/*.drv
nix-store-cataloger
nix/store/*, nix/store/*.drv
OCaml
opam-cataloger
*opam
PHP
php-composer-installed-cataloger
installed.json
php-composer-lock-cataloger
composer.lock
php-interpreter-cataloger
php*/**/*.so, php-fpm*, apache*/**/libphp*.so
php-pear-serialized-cataloger
php/.registry/**/*.reg
php-pecl-serialized-cataloger
php/.registry/.channel.*/*.reg
Portage
portage-cataloger
var/db/pkg/*/*/CONTENTS
Prolog
swipl-pack-cataloger
pack.pl
Python
python-installed-package-cataloger
*.egg-info, *dist-info/METADATA, *egg-info/PKG-INFO, *DIST-INFO/METADATA, *EGG-INFO/PKG-INFO
python-package-cataloger
uv.lock
python-package-cataloger
setup.py
python-package-cataloger
Pipfile.lock
python-package-cataloger
poetry.lock
python-package-cataloger
*requirements*.txt
R
r-package-cataloger
DESCRIPTION
RPM
rpm-archive-cataloger
*.rpm
rpm-db-cataloger
var/lib/rpmmanifest/container-manifest-2
rpm-db-cataloger
{var/lib,usr/share,usr/lib/sysimage}/rpm/{Packages,Packages.db,rpmdb.sqlite}
Ruby
ruby-gemfile-cataloger
Gemfile.lock
ruby-gemspec-cataloger
*.gemspec
ruby-installed-gemspec-cataloger
specifications/**/*.gemspec
Rust
cargo-auditable-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
rust-cargo-lock-cataloger
Cargo.lock
SBOM
sbom-cataloger
*.syft.json, *.bom.*, *.bom, bom, *.sbom.*, *.sbom, sbom, *.cdx.*, *.cdx, *.spdx.*, *.spdx
Snap
snap-cataloger
snap/snapcraft.yaml
snap-cataloger
snap/manifest.yaml
snap-cataloger
doc/linux-modules-*/changelog.Debian.gz
snap-cataloger
usr/share/snappy/dpkg.yaml
snap-cataloger
meta/snap.yaml
Swift
cocoapods-cataloger
Podfile.lock
swift-package-manager-cataloger
Package.resolved, .package.resolved
Terraform
terraform-lock-cataloger
.terraform.lock.hcl
WordPress
wordpress-plugins-cataloger
wp-content/plugins/*/*.php

Legend

  • : Supported by default
  • : Conditionally supported (requires configuration)
  • (empty) : Not supported

Dependencies

We describe Syft’s ability to capture dependency information in the following dimentions:

  • Depth: How far into the true dependency graph we are able to discover package nodes.

    • direct: only captures dependencies explicitly declared by the project, but not necessarily dependencies of those dependencies

    • transitive: all possible depths of dependencies are captured

  • Edges: Whether we are able to capture relationships between packages, and if so, describe the topology of those relationships.

    • flat: we can capture the root package relative to all other dependencies, but are unaware of relationships between dependencies (a simple star topology, where all dependencies point to the root package)

    • complete: all possible relationships between packages are captured (the full dependency graph)

  • Kinds: The types of dependencies we are able to capture.

    • runtime: dependencies required for the package to function at runtime

    • dev: dependencies required for development

Licenses

Indicates whether Syft can detect and catalog license information from package metadata. When supported, Syft extracts license declarations from package manifests, metadata files, or installed package databases.

Package manager features

Syft can extract various package manager metadata beyond basic package information:

  • Files: Whether Syft can catalog the list of files that are part of a package installation. This provides visibility into all files installed by the package manager.

  • Digests: Whether Syft can capture file checksums (digests/hashes) for individual files within a package. This enables integrity verification of installed files. Note: this is not necessarily the actual hash of the file, but instead the claims made by the package manager about those files. We capture actual file hashes in the files section of the SBOM.

  • Integrity Hash: Whether Syft can capture a single package-level integrity hash used by package managers to verify the package archive itself (for example, the https://go.dev/ref/mod#go-sum-files for go packages).

Next steps

1 - ALPM

ALPM package format used by Arch-based Linux distributions

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
alpm-db-cataloger
var/lib/pacman/local/**/desc
 transitive complete runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)

Operating systems

Operating System Supported Versions Provider Data Source
Arch Linux minimal support (CPE-based) nvd National Vulnerability Database (NVD)

Contributing

Interested in contributing vulnerability scanning support?

Feel free to add a new vunnel provider for Arch-based distributions. See the existing issue in the Vunnel repository.

Next steps

2 - APK

APK package format analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
apk-db-cataloger
lib/apk/db/installed
 direct complete runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
Alpine SecDB
National Vulnerability Database (NVD)
Chainguard Security
MINIMOS Security
Wolfi Security

Operating systems

Operating System Supported Versions Provider Data Source
Alpine Linux 3.2+, edge alpine Alpine SecDB
Chainguard OS rolling chainguard Chainguard Security
MinimOS rolling minimos MINIMOS Security
Wolfi rolling wolfi Wolfi Security

The APK vulnerability database (a.k.a. “SecDB”) includes data from the Alpine Security Tracker, which provides detailed information on vulnerabilities affecting Alpine Linux packages. This database only includes vulnerabilities that have fixes available and does not track unfixed vulnerabilities. The maintainers of the SecDB intend for the primary source of truth for disclosures to be the National Vulnerability Database (NVD).

This is true of other APK vulnerability data sources as well (such as Chainguard, Wolfi, and MinimOS).

Next steps

3 - Binary

Binary package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
binary-classifier-cataloger
arangodb-binaryarangosh bash-binarybash busybox-binarybusybox chrome-binarychrome consul-binaryconsul curl-binarycurl dart-binarydart erlang-alpine-binarybeam.smp erlang-binaryerlexec erlang-libraryliberts_internal.a ffmpeg-binaryffmpeg ffmpeg-librarylibav*, libswresample* fluent-bit-binaryfluent-bit gcc-binarygcc go-binarygo go-binary-hintVERSION* gzip-binarygzip haproxy-binaryhaproxy hashicorp-vault-binaryvault haskell-cabal-binarycabal haskell-ghc-binaryghc* haskell-stack-binarystack helmhelm httpd-binaryhttpd java-binaryjava java-jdb-binaryjdb jq-binaryjq julia-binarylibjulia-internal.so lighttpd-binarylighttpd mariadb-binary{mariadb,mysql} memcached-binarymemcached mysql-binarymysql nginx-binarynginx nodejs-binarynode openssl-binaryopenssl perl-binaryperl php-composer-binarycomposer* postgresql-binarypostgres proftpd-binaryproftpd pypy-binary-liblibpypy*.so* python-binarypython* python-binary-liblibpython*.so* redis-binaryredis-server ruby-binaryruby rust-standard-library-linuxlibstd-????????????????.so rust-standard-library-macoslibstd-????????????????.dylib sqlcipher-binarysqlcipher swipl-binaryswipl traefik-binarytraefik util-linux-binarygetopt wordpress-cli-binarywp xtrabackup-binaryxtrabackup xz-binaryxz zstd-binaryzstd
elf-binary-package-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
pe-binary-package-cataloger
*.dll, *.exe

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

4 - Bitnami

Bitnami package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
bitnami-cataloger
/opt/bitnami/**/.spdx-*.spdx
 transitive complete runtime

Next steps

5 - Conda

Conda package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
conda-meta-cataloger
conda-meta/*.json
 direct runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

6 - C/C++

C/C++ package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
conan-cataloger
conan.lock
 transitive runtime, build
conan-cataloger
conanfile.txt
 direct runtime
conan-info-cataloger
conaninfo.txt
 direct flat runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

7 - Dart

Dart package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
dart-pubspec-cataloger
pubspec.yml, pubspec.yaml
 direct runtime
dart-pubspec-lock-cataloger
pubspec.lock
 transitive runtime, dev

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

8 - DPKG

Debian package format used by Debian-based Linux distributions

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
deb-archive-cataloger
*.deb
dpkg-db-cataloger
lib/dpkg/status, lib/dpkg/status.d/*, lib/opkg/info/*.control, lib/opkg/status
 transitive complete runtime

Notable capabilities:

  • OPKG compatibility: Syft supports OpenWrt’s OPKG package manager format using the same cataloger.
  • Distroless images: Syft automatically detects and supports Google distroless images that use /var/lib/dpkg/status.d/.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
Debian Security Tracker (DSA, DLA)
ECHO Security
Ubuntu CVE Tracker (USN)

Operating systems

Operating System Supported Versions Provider Data Source
Debian 7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstable debian Debian Security Tracker
Echo OS rolling echo ECHO Security
Raspberry Pi OS 7 (wheezy), 8 (jessie), 9 (stretch), 10 (buster), 11 (bullseye), 12 (bookworm), 13 (trixie), 14, unstable debian Debian Security Tracker
Ubuntu 12.04 (precise), 12.10 (quantal), 13.04 (raring), 14.04 (trusty), 14.10 (utopic), 15.04 (vivid), 15.10 (wily), 16.04 (xenial), 16.10 (yakkety), 17.04 (zesty), 17.10 (artful), 18.04 (bionic), 18.10 (cosmic), 19.04 (disco), 19.10 (eoan), 20.04 (focal), 20.10 (groovy), 21.04 (hirsute), 21.10 (impish), 22.04 (jammy), 22.10 (kinetic), 23.04 (lunar), 23.10 (mantic), 24.04 (noble), 24.10 (oracular), 25.04 (plucky), 25.10 ubuntu Ubuntu CVE Tracker

Next steps

9 - .NET

.NET package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
dotnet-deps-binary-cataloger
*.deps.json, *.dll, *.exe
 transitive complete runtime
dotnet-deps-cataloger
*.deps.json
 transitive complete runtime
dotnet-packages-lock-cataloger
packages.lock.json
 transitive complete runtime, dev, build
dotnet-portable-executable-cataloger
*.dll, *.exe
Syft Configuration
Configuration Key Description
dotnet.dep-packages-must-claim-dll Allows for deps.json packages to be included only if there is a runtime/resource DLL claimed in the deps.json targets section. This does not require such claimed DLLs to exist on disk. The behavior of this
dotnet.dep-packages-must-have-dll Allows for deps.json packages to be included only if there is a DLL on disk for that package.
dotnet.propagate-dll-claims-to-parents Allows for deps.json packages to be included if any child (transitive) package claims a DLL. This applies to both the claims configuration and evidence-on-disk configurations.
dotnet.relax-dll-claims-when-bundling-detected Will look for indications of IL bundle tooling via deps.json package names and, if found (and this config option is enabled), will relax the DepPackagesMustClaimDLL value to `false` only in those cases.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.dotnet.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

10 - Elixir

Elixir package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
elixir-mix-lock-cataloger
mix.lock
 transitive runtime, dev

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

11 - Erlang

Erlang package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
erlang-otp-application-cataloger
*.app
 direct runtime, dev
erlang-rebar-lock-cataloger
rebar.lock
 direct runtime, dev

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

12 - GitHub Actions

GitHub Actions package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
github-action-workflow-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml
github-actions-usage-cataloger
.github/actions/*/action.yml, .github/actions/*/action.yaml
github-actions-usage-cataloger
.github/workflows/*.yaml, .github/workflows/*.yml

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)

Next steps

13 - Go

Go package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
go-module-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
 transitive flat runtime, dev
go-module-file-cataloger
go.mod
 transitive flat runtime, dev
Syft Configuration
Configuration Key Description
golang.local-mod-cache-dir Specifies the location of the local go module cache directory. When not set, syft will attempt to discover the GOPATH env or default to $HOME/go.
golang.local-vendor-dir Specifies the location of the local vendor directory. When not set, syft will search for a vendor directory relative to the go.mod file.
golang.no-proxy Is a list of glob patterns that match go module names that should not be fetched from the go proxy. When not set, syft will use the GOPRIVATE and GONOPROXY env vars.
golang.proxy Is a list of go module proxies to use when fetching go module metadata and licenses. When not set, syft will use the GOPROXY env or default to https://proxy.golang.org,direct.
golang.search-local-mod-cache-licenses Enables searching for go package licenses in the local GOPATH mod cache.
golang.search-local-vendor-licenses Enables searching for go package licenses in the local vendor directory relative to the go.mod file.
golang.search-remote-licenses Enables downloading go package licenses from the upstream go proxy (typically proxy.golang.org).

Version detection for binaries

When Syft scans a Go binary, the main module often has version (devel) because Go doesn’t embed version information by default. Syft attempts to detect the actual version using three strategies (configurable via golang.main-module-version.*):

  1. From ldflags (enabled by default): Looks for version strings passed during build like -ldflags="-X main.version=v1.2.3". Supports common patterns: *.version=, *.gitTag=, *.release=, etc.

  2. From build settings (enabled by default): Uses VCS metadata (commit hash and timestamp) embedded by Go 1.18+ to generate a pseudo-version like v0.0.0-20230101120000-abcdef123456.

  3. From contents (disabled by default): Scans binary contents for version string patterns. Can produce false positives.

Best practice: Use -ldflags when building to embed your version explicitly.

Example:

go build -ldflags="-X main.version=v1.2.3"

This ensures Syft (and Grype) can accurately identify your application version for vulnerability matching.

Standard library

Syft automatically creates a stdlib package for each Go binary, representing the Go standard library version used to compile it. The version is extracted from the binary’s build metadata (e.g., go1.22.2). This enables Grype to check for vulnerabilities reported against the go standard library.

Why this matters: Vulnerabilities in the Go compiler (like CVEs affecting the crypto library or net/http) can affect your application even if your code doesn’t directly use those packages.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.golang.using-cpes Use CPE package identifiers to find vulnerabilities
match.golang.always-use-cpe-for-stdlib use CPE matching to find vulnerabilities for the Go standard library
match.golang.allow-main-module-pseudo-version-comparison allow comparison between main module pseudo-versions (e.g. v0.0.0-20240413-2b432cf643...)

Main module filtering

Grype skips vulnerability matching for packages that match all these conditions:

  • Package name equals the main module name (from the SBOM metadata)
  • Package version is unreliable:
    • When allow-main-module-pseudo-version-comparison is false (default): version starts with v0.0.0- or is (devel)
    • When allow-main-module-pseudo-version-comparison is true: version is (devel) only

This filtering exists because Go doesn’t have a standard way to embed the main module’s version into compiled binaries (see golang/go#50603). Pseudo-versions in compiled binaries are often unreliable for vulnerability matching.

You can disable this filtering with the allow-main-module-pseudo-version-comparison configuration option.

Troubleshooting

No vulnerabilities found for main module

Cause: The main module has a pseudo-version (v0.0.0-*) or (devel), which Grype filters by default.

Solution: Enable pseudo-version matching in your Grype configuration:

match:
  golang:
    allow-main-module-pseudo-version-comparison: true

No vulnerabilities found for stdlib

Possible causes:

  • Missing CPEs: Verify Syft generates CPEs with generate-cpes: true in .syft.yaml
  • CPE matching disabled: Ensure always-use-cpe-for-stdlib: true in Grype config (default)
  • Incorrect version format: Stdlib version should be go1.18.3, not v1.18.3 (file a Syft bug if incorrect)

Next steps

14 - Haskell

Haskell package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
haskell-cataloger
cabal.project.freeze
 transitive runtime, dev
haskell-cataloger
stack.yaml.lock
 transitive runtime, dev
haskell-cataloger
stack.yaml
 direct runtime, dev

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

15 - Homebrew

Homebrew package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
homebrew-cataloger
Cellar/*/*/.brew/*.rb, Library/Taps/*/*/Formula/*.rb

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

16 - Java

Java package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
graalvm-native-image-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable (mimetype)
 transitive complete runtime, dev
java-archive-cataloger
*.jar, *.war, *.ear, *.par, *.sar, *.nar, *.jpi, *.hpi, *.kar, *.lpkg
 transitive complete runtime, dev
java-archive-cataloger
*.zip
 transitive complete runtime, dev
java-archive-cataloger
*.tar, *.tar.gz, *.tgz, *.tar.bz, *.tar.bz2, *.tbz, *.tbz2, *.tar.br, *.tbr, *.tar.lz4, *.tlz4, *.tar.sz, *.tsz, *.tar.xz, *.txz, *.tar.zst, *.tzst, *.tar.zstd, *.tzstd
 transitive complete runtime, dev
java-gradle-lockfile-cataloger
gradle.lockfile*
 transitive runtime, dev
java-jvm-cataloger
release
 transitive runtime, dev
java-pom-cataloger
*pom.xml
 direct complete runtime, dev
Syft Configuration
Configuration Key Description
java.maven-local-repository-dir Specifies the location of the local maven repository. When not set, defaults to ~/.m2/repository.
java.maven-url Specifies the base URL(s) to use for fetching POMs and metadata from maven central or other repositories. When not set, defaults to https://repo1.maven.org/maven2.
java.max-parent-recursive-depth Limits how many parent POMs will be fetched recursively before stopping. This prevents infinite loops or excessively deep parent chains.
java.resolve-transitive-dependencies Enables resolving transitive dependencies for java packages found within archives.
java.use-maven-local-repository Enables searching the local maven repository (~/.m2/repository by default) for parent POMs and other metadata.
java.use-network Enables network operations for java package metadata enrichment, such as fetching parent POMs and license information.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.java.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

17 - JavaScript

JavaScript package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
javascript-lock-cataloger
pnpm-lock.yaml
 transitive runtime
javascript-lock-cataloger
yarn.lock
 transitive runtime, dev
javascript-lock-cataloger
package-lock.json
 transitive runtime
javascript-package-cataloger
package.json
 direct runtime
Syft Configuration
Configuration Key Description
javascript.include-dev-dependencies Controls whether development dependencies should be included in the catalog results, in addition to production dependencies.
javascript.npm-base-url Specifies the base URL for the NPM registry API used when searching for remote license information.
javascript.search-remote-licenses Enables querying the NPM registry API to retrieve license information for packages that are missing license data in their local metadata.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.javascript.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

18 - Linux Kernel

Linux kernel archive and module analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
linux-kernel-cataloger
kernel, kernel-*, vmlinux, vmlinux-*, vmlinuz, vmlinuz-*, lib/modules/**/*.ko
Syft Configuration
Configuration Key Description
linux-kernel.catalog-modules Enables cataloging linux kernel modules (*.ko files) in addition to the kernel itself.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

19 - Lua

Lua package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
lua-rock-cataloger
*.rockspec
 direct runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

20 - Nix

Nix package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
nix-cataloger
nix/var/nix/db/db.sqlite, nix/store/*, nix/store/*.drv
 transitive complete runtime
nix-store-cataloger
nix/store/*, nix/store/*.drv
 transitive complete runtime
Syft Configuration
Configuration Key Description
nix.capture-owned-files Determines whether to record the list of files owned by each Nix package discovered in the store. Recording owned files provides more detailed information but increases processing time and memory usage.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

21 - OCaml

OCaml package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
opam-cataloger
*opam
 direct runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

22 - PHP

PHP package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
php-composer-installed-cataloger
installed.json
 transitive runtime, dev
php-composer-lock-cataloger
composer.lock
 transitive runtime
php-interpreter-cataloger
php*/**/*.so, php-fpm*, apache*/**/libphp*.so
 direct flat runtime
php-pear-serialized-cataloger
php/.registry/**/*.reg
 direct runtime
php-pecl-serialized-cataloger
php/.registry/.channel.*/*.reg
 direct runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

23 - Portage

Debian package format used by Debian-based Linux distributions

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
portage-cataloger
var/db/pkg/*/*/CONTENTS
 direct runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)

Operating systems

Operating System Supported Versions Provider Data Source
Gentoo Linux minimal support (CPE-based) nvd National Vulnerability Database (NVD)

Next steps

24 - Prolog

Prolog package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
swipl-pack-cataloger
pack.pl
 direct runtime, dev

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

25 - Python

Python package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
python-installed-package-cataloger
*.egg-info, *dist-info/METADATA, *egg-info/PKG-INFO, *DIST-INFO/METADATA, *EGG-INFO/PKG-INFO
 direct complete runtime
python-package-cataloger
uv.lock
 transitive complete dev, optional
python-package-cataloger
setup.py
 direct
python-package-cataloger
Pipfile.lock
 transitive runtime
python-package-cataloger
poetry.lock
 transitive complete dev, optional
python-package-cataloger
*requirements*.txt
Syft Configuration
Configuration Key Description
python.guess-unpinned-requirements Attempts to infer package versions from version constraints when no explicit version is specified in requirements files.

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.python.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

26 - R

R package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
r-package-cataloger
DESCRIPTION

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

27 - RPM

Red Hat Package Manager format used by Red Hat-based Linux distributions

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
rpm-archive-cataloger
*.rpm
 direct complete runtime
rpm-db-cataloger
var/lib/rpmmanifest/container-manifest-2
 transitive runtime
rpm-db-cataloger
{var/lib,usr/share,usr/lib/sysimage}/rpm/{Packages,Packages.db,rpmdb.sqlite}
 transitive complete runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
Amazon Linux Security Center (ALAS)
Microsoft AzureLinux OVAL
Red Hat Security Data API (RHSA)
Microsoft CBL-Mariner OVAL
Oracle Linux Security (ELSA)
SUSE Security OVAL (SUSE-SU)

Operating systems

Operating System Supported Versions Provider Data Source
Amazon Linux 2, 2022, 2023 amazon Amazon Linux Security Center
Azure Linux 3.0 mariner Microsoft CBL-Mariner OVAL
CentOS 5, 6, 7, 8 rhel Red Hat Security Data API
CBL-Mariner 1.0, 2.0 mariner Microsoft CBL-Mariner OVAL
Oracle Linux 5, 6, 7, 8, 9, 10 oracle Oracle Linux Security
Red Hat Enterprise Linux 5, 6, 7, 8, 9, 10
EUS: 5.9, 6.4+, 7, 8.1, 8.2, 8.4, 8.6, 8.8, 9		 rhel Red Hat Security Data API
Rocky Linux 5, 6, 7, 8, 9, 10 rhel Red Hat Security Data API
SUSE Linux Enterprise Server 11, 12, 15 sles SUSE Security OVAL

Next steps

28 - Ruby

Ruby package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
ruby-gemfile-cataloger
Gemfile.lock
 transitive runtime, dev
ruby-gemspec-cataloger
*.gemspec
 direct runtime
ruby-installed-gemspec-cataloger
specifications/**/*.gemspec
 transitive runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.ruby.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

29 - Rust

Rust package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
cargo-auditable-binary-cataloger
application/x-executable, application/x-mach-binary, application/x-elf, application/x-sharedlib, application/vnd.microsoft.portable-executable, application/x-executable (mimetype)
 transitive complete runtime
rust-cargo-lock-cataloger
Cargo.lock
 transitive complete runtime, dev, build

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
GitHub Security Advisories (GHSA)
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.rust.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

30 - SBOM

SBOM package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
sbom-cataloger
*.syft.json, *.bom.*, *.bom, bom, *.sbom.*, *.sbom, sbom, *.cdx.*, *.cdx, *.spdx.*, *.spdx

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

31 - Snap

Snap package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
snap-cataloger
snap/snapcraft.yaml
snap-cataloger
snap/manifest.yaml
snap-cataloger
doc/linux-modules-*/changelog.Debian.gz
snap-cataloger
usr/share/snappy/dpkg.yaml
snap-cataloger
meta/snap.yaml

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

32 - Swift

Swift package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
cocoapods-cataloger
Podfile.lock
 transitive runtime
swift-package-manager-cataloger
Package.resolved, .package.resolved
 transitive runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

33 - Terraform

Terraform package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
terraform-lock-cataloger
.terraform.lock.hcl
 direct runtime

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps

34 - Wordpress

Wordpress package analysis and vulnerability scanning capabilities

Package analysis

Cataloger + Evidence License Dependencies Package Manager Claims
Depth Edges Kinds Files Digests Integrity Hash
wordpress-plugins-cataloger
wp-content/plugins/*/*.php

Vulnerability scanning

Data Source Disclosures Fixes Track by
Source
Package
Affected Date Versions Date
National Vulnerability Database (NVD)
Grype Configuration
Configuration Key Description
match.stock.using-cpes Use CPE package identifiers to find vulnerabilities

Next steps