Bitnami转发了
We're delighted to share that Syft v1.20.0 has been released, and it represents a significant step forward for our open-source software composition analysis tool. Working with the community continues to be one of the most rewarding aspects of this project. A community member identified that certificate validation was being performed unnecessarily during DLL scanning on Windows, resulting in scans taking up to 50 minutes. With this insight, we've reduced those scan times to just a few minutes—a substantial improvement for our Windows users. The new release also includes dedicated support for Bitnami embedded SBOMs, allowing us to merge authoritative vendor data with Syft's comprehensive analysis capabilities. This wasn't a simple implementation, but the result is worth it: more accurate SBOMs that combine the best of both worlds. We've also addressed a challenge with license detection. When license files don't match a valid SPDX expression, they were sometimes marked as "unlicensed" even when valid license text was present. Our solution preserves the original license text when SPDX matching fails, ensuring you retain essential license information. The upgrade to Go 1.24 brings additional benefits: scan times are reduced by up to 20%, and Go module version detection capabilities are improved. We are truly grateful to everyone who contributed to this release. Open source thrives on collaboration, and Syft is no exception. If you're interested in software supply chain security, I encourage you to try it out: github.com/anchore/syft https://lnkd.in/ej669jNF