Syft

Syft 1.54.1

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

  • By Anchore Inc
  • Open Source
  • Updated Oct 6, 2026
Download for Windows

About Syft

Syft is a powerful and easy-to-use open-source tool for generating Software Bill of Materials (SBOMs) for container images and filesystems. It provides detailed visibility into the packages and dependencies in your software, helping you manage vulnerabilities, license compliance, and software supply chain security.

What's new in 1.54.1

Bug Fixes

  • resolve packages.lock dependencies deterministically [PR #5210 @spiffcs]
  • Cannot produce attestation file from local podman image [Issue #1664] [PR #5368 @Bru456]

Dependencies
9 dependency changes (9 updated).
Updated (9 packages)
- github.com/anchore/go-rpmdb v0.2.0 → v0.2.2
- github.com/anchore/stereoscope v0.3.3 → v0.3.4
- github.com/docker/cli v29.8.1+incompatible → v29.8.2+incompatible
- github.com/glebarez/go-sqlite v1.20.3 → v1.23.0
- github.com/klauspost/compress v1.20.0 → v1.20.1
- github.com/secure-systems-lab/go-securesystemslib v0.11.0 → v0.11.1
- github.com/sigstore/protobuf-specs v0.5.1 → v0.5.2
- github.com/sigstore/sigstore v1.10.8 → v1.10.11
- github.com/sylabs/sif/v2 v2.24.1 → v2.24.2
(Full Changelog)

Full release notes »

Technical details

PublisherAnchore Inc
Version1.54.1
Release date2026-10-06
LicenseApache-2.0
Installer typezip
Architecturex64, arm64
Package IDAnchore.Syft

Links & install command

Install Syft from the command line with Windows Package Manager (winget):

winget install --id=Anchore.Syft -e

containerscyclonedxdockergogolanghacktoberfestocisbomspdxstatic-analysistool

Older versions

  • 1.54.0
  • 1.52.0
  • 1.51.1
  • 1.51.0
  • 1.50.0
  • 1.49.0
  • 1.48.0
  • 1.46.0
  • 1.45.1