CVE and update status of the FreeBSD ports tree3,864 unaddressed CVEs in 671 portsAll times are CET
Port details

security/syft 1.42.2_8

CLI tool for generating SBOMs from container images and filesystems

1
unaddressed
0
VuXML only
0
fixed
0
open problem reports

Port info

Maintainer
youngbill.empire411@gmail.com
Packages
latest: 1.42.2_8
Upstream
Higher version available: 1.55.0
Last update
to 1.42.2_8 · d81b7ba3c3
Quarterly
2026Q4: 1.42.2_8 · last MFH 60647eff54
WWW
https://github.com/anchore/syft
Links
cgit · VuXML

Install

Package
# pkg install syft
installs 1.42.2_8 from latest; from quarterly (2026Q4) 1.42.2_8
Port
# cd /usr/ports/security/syft && make install clean
Size
20 MiB download · 79 MiB installed
Depends on
nothing
License
APACHE20

Packages by version and architecture

latest

FreeBSD versionamd64aarch64i386
FreeBSD 161.42.2_81.42.2_7–
FreeBSD 151.42.2_81.42.2_7–
FreeBSD 141.42.2_81.42.2_7✗

quarterly (2026Q4)

FreeBSD versionamd64aarch64i386
FreeBSD 151.42.2_81.42.2_7–
FreeBSD 141.42.2_81.42.2_7✗

version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.

Unaddressed (1)

The CVE record lists the packaged version 1.42.2_8 as affected, and no VuXML entry names the CVE. What does this mean?

CVECVSSPublishedDescription
CVE-2026-334815.32026-03-26Syft is a a CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images and filesystems. Syft versions before v1.42.3 would not prop…

VuXML only (0)

Listed in VuXML, the packaged version 1.42.2_8 is still in the affected range; pkg audit reports it. What does this mean?

None.

Fixed (0)

No VuXML entries for this package.

Problem reports (0) · open in Bugzilla, most recently changed first

None.

Commits (11)

Dag-Erling Smørgrav (des) · 1.42.2_8 MFH 2026Q4 ✓
various: Bump Go ports for Go 1.26.10 / 1.27.3
d81b7ba3c3
Dag-Erling Smørgrav (des) · 1.42.2_6
various: Drop Go 1.25 version pin

This is a nop since 1.25 is the oldest supported version.
79fc20201d
Dag-Erling Smørgrav (des) · 1.42.2_6 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.14 / 1.26.7
4867821cd6
Dag-Erling Smørgrav (des) · 1.42.2_5 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.13 / 1.26.6
6d39dcf04e
Dag-Erling Smørgrav (des) · 1.42.2_4 MFH 2026Q3 ✓
various: Bump go ports for go-1.25.12 / 1.26.5
4ea3547132
Dag-Erling Smørgrav (des) · 1.42.2_3
various: Bump go ports for go-1.25.11 / go-1.26.4
dd8dc2a59d
Adam Weinberger (adamw) · 1.42.2_2
various: Bump ports for Go 1.25.10
4e243a83f8
Robert Clausecker (fuz) · 1.42.2_1
security/syft: fix fetch

The port tries to fetch google.golang.org/genproto and its submodules
in different versions for some reason.  This confuses our framework to
the point where it cannot fetch the port.

Fix the build by fetching the same (newer) version for both parent and
child.  The versions are ~2 months apart, which should pose no problem.

Also mark as only for aarch64, amd64 due to use of modernc.org/sqlite

Approved by:	portmgr (build fix blanket)
MFH:		2026Q2
c86a02ab3b
Dag-Erling Smørgrav (des) · 1.42.2_1
various: Bump go ports for go-1.25.9 / 1.26.2
7507e72a84
Torsten Zuehlsdorff (tz) · 1.42.2
security/syft: New port

Syft is a CLI tool and library for generating a Software Bill of Materials
  (SBOM) from container images and filesystems.

  It supports multiple SBOM formats including CycloneDX and SPDX and can scan
  containers, directories, and archives to identify installed packages.

  Syft is developed by Anchore and is commonly used in software supply-chain
  security workflows.

Sponsored by:	OTTRIA
498cc5a1de