CLI tool and library for generating a Software Bill of Materials from container images and filesystems
active 2025-03-15 → 2026-08-10 (UTC)
Activity over time
Daily event counts in the loaded window
Line chart, 514 days from 2025-03-15 to 2026-08-10. Pushes: 555 total, peak 14 in a day. Pull requests: 496 total, peak 11 in a day. Issues: 176 total, peak 7 in a day. Comments: 641 total, peak 24 in a day. Stars: 875 total, peak 16 in a day.
- Pushes
- Pull requests
- Issues
- Comments
- Stars
Stars, PRs, issues and forks are under-captured in the later part of this window. GH Archive progressively stopped capturing non-push events during 2026 — −95% or worse by the end of the window. Every series here except Pushes fades for that reason, so a decline above reflects the archive, not this repository. Pushes stay reliable throughout, so read them, and the contributor counts derived from them, as the real signal. Data health has the measurements.
Top contributors
Pushes, PRs, issues, reviews and comments — stars and forks excluded, so this is contribution rather than popularity
| Contributor | Contributions | Pushes | PRs | Comments |
|---|---|---|---|---|
| wagoodman | 451 | 194 | 42 | 105 |
| spiffcs | 425 | 189 | 77 | 69 |
| kzantow | 305 | 38 | 23 | 139 |
| dependabot[bot] | 156 | 23 | 122 | 11 |
| anchore-actions-token-generator[bot] | 132 | 45 | 87 | 0 |
| github-actions[bot] | 109 | 0 | 8 | 5 |
| willmurphyscode | 97 | 39 | 21 | 21 |
| witchcraze | 36 | 0 | 9 | 8 |
| rezmoss | 34 | 0 | 8 | 20 |
| popey | 30 | 7 | 2 | 14 |
| naoriel | 27 | 0 | 1 | 15 |
| VictorHuu | 19 | 0 | 8 | 9 |
| tjhub1983 | 14 | 0 | 4 | 10 |
| dsseng | 12 | 0 | 0 | 8 |
| houdini91 | 12 | 0 | 3 | 8 |
| timols | 11 | 0 | 2 | 5 |
| jakub-bochenski | 11 | 0 | 0 | 7 |
| oss-auto-merger[bot] | 10 | 10 | 0 | 0 |
| jayvdb | 8 | 0 | 2 | 3 |
| martincostello | 8 | 0 | 0 | 5 |
Recent activity
Latest issues, pull requests and releases
- Pull request#5161sueun-dev2026-08-07 19:18
- Issue#5115kzantow2026-07-28 14:20Exclude directories for windows scans is not working
- Issue comment#4676rezmoss2026-07-24 23:59added bun cataloger & bin detection
- Pull request#5049dependabot[bot]2026-07-10 13:13
- Issue#632kzantow2026-06-25 17:36Support for NTIA minimum elements for an SBOM
- Pull request#5010wagoodman2026-06-24 03:14
- Pull request#4987willmurphyscode2026-06-16 21:34
- Pull request#4969rezmoss2026-06-10 22:57
- Issue comment#4625hnnynh2026-06-09 01:04Add support for Bun lockfile (bun.lock)
- Issue comment#4915wagoodman2026-05-28 20:02Improve identification of source code checkouts of C/C++ projects, e.g. LWIP V2.1.2
- Issue comment#4785SAY-52026-05-27 04:28swift: emit canonical purls without .git suffix or repeated name
- Issue#4940xdfm12026-05-26 10:59Syft does not extract package licenses from opkg manager
- Issue comment#4788SAY-52026-05-25 04:58cpe: map conan expat to libexpat product+vendor
- Issue comment#4939witchcraze2026-05-24 02:52update deno classifier
- Issue comment#4926spiffcs2026-05-21 16:50perf(python): hoist name normalization regexp to package level
- Issue comment#4893tjhub19832026-05-21 01:36fix: support go binary older versions (1.8.x, 1.9.x) on s390x
- Issue comment#4891tjhub19832026-05-20 01:08fix(dotnet): prefer ProductVersion when it contains semantic metadata (#4017)
- Issue comment#4918tjhub19832026-05-20 01:08feat: add .bpl file support to PE cataloger
- Pull request#4924algojogacor2026-05-18 00:35
- Issue#4921Miablo2026-05-15 22:44Opt-in hierarchical dependency resolution for Java archives
- Issue comment#4902tjhub19832026-05-14 05:58fix(binary): support helm pre-release versions (alpha/beta/rc) (#4820)
- Issue comment#4894tjhub19832026-05-14 04:47fix: support deno binary older versions (1.10.3 - 1.32.2)
- Issue comment#4880tjhub19832026-05-14 04:47fix: skip permission-denied paths instead of crashing on directory walk (#3258)
- Pull request#4740will-bates112026-05-13 17:44
- Issue#4916willmurphyscode2026-05-13 14:15Syft-generated Windows SBOM unable to identify format
Totals cover only the window loaded into ClickHouse and count events, not GitHub's lifetime totals — 875 stars here means stars gained during the window, not the repo's star count.