# anchore/syft

> A CLI tool and Go library for generating a Software Bill of Materials (SBOM) from container images, filesystems, and archives. Supports many packaging ecosystems and output formats (CycloneDX, SPDX).

- Magnitude: 1.5 out of 10 — Steady
- Stars: 9,819 total · +3 stars measured 2026-11-03, 00:39–13:58 UTC, ≈ 5 by evening
- Star trust: star growth looks organic
- Category: Security · Language: Go · License: Apache-2.0 · Created: 2020-05-07 · Last push: 2026-11-02
- GitHub: https://github.com/anchore/syft · Page: https://gitnova.dev/en/r/anchore/syft

## Useful for

- Generate an SBOM for a Docker image in CycloneDX format
- Scan a project directory and get a dependency list in SPDX
- Pass the SBOM to Grype for vulnerability scanning

## Why it’s here

- Star-counter measurements on 2026-11-03 (UTC), 00:39–13:58: 9816 → 9819 stars (+3). This is the change over that interval.
- Estimated end-of-day forecast: about +5 stars, using observed gains and the previous day.
- Recent forks include notable developers: @zricethezav (998 followers).

## Star trust

Star growth looks organic.

Star-trust labels are heuristics based on the repository’s behavior, not a check of every stargazer.

## Numbers

- Forks: 1,040
- Issues and pull requests: 5,484
- Watchers: 70
- Average over the last week: 7 per day
- Usual pace: 7 per day
- Stars in the last hour (measured): 0
- Latest release: v1.56.0 (2026-11-02)

## Stars per day, last 30 days (oldest → newest, today is partial)

2026-10-05 … 2026-11-03: 10, 5, 4, 4, 5, 4, 2, 5, 6, 9, 2, 7, 1, 4, 6, 4, 6, 13, 12, 14, 4, 11, 12, 10, 9, 11, 4, 3, 7, 3

## Magnitude by day, last 14 days

09-24 0.9, 09-25 1.1, 09-26 1.2, 09-27 1.0, 09-28 1.0, 09-29 1.3, 09-30 1.3, 10-28 1.6, 10-29 1.9, 10-30 1.7, 10-31 1.8, 11-01 1.5, 11-02 1.5, 11-03 1.6

## Similar by description

1. **aquasecurity/trivy** — 1.8 · Steady · Security · Go · +12 stars measured 2026-11-03, 00:37–13:57 UTC, ≈ 20 by evening
   Security scanner that finds vulnerabilities, misconfigurations, secrets and SBOM in containers, Kubernetes, code repositories, clouds and filesystems. Aimed at developers and DevOps for checking artifact security.
   Full card: https://gitnova.dev/en/r/aquasecurity/trivy.md

---

Magnitude (0–10) measures how fast and how unusually interest in a repository is growing right now. It is not a quality score.
Days are UTC. “So far today” is a fact; “expected by the end of the day” is a forecast.
Summaries and use cases are written by an LLM (DeepSeek V4.1 Flash) from the README and may be inaccurate: verify specific claims (benchmarks, speed, hardware) in the repository itself.
Data as of 2026-11-03 14:05 UTC, updated every 30 minutes.