syft adds extended Go symbol-capture scope and module patterns
Introduced 2026-08-10 · score 0.98
HOW TO USE IT
When configuring a Syft v1.51.0 SBOM for Grype reachability analysis, set `golang.capture-symbols` to `extended-stdlib` to capture stdlib and modules under `golang.org/x/`. Add `golang.capture-symbols-modules` patterns to widen that selection; they are ignored when capture-symbols is `none`.
syft scan <image-or-directory> --config <path/to/syft.yaml>golang:
capture-symbols: extended-stdlib
capture-symbols-modules:
- github.com/klauspost/**WHY THIS HELPS
Configure Go symbol capture in an SBOM for grype reachability analysis.
BEFORE THIS CHANGE
Set `golang.capture-symbols` to `none`, `stdlib`, or `all` to select symbol data capture scope.
REQUIREMENTS AND LIMITATIONS
- Version: v1.51.0
- golang.capture-symbols: Symbol capture scope; allowed values are `none`, `stdlib`, `extended-stdlib`, and `all`. `extended-stdlib` selects stdlib plus modules under `golang.org/x/`.
- golang.capture-symbols-modules: List of Go module path glob patterns to capture in addition to the selected scope; patterns only widen scope and are inert when capture-symbols is `none`. `**` crosses path separators; `*` does not. A trailing major version suffix is ignored unless the pattern spells one out.
- `capture-symbols-modules` is unioned with the selected scope and only widens it.
- Patterns are standard doublestar globs matched against module paths with trailing major version suffixes removed.
FIRST-PARTY EVIDENCE
- https://github.com/anchore/syft/releases/tag/v1.51.0
- https://github.com/anchore/syft/pull/5154
- https://github.com/anchore/syft/blob/v1.51.0/README.md
- https://github.com/anchore/syft/blob/v1.51.0/cmd/syft/internal/options/golang.go
Check the installed version and the source before using it. Entry JSON