Syft 1.48.0 brings macOS .app bundles and .NET single-file bundles into SBOM scans

What happened on this date

On 2026-07-16 (14:47 UTC), Anchore's SBOM generator Syft published v1.48.0 on GitHub. New features in 1.48.0 include a macOS .app cataloger, capture of Go binary symbols, vcpkg support, Kerberos 5 library cataloging, a safetensors model type, and scan duration and scan date in results. Fixes include the .NET cataloger finding deps.json packages inside Linux ELF single-file bundles, corrected Swift PURL matching, case-insensitive PE file extensions, and handling of npm keys in deno.lock. The release page lists 17 contributors, and the changes affect what an SBOM can see in finished, packaged artifacts rather than only in source manifests.

What it means for protecting app logic

SBOM tools are first of all a help to defenders: when a vulnerability advisory lands after release, you need to know quickly which versions ship the affected component. This update lets Syft identify dependencies directly in more finished artifacts, such as macOS app bundles and .NET single-file bundles. The same visibility applies to anyone holding your release: single-file packaging and app bundling do not hide your dependency make-up, and dependency lists and versions are effectively public. The new safetensors model type is also worth noting; if an app ships model files, they are identifiable, extractable assets and should not be treated as a protected core capability. Scan completeness depends on cataloger coverage, so not found should never be read as not present.

Checks to run on your own builds

First, generate SBOMs from the final release artifacts, such as .app bundles, single-file executables and installers, not just from source lockfiles, and compare the two to find components added or missed during packaging. Second, archive the SBOM alongside each release so vulnerability response can locate affected versions quickly. Third, check whether the package ships model files and assess the impact if they were extracted, moving inference server-side where needed. Fourth, confirm the single-file or app bundle does not carry debug symbols, test configuration or internal documents. Fifth, after upgrading Syft, rescan past releases and look for new results from the new catalogers.

Your checklist

• Generate SBOMs from final artifacts and diff against lockfile inventories
• Archive an SBOM with every release
• Assess the impact of shipped model files being extracted
• Confirm the release carries no debug symbols or internal configuration