CLI tool and library for generating a Software Bill of Materials from container images and filesystems
C-Rank Grade: A (Welcoming) - 59/100
External PR Merge Rate: 42%
Response Time: 22h
First Timer Success: 48%
anchore/syft has a recorded first-timer success rate of 48.5%. Repositories ranked A typically provide actionable feedback during code reviews and actively nurture new community contributors.
Maintainers in anchore/syft respond to incoming external pull requests in approximately 21.6 hours on average. Keeping PRs focused on single tasks and ensuring tests pass helps maintainers review faster.
The C-Rank™ system evaluates GitHub projects on a 0–100 scale using real data: PR merge rates, review turnaround time, active maintainer presence, and first-time contributor success. A score of 58.5 places anchore/syft in the A tier.
The external contributor pull request merge rate for anchore/syft is 42.1%, based on public PR activity from non-core contributors.
anchore/syft currently has 5 active issue(s) tagged with beginner-friendly labels like "good first issue", "beginner", or "up-for-grabs".
Balanced & professional review environment in anchore/syft. Maintains strict focus on technical quality and test standards.
Average Response Latency
Tracks hours until a maintainer leaves a review, comment, or PR response.
External Acceptance Rate
Percentage of community pull requests successfully merged into main.
First PR Conversion
Rate at which developers submitting their first repository PR succeed.
Show contributors that your repository actively reviews and merges external pull requests.
[](https://getmerged.abhishekco.de/anchore/syft?utm_source=github&utm_medium=badge)
Historical health & responsiveness evolution
External PR acceptance
First PR success rate
50% receive response in
90% receive response in
Maintainer review activity heatmap & prime window prediction
Calculating local time...
Calculating local time...
Detected: UTC
Maintainers are most responsive around 14:00 UTC (14:00 UTC in your timezone). Recommended submission window is Monday - Wednesday from 17:00 to 21:00 UTC (17:00 - 21:00 UTC local).
Maintainer Strategy: Maintainer Sweet Spot: PRs under 150 lines merge in ~14 hours (53% approval). Large PRs (>500 lines) take ~104 hours (19% approval). Keep your diff compact for rapid review.
Hi, thanks for maintaining Syft. I am working on downstream RPM packaging for Syft. The GitHub auto-generated source archive (archive/refs/tags/vX.Y.Z.tar.gz) does not include a root vendor/ directory, and Syft has a large Go module dependency graph. For distributions that need offline builds, it would be very helpful if each GitHub release also provided an official source dependency archive, for example: syft-vX.Y.Z-vendor.tar.gz generated from the release tag with go mod vendor Would you be open to publishing an official vendored dependency archive as part of the release artifacts? Thanks!
What happened: Syft detected PHP extension openssl.so as openssl 8.5.7. This version is from the PHP. This is confusing because there is no OpenSSL release with version 8.5.7. (all extensions may have simmilar issue) What you expected to happen: I'm not sure what the best representation should be. However, the current artifact name and generated CPEs appear misleading. At minimum, it seems the PHP extension version should not be represented as an OpenSSL product version. Both humans and downstream tooling may incorrectly interpret this as an OpenSSL installation. Steps to reproduce the issue: $ cat Dockerfile FROM alpine:latest RUN apk add --no-cache \ php \ php-openssl \ php-ldap \ php-sqlite3 \ && rm -rf /lib/apk/db/* $ docker build -t php-no-apkdb . $ syft -q php-no-apkdb NAME VERSION TYPE busybox 1.37.0 binary ldap 8.5.7 binary openssl 8.5.7 binary php-cli 8.5.7 binary sqlite3 8.5.7 binary $ syft -q php-no-apkdb -o
What would you like to be added: Default is that dev dependencies are excluded. But NPM devOptional dependencies are still included. I think they should be excluded. Why is this needed: Dev dependencies are not something you distribute, including optional ones.
What happened: Current matcher can not detect some pattern 2.11.30 - 2.11.35 arm/v6 v2.11.1 - v2.11.3 v3.0.1 v3.1.1 - v3.1.7 v3.4.0 v3.5.6 v3.6.0 - v3.6.6 s390x 2.x 3.x ppc64le v2.11.10 - v2.11.28 Steps to reproduce the issue: 2.11.30 $ syft -q traefik:2.11.30 | grep traefik github.com/traefik/paerser v0.2.2 go-module github.com/traefik/traefik/v2 v0.0.0-20251028084404-998868450f09 go-module github.com/traefik/yaegi v0.16.1 go-module arm/v6 $ syft -q --platform linux/arm/v6 traefik:v2.11.1 | grep traefik github.com/traefik/paerser v0.2.0 go-module github.com/traefik/traefik/v2 v0.0.0-2024041009520
What happened: Running syft on a root filesystem directory results in duplicated components (one deb, one pypi) for all Python packages installed via Ubuntu packages. What you expected to happen: Related to #931 - I would want the pypi components that have an equivalent deb component to be filtered out. When #931 was closed the topic seemed to have moved from the initial report of rpm and pypi to just covering binary packages. I've opened a new issue to avoid pinging everyone in there. I understand that I could de-select the python cataloger but in this case we do have some (far fewer) Python packages that are not available as Debians. This is an issue because the pypi component metadata does not capture that in the Debian/Ubuntu ecosystem some backported fixes have been applied, and so once this CycloneDX SBOM is fed into grype some false positives will result. Steps to reproduce the issue: This is run on an Ubuntu root file system extracted to a tmp location to produce a CycloneDX JS
Rate what actually matters after opening a pull request here.
Rate your first-hand PR experience (review speed, maintainer responsiveness, and onboarding ease) to help other contributors.
When evaluating whether to contribute to anchore/syft, response velocity and maintainer engagement are crucial. GetMerged continuously tracks pull request trajectories, first-comment latency, and code review rounds to help developers avoid submitting pull requests to backlogged repositories.
Currently, maintainers of anchore/syft acknowledge new external contributions in approximately 21 hours. Out of all submitted pull requests from non-core authors in the last 180-day window, 42.1% were successfully merged into the primary branch.
anchore/syft has a recorded first-timer success rate of 48.5%. Repositories ranked Welcoming typically provide actionable feedback during code reviews and actively nurture new community contributors.
The initial maintainer response time averages ~21 hours. Keeping PRs scoped to single concerns and ensuring CI checks succeed will optimize review turnaround.
The C-Rank™ index scores repositories on a 0 to 100 scale using an objective formula: external PR merge rates, initial response speed, active maintainer count, and first-time contributor retention. A score of 58.5 places anchore/syft in the Welcoming tier.
The external pull request merge rate is 42.1%. GetMerged isolates non-core community contributions so external developers get an accurate benchmark of PR acceptance probability.
Yes, anchore/syft currently has 5 active issue(s) tagged with beginner-friendly labels. You can inspect these directly from the repository issues tab.
All metrics displayed for anchore/syft are automatically retrieved via the public GitHub API and recalculated daily. Insider pull requests submitted by repository owners or organization members are excluded from merge rate calculations to preserve objective external contributor statistics.