Dependencies

Notable direct dependencies in go.mod and what they're used for.

Anchore-owned modules

Module	Used for
github.com/anchore/syft	Package cataloging from images, directories, files, and SBOMs. The single largest external integration.
github.com/anchore/stereoscope	Container image reading (transitively, via syft).
github.com/anchore/clio	Application bootstrap (commands, options, UI, bus, redact, log wiring).
github.com/anchore/fangs	Layered configuration (CLI flags + env + YAML).
github.com/anchore/bubbly	Bubble Tea UI components for the progress UI.
github.com/anchore/go-logger	Logging interface.
github.com/anchore/go-version	Version comparison helpers.
github.com/anchore/packageurl-go	PURL parsing.
github.com/anchore/go-collections, go-homedir, go-sync	Misc utilities.

Version comparison libraries

Each ecosystem uses a dedicated upstream library wrapped by grype/version/:

Library	Used by
github.com/Masterminds/semver/v3	semver.go
github.com/aquasecurity/go-pep440-version	pep440_version.go (Python)
github.com/bitnami/go-version	bitnami_version.go
github.com/knqyf263/go-apk-version	apk_version.go (Alpine)
github.com/knqyf263/go-deb-version	deb_version.go (Debian)
github.com/masahiro331/go-mvn-version	maven_version.go
github.com/anchore/go-version	rpm_version.go and others

CLI / TUI

Library	Role
github.com/spf13/cobra	Command tree and flag parsing.
github.com/spf13/viper, pflag, cast	Used transitively via clio/fangs.
github.com/charmbracelet/bubbletea, lipgloss, bubbles	TUI framework and components.
github.com/muesli/termenv, gookit/color, acarl005/stripansi	Color rendering.
github.com/dustin/go-humanize, hako/durafmt	Human-friendly formatting.
github.com/olekukonko/tablewriter	Plain-table rendering.
github.com/wagoodman/go-presenter, go-progress, go-partybus	Presenter abstraction, progress reporting, event bus.

Database

Library	Role
github.com/glebarez/sqlite	SQLite driver (pure-Go, via modernc.org/sqlite).
gorm.io/gorm	ORM for v6 DB access.

Output formats

Library	Role
github.com/CycloneDX/cyclonedx-go	CycloneDX presenter.
github.com/owenrumney/go-sarif	SARIF presenter.
github.com/Masterminds/sprig/v3	Template helpers for the template presenter.
github.com/openvex/go-vex	OpenVEX parsing.
github.com/gocsaf/csaf/v3	CSAF parsing.
github.com/pandatix/go-cvss	CVSS parsing/scoring.

Network / image I/O

Library	Role
github.com/docker/docker, google/go-containerregistry	Image source plumbing (transitively used by stereoscope).
github.com/hashicorp/go-getter, go-cleanhttp, go-multierror	Download and HTTP helpers.
github.com/mholt/archives, klauspost/compress, ulikunitz/xz	Archive handling.

Testing

Library	Role
github.com/stretchr/testify	Assertions.
github.com/gkampitakis/go-snaps	Snapshot testing for presenter outputs.
github.com/sergi/go-diff, go-test/deep	Pretty diffs for assertions.

Tooling pulled in via go.mod

Library	Role
github.com/dave/jennifer	Go-source code generation (used by JSON-schema generators).
github.com/iancoleman/strcase	Case conversion in code generation.
github.com/invopop/jsonschema	Building JSON schemas from Go types.

Counts

• ~70 direct require lines.
• ~250 indirect dependencies.
• Dependabot manages updates; dependabot[bot] accounts for ~28% of all commits on main.