syft 1.38.0

[BrewTestBot]

Created by brew bump

---

Created with brew bump-formula-pr.

Details

release notes

### Added Features

add support for cataloging GGUF models [#4184 #4279 @spiffcs]
Support scanning a list of CPEs [#3890 #4207 @chovanecadam]
Syft does not detect Elixir binary on system [#4333 #4334 @rezmoss]

Bug Fixes

Support extras statements in Python PDM cataloger [#4352 @wagoodman]
Preserve --from argument order [#4350 @wagoodman]
SBOM generated by Syft 1.28 contains license elements missing id or name (causing CycloneDX parser error) [#4363]
empty PURL output in dependency snapshot format breaks sbom-action [#4311]
Interface includes constraint elements, can only be used in type parameters [#4346]
Upgrade github.com/nwaples/rardecode@v1.1.3 to 2.2.1 [#4338]
Upgrade to Golang 1.25.4 [#4341]

Additional Changes

migrate syft to use mholt/archives instead of anchore fork [#4029 @Rupikz]
Add license enrichment from pypi to python packages [#4295 @timols]
license file search [#4327 @kzantow]

(Full Changelog)

View the full release notes at https://github.com/anchore/syft/releases/tag/v1.38.0.

---

[github-actions]

🤖 An automated task has requested bottles to be published to this PR.

Caution

Please do not push to this PR branch before the bottle commits have been pushed, as this results in a state that is difficult to recover from. If you need to resolve a merge conflict, please use a merge commit. Do not force-push to this PR branch.