What happened: Syft fails to detect that click==8.2.1 is a dependency of flask==3.1.1 when scanning a virtual environment that has both packages installed.
What you expected to happen: Syft detects the dependency relationship.
Steps to reproduce the issue:
- Create and activate virtual environment
- Install flask
- Scan directory containing virtual environment
- Check whether SBOM contains dependency relationship between
flask and click
Anything else we need to know?: I think this is caused by incorrect parsing of the Requires-Dist field in the wheel's METADATA file. The relevant code expects parentheses around the version specifier when in fact parsers should treat them as being optional.
Environment:
- Output of
syft version: 1.24.0
- OS (e.g:
cat /etc/os-release or similar): NixOS 25.11 (Xantusia)
What happened: Syft fails to detect that
click==8.2.1is a dependency offlask==3.1.1when scanning a virtual environment that has both packages installed.What you expected to happen: Syft detects the dependency relationship.
Steps to reproduce the issue:
flaskandclickAnything else we need to know?: I think this is caused by incorrect parsing of the
Requires-Distfield in the wheel'sMETADATAfile. The relevant code expects parentheses around the version specifier when in fact parsers should treat them as being optional.Environment:
syft version: 1.24.0cat /etc/os-releaseor similar): NixOS 25.11 (Xantusia)