# Syft - v1.26.1 released **URL:** \ **Category:** Announcements\ **Tags:** release\ **Created:** [May 22, 2025, 12:56pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445 "2025-05-22T12:56:21Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![popey](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/popey/32/429_2.png) [@popey](https://anchorecommunity.discourse.group/u/popey)\ **Post date:** [May 22, 2025, 12:56pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/1 "2025-05-22T12:56:21Z")
> **[Release v1.26.1 · anchore/syft](https://github.com/anchore/syft/releases/tag/v1.26.1)** > > Bug Fixes > > Dotnet deps binary cataloger hangs \[#3919 #3930 @kzantow\] > > (Full Changelog) ✨ **Help shape the future of Syft! Share your thoughts in our [quick 5-question survey](https://forms.gle/nPmEnqGdzYPU9pqn6)**. Your feedback will guide our development priorities and help us better serve your needs. Thank you! 🙌 ## Release Notes: ## Version v1.26.1 ### Bug Fixes - Dotnet deps binary cataloger hangs [#3919](https://github.com/anchore/syft/issues/3919) [#3930](https://github.com/anchore/syft/pull/3930) [@kzantow](https://github.com/kzantow) **[(Full Changelog)](https://github.com/anchore/syft/compare/v1.26.0...v1.26.1)** ---
**Author:** ![Carlos\_CM](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/carlos_cm/32/294_2.png) [@Carlos\_CM](https://anchorecommunity.discourse.group/u/Carlos_CM)\ **Post date:** [May 25, 2025, 6:28pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/2 "2025-05-25T18:28:24Z")
With this new version, I receive an SHA265 hash for some libraries as a licence. In theory, version v1.24.0 should have added the following improvement: ‘Return the full licence string instead of the SHA-256 hash when the licence string exceeds 64 characters’. Why is this happening to me? Thank you very much! ---
**Author:** ![kzantow](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/kzantow/32/17_2.png) [@kzantow](https://anchorecommunity.discourse.group/u/kzantow)\ **Post date:** [May 26, 2025, 10:49pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/3 "2025-05-26T22:49:19Z")
Hey @Carlos_CM – I believe the current behavior, after [the issue you mentioned](https://github.com/anchore/syft/issues/3780) is: we attempt to validate the license string is a valid SPDX license expression and if it is valid, we directly include the expression but if the license is not a valid SPDX expression, like other unknown licenses, the contents are hashed and included as an “[other license](https://spdx.github.io/spdx-spec/v2.3/other-licensing-information-detected/)”, assuming you are using SPDX. There is an option to include full contents, which is disabled by default, that also can affect this behavior. I’d need a little more details to understand the specifics you’re seeing. ---
**Author:** ![spiffcs](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/spiffcs/32/14_2.png) [@spiffcs](https://anchorecommunity.discourse.group/u/spiffcs)\ **Post date:** [May 27, 2025, 5:10pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/4 "2025-05-27T17:10:01Z")
The good news here is that if you receive a SHA256 then you should be able to enable an option that will give you the full contents. We wanted to be sensitive to not increase the SBOM size without the user opting in here. The option should be `SYFT_LICENSE_CONTENT=unknown` ← That should get you the license content here. If you throw over some examples of commands you’re running we can help 😀 ---
**Author:** ![Carlos\_CM](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/carlos_cm/32/294_2.png) [@Carlos\_CM](https://anchorecommunity.discourse.group/u/Carlos_CM)\ **Post date:** [June 2, 2025, 11:21am UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/5 "2025-06-02T11:21:06Z")
Thank you very much for your answers. I have tried to enable the option to obtain the full contents rather than the SHA256 hash. I’m using Syft in a GitHub action to generate the SBOM of a repository. I added the following line to define the environment variable: ```auto env: SYFT_LICENSE_CONTENT: unknown ``` Nevertheless, I am still experiencing the same problem: ![image](https://global.discourse-cdn.com/free1/uploads/anchorecommunity/original/1X/fb76d31698b26e077f15361274b944c6917ac0b4.png) Is this the correct way to do it? Perhaps I didn’t understand it properly. Thank you very much! ---
**Author:** ![spiffcs](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/spiffcs/32/14_2.png) [@spiffcs](https://anchorecommunity.discourse.group/u/spiffcs)\ **Post date:** [June 2, 2025, 2:41pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/6 "2025-06-02T14:41:59Z")
Are you accessing the correct field? You’ll still see the `sha256:xxxx` in the `value` field, but with that option enabled you should now see a `contents:xxxx` field that has the full contents: Something like this. See `contents` at the end of the object ```json { "value": "sha256:9e3a4384b6d8d2358d44103f62bcd948328b3f8a63a1a6baa66abeb43302d581", "spdxExpression": "", "type": "concluded", "urls": [], "locations": [ { "path": "/usr/share/doc/libcom-err2/copyright", "layerID": "sha256:a8c68591d421fc2d4bdda704f67a796edf5ff880c59358d75107eb5261821650", "accessPath": "/usr/share/doc/libcom-err2/copyright", "annotations": { "evidence": "supporting" } } ], "contents": "This is the Debian GNU/Linux prepackaged version of the Common Error\nDescription library. It is currently distributed together with the EXT2 file\nsystem utilities, which are otherwise packaged as \"e2fsprogs\".\n\nThis package was put together by Yann Dirson ,\nfrom sources obtained from a mirror of:\n tsx-11.mit.edu:/pub/linux/packages/ext2fs/\n\nFrom the original distribution:\n\nCopyright 1987, 1988 by the Student Information Processing Board\n\tof the Massachusetts Institute of Technology\n\nPermission to use, copy, modify, and distribute this software\nand its documentation for any purpose and without fee is\nhereby granted, provided that the above copyright notice\nappear in all copies and that both that copyright notice and\nthis permission notice appear in supporting documentation,\nand that the names of M.I.T. and the M.I.T. S.I.P.B. not be\nused in advertising or publicity pertaining to distribution\nof the software without specific, written prior permission.\nM.I.T. and the M.I.T. S.I.P.B. make no representations about\nthe suitability of this software for any purpose. It is\nprovided \"as is\" without express or implied warranty.\n" } ``` ---
**Author:** ![Carlos\_CM](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/carlos_cm/32/294_2.png) [@Carlos\_CM](https://anchorecommunity.discourse.group/u/Carlos_CM)\ **Post date:** [June 3, 2025, 4:27pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/7 "2025-06-03T16:27:25Z")
I was accessing the ‘value’ field instead of the ‘contents’ field, but I still can’t retrieve the contents. Could you tell me how you got that JSON? Thank you very much! ---
**Author:** ![spiffcs](https://yyz2.discourse-cdn.com/free1/user_avatar/anchorecommunity.discourse.group/spiffcs/32/14_2.png) [@spiffcs](https://anchorecommunity.discourse.group/u/spiffcs)\ **Post date:** [June 4, 2025, 1:35pm UTC](https://anchorecommunity.discourse.group/t/syft-v1-26-1-released/445/8 "2025-06-04T13:35:07Z")
Here is an example of the command with the env variable set to unknown. The nvidia/cuda image should have some `unknown` licenses with contents generated. You can search for the field `contents` in the document and should see some full text 😀 `SYFT_LICENSE_CONTENT=unknown syft -o json nvidia/cuda:12.5.1-cudnn-runtime-ubuntu20.04 | jq . > unknown.json`