inspector-sbomgen v1.9.0 Released

[bluesentinelsec]

We have released inspector-sbomgen version 1.9.0. Inspector-sbomgen is the asset inventory tool that powers the Inspector GitHub Action.

This release includes many new features, shown below.

No action is required if you are already using sbomgen_version: "latest" in your workflow.

If you pin to versions, consider updating your workflows to use sbomgen_version: 1.9.0.

The latest version of inspector-sbomgen can be downloaded here:

• https://docs.aws.amazon.com/inspector/latest/user/sbom-generator-versions.html

[inspector-sbomgen 1.9.0] - November 11th 2025

Artifacts

• Added support for Windows-based container images.

OS Support

• Added support for Microsoft Windows. Note: Windows support is experimental; we are not releasing pre-compiled Windows builds at this time. Windows builds will follow in a future release.
• Improved parsing of /etc/os-release when the OS name contains spurious single/double quotation marks.
• Improved collection of currently installed OS packages from Debian and Ubuntu.
• Added support for FreeBSD 13 and above.
• Added instance type when inventorying EC2 instances.
• Added vendor qualifier to Amazon Linux packages for non-native repository identification.

Expanded Ecosystems

• Added support for MySQL and MariaDB installations.
• Added support for PHP interpreter installations.
• Added support for Jenkins-core installations.
• Added support for 7zip installations on Windows OS.
• Added support for Elasticsearch.
• Added support for Curl and LibCurl installations.
• Added support for Microsoft applications.

Package Support

• Added support for Java Gradle inventory and vulnerability scanning.
• Minor improvements to mitigate infinite loops in Maven project dependency resolution.
• Resolved an issue that would sometimes cause an array index out of bounds error.
• Improved support for Node runtime on Distroless containers.

Security

• Added mitigations against possible directory traversal threats during container image unpacking.

Miscellaneous

• Migrated Dockerfile parsing to Moby Buildkit.
• Improved handling of Docker findings within container images built with here-documents.
• Added --scan-sbom-endpoint and --scan-sbom-service CLI arguments.
• Removed --enable-log-to-disk option.
• Optimize scanning performance for NPM package collectors