Syft Schema#

        graph LR
    SyftPackage -- DEPENDS_ON --> SyftPackage

SyftPackage#

A software package discovered in a Syft artifact scan.

Ontology Projection: SyftPackage contributes data to canonical PackageVersion nodes.

Field	Index	Description
id	Yes	Normalized package identifier.
firstseen		Timestamp when a sync job first created this node.
lastupdated	Yes	Timestamp of the last sync that observed this node.
found_by		Syft cataloger that discovered the package.
language		Programming language associated with the package.
name		Package name.
normalized_id	Yes	Normalized identifier used for cross-tool package matching.
purl		Package URL identifying the package.
type		Package ecosystem or type, such as npm, pypi, or deb.
version		Package version.

(:PackageVersion)-[:DETECTED_AS]->(:SyftPackage): A canonical package version was detected as a Syft package.
(:SyftPackage)-[:DEPENDS_ON]->(:SyftPackage): Self-referential relationship: (SyftPackage)-[:DEPENDS_ON]->(SyftPackage).

Each SyftPackage carries a dependency_ids list of normalized_ids it depends on.

(:SyftPackage)-[:DEPLOYED]->(:Image): Links a package to the ontology image in which Syft discovered it.