Syft incorrectly identifies NuGet package "Newtonsoft.Json" as "Json.NET" with incorrect version
- Dominant language
- Go
- Stars
- 9.6k
- Forks
- 962
- Avg merge
- 23h 27m
- Merged PRs (30d)
- 48
Description
**What happened**:
When scanning the NuGet package `Newtonsoft.Json` version `12.0.3`, Syft incorrectly identifies the package as `Json.NET` instead of `Newtonsoft.Json`. Additionally, the version includes build metadata as `12.0.3.23909` instead of the correct `12.0.3`.
**What you expected to happen**:
- The package should be detected as `Newtonsoft.Json`, not `Json.NET`.
- The version should be reported as `12.0.3`.
**Steps to reproduce the issue**:
1. Download the `Newtonsoft.Json` NuGet package (version `12.0.3`) - https://www.nuget.org/packages/Newtonsoft.Json/12.0.3
2. Run Syft to scan the extracted package directory.
```bash
syft ./newtonsoft.json.12.0.3 --output json
```
**Anything else we need to know?**:
No
**Environment**:
- **Syft version**: `1.19.0`
- **OS**: `macOS Sequoia`
Contributor guide
Research direction
Start by reproducing the issue with the NuGet package and the provided Syft JSON scan command. Trace how the package name and version are identified, then verify that the output reports Newtonsoft.Json at version 12.0.3 rather than Json.NET or 12.0.3.23909.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- cli, tooling
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 25/100