That's great to know, thank you!

I'd like to be a bit more precise about Docker. Do I understand correctly that

docker buildx build --tag <namespace>/<image>:<version> \
    --attest type=sbom --push .

will scan the container image and convert cargo auditable data from binaries into a CycloneDX SBOM?

Yes, that is what it does. If you want to see it in action, you can take a look at neondatabase/neon#12768:

• https://github.com/neondatabase/neon/actions/runs/16594165208/job/46938463706#step:11:186 has the command
• https://github.com/neondatabase/neon/actions/runs/16594165208/job/46938463706#step:11:9311 mentions that it starts scanning
• docker buildx imagetools inspect ghcr.io/neondatabase/neon:16594165208-bookworm-x64 --format "{{ json .SBOM }}" pulls the metadata and then the cyclonedx doc and prints it as json

In that case we explicitly pin the buildkit-syft-scanner, but only for predictability. It is the default right now.

I just wanted to say I really appreciate the updates!

I don't hear about people using the tool unless something breaks, so large projects making use of it can fly completely under my radar. I'm always happy to hear about it being useful though, and it helps make a stronger case for making it the default in Cargo!