Packages
Which images ship a package
322 packages in 328 versions, read from the package sets of 9 images.
Every image's package set is in the report, read from verified SBOMs, so an image missing from this page doesn't ship it.
Who ships a version
A package name, and the versions you're after. The answer lists the images that ship a matching version, and the images built on one of those, which inherit it from their base.
How to write a search
- A package name, in any case.
*matches anything:libxml2*. - Then versions:
<,<=,>,>=,=, or!=and a version. A comma or space means "and",||means "or":openssl >=3.0,<3.0.15,deb:openssl <3.0.15,openssl <1.1.1w || >=3.0,<3.0.15. No versions means any version. - A type before the name, like
deb:,rpm:, orapk:, keeps to that kind of package. - Versions are ordered the way their ecosystem orders them: apk for Alpine and Wolfi, dpkg for Debian (where
~comes before a release), rpm, semver for Go, npm, and Cargo, and PEP 440 for Python. A version without an epoch or a revision ignores the package's:<2.14.0holds for2.13.9-r5and not for2.14.0-r1.