diff --git a/_service b/_service
index 411e6e1..841cc24 100644
--- a/_service
+++ b/_service
@@ -3,7 +3,7 @@
     <param name="url">https://github.com/anchore/syft</param>
     <param name="scm">git</param>
     <param name="exclude">.git</param>
-    <param name="revision">v0.48.1</param>
+    <param name="revision">v0.49.0</param>
     <param name="versionformat">@PARENT_TAG@</param>
     <param name="changesgenerate">enable</param>
     <param name="versionrewrite-pattern">v(.*)</param>
@@ -16,6 +16,6 @@
     <param name="compression">gz</param>
   </service>
   <service name="go_modules" mode="disabled">
-    <param name="archive">syft-0.48.1.tar.gz</param>
+    <param name="archive">syft-0.49.0.tar.gz</param>
   </service>
 </services>
diff --git a/_servicedata b/_servicedata
index 8b2c517..87b47ec 100644
--- a/_servicedata
+++ b/_servicedata
@@ -1,4 +1,4 @@
 <servicedata>
 <service name="tar_scm">
                 <param name="url">https://github.com/anchore/syft</param>
-              <param name="changesrevision">03e37044d437294b0aac44a4e9277eb8f6c8be3f</param></service></servicedata>
\ No newline at end of file
+              <param name="changesrevision">d5e12ff89c2d3af684152dd401618533a6f1b67e</param></service></servicedata>
\ No newline at end of file
diff --git a/syft-0.48.1.tar.gz b/syft-0.48.1.tar.gz
deleted file mode 100644
index 80c1ad6..0000000
--- a/syft-0.48.1.tar.gz
+++ /dev/null
@@ -1,3 +0,0 @@
-version https://git-lfs.github.com/spec/v1
-oid sha256:741a2ef614a0c18a929d9f833974e3219250764f8e3e341d91ec12d4fc65b446
-size 3925051
diff --git a/syft-0.49.0.tar.gz b/syft-0.49.0.tar.gz
new file mode 100644
index 0000000..5603932
--- /dev/null
+++ b/syft-0.49.0.tar.gz
@@ -0,0 +1,3 @@
+version https://git-lfs.github.com/spec/v1
+oid sha256:6282483125ae32ff62a94f4848dbaadededdd3e04e7fa82d5ae4bbe3e685bb70
+size 3767025
diff --git a/syft.changes b/syft.changes
index ccbfc2b..0097f27 100644
--- a/syft.changes
+++ b/syft.changes
@@ -1,3 +1,14 @@
+-------------------------------------------------------------------
+Mon Jun 27 13:20:51 UTC 2022 - kastl@b1-systems.de
+
+- Update to version 0.49.0:
+  * Updates parsing of `yarn.lock` to use `resolved` URLs that are pulled from yarn and npm registries (#926)
+  * remove OSS Meetup message (#1057)
+  * add pom.xml cataloger (#1055)
+  * Add support for CBL-Mariner distroless images (#1045)
+  * Add catalogers configuration (#1038)
+  * add template output (#1051)
+
 -------------------------------------------------------------------
 Wed Jun 22 08:47:26 UTC 2022 - kastl@b1-systems.de
 
diff --git a/syft.spec b/syft.spec
index a716406..7a7bb68 100644
--- a/syft.spec
+++ b/syft.spec
@@ -19,7 +19,7 @@
 %define __arch_install_post export NO_BRP_STRIP_DEBUG=true
 
 Name:           syft
-Version:        0.48.1
+Version:        0.49.0
 Release:        0
 Summary:        CLI tool and library for generating a Software Bill of Materials
 License:        Apache-2.0
diff --git a/vendor.tar.gz b/vendor.tar.gz
index 03e3014..baf260b 100644
--- a/vendor.tar.gz
+++ b/vendor.tar.gz
@@ -1,3 +1,3 @@
 version https://git-lfs.github.com/spec/v1
-oid sha256:fe11a2c03b6710cabc156c3eb0bab757b07f131ebd0a3f95a14090492b0a58c3
-size 42549798
+oid sha256:bd79b628ddf56e878b943022dac3b51931588a4561459d983c17e52c722c3f86
+size 42640777