grype
A vulnerability scanner for container images and filesystems
APACHE-2.0 License
Bot releases are visible (Hide)
Published by github-actions[bot] about 1 year ago
v0.68.0 (2023-09-14)
Added Features
- Ignore/add match results based on OpenVEX documents [PR #1397] [puerco]
- Introduce exit code failure option for db update check [PR #1463] [devfbe]
Bug Fixes
- Fix race conditions around stager, enable detector [PR #1489] [willmurphyscode]
- Grype hangs forever if gets interrupted during work (in rare cases) [Issue #1427] [PR #1437] [kzantow]
Published by github-actions[bot] about 1 year ago
v0.66.0 (2023-08-31)
Added Features
- Allow for access to private CAs securely [Issue #1226] [PR #1232] [5p2O5pe25ouT]
- Filter out packages that are owned by OS packages (ownership overlap) [Issue #1373] [PR #1387] [willmurphyscode]
Bug Fixes
- fix: Only remove packages by binary overlap [PR #1444] [willmurphyscode]
- New version notice only showing the version and no text [PR #1445] [wagoodman]
- fix: set correct default to exclude overlapping binaries [PR #1452] [kzantow]
- Portage version comparison is not working [Issue #1459] [PR #1468] [barnuri]
Additional Changes
- Update Syft to 0.89.0
Published by github-actions[bot] about 1 year ago
v0.65.1 (2023-08-04)
Bug Fixes
- Grype cannot read SPDX documents generated by SPDX-maven-plugin [Issue #1306]
Published by github-actions[bot] about 1 year ago
Changelog
v0.65.0 (2023-07-31)
Added Features
- feat: implement secondary sorting for default json output [PR #1403] [spiffcs]
- Consistent sort order for grype output [Issue #709] [PR #1400] [spiffcs]
Bug Fixes
- Grype reading SPDX file with json output gets UnknownScheme error [Issue #948]
- grype 0.64.0 doesn't list vulnerabilties if
--fail-onfails [Issue #1392] [PR #1395] [willmurphyscode]
Additional Changes
- chore: bump quality gate label dataset [PR #1404] [westonsteimel]
Published by github-actions[bot] about 1 year ago
Changelog
v0.64.2 (2023-07-20)
Bug Fixes
- grype 0.64.0 doesn't list vulnerabilties if
--fail-onfails [Issue #1392] [PR #1395] [willmurphyscode]
Published by github-actions[bot] over 1 year ago
Changelog
v0.64.1 (2023-07-17)
Bug Fixes
- stop truncating template files Issue #1388 PR #1391 willmurphyscode
Additional Changes
Published by github-actions[bot] over 1 year ago
Changelog
v0.64.0 (2023-07-13)
Added Features
- You can now list multiple output formats and files to write to disk with one command, like Syft: "-o format1=file1 -o format1=file2" [Issue #648] [PR #1346] [olivierboudet]
Bug Fixes
- Correctly detect format of CycloneDX XML SBOM with no components [Issue #1005]
- Fix vulnerability summary counts to be less confusing. [Issue #1360]
Additional Changes
Published by github-actions[bot] over 1 year ago
Changelog
v0.63.0 (2023-06-21)
Added Features
- Always include the specific package name and version used in the vulnerability search in the matchDetails section of the output [PR #1339] [westonsteimel]
- Expose Go template file that produces the table report [Issue #629] [PR #1343] [jneate]
- Add a folder for community Go templates (see templates/README.md for more details) [Issue #1316]
Breaking Changes
- update Syft to v0.84.0: stereoscope platform fix and artifact ID padding [PR #1354] [anchore-actions-token-generator]
Published by github-actions[bot] over 1 year ago
Changelog
v0.62.3 (2023-06-05)
Bug Fixes
- Suppressed vulnerabilties are now correctly hidden, unless the --show-suppressed option is provided.
[Issue #1053] [Issue #1278] [PR #1322] [jamestran201]
Published by github-actions[bot] over 1 year ago
Published by github-actions[bot] over 1 year ago
Changelog
v0.62.0 (2023-05-22)
Added Features
- Add package qualifier for platform CPE [PR #1291] [westonsteimel]
- Include timestamp and image name in reports [Issue #1170] [PR #1249] [jneate]
- Document command line flag for config file location [Issue #1271] [PR #1274] [jneate]
- Add support for Mariner distribution [Issue #1220]
- Add support for Syft IDs in JSON output [PR #1266] [luhring]
Bug Fixes
- False positive with pkg:rpm PURLs [Issue #1031] [PR #1237] [Shanedell]
- Specifying "extras" in pip / requirements.txt results in false negative [Issue #1246]
- CycloneDX dependencies relationships inverted [Issue #1294]
Additional Changes
- docs: add "cyclonedx-json" to output formats [PR #1252] [HNKNTA]
- chore: update quality gate labels and add keycloak [PR #1255] [westonsteimel]
- Install skopeo during bootstrap [PR #1260] [willmurphyscode]
- Replace deprecated io/ioutil calls [PR #1296] [testwill]
- Fix reading syft json from stdin by redirect [PR #1299] [devfbe]
- Add gitignore for default build target [PR #1305] [testwill]
Published by github-actions[bot] over 1 year ago
Changelog
v0.61.1 (2023-04-21)
Bug Fixes
- ❔ Parsing dpkg status: extracting key-value from line: usr/lib/os-release err: cannot parse field [Issue #1195]
- Grype suggesting to upgrade to a version already used. [Issue #1209]
Additional Changes
Published by github-actions[bot] over 1 year ago
Changelog
v0.61.0 (2023-04-04)
Added Features
- feat: Add config option to prefer registry over local Docker when scanning an image [Issue #1204] [PR #1215] [spiffcs]
Additional Changes
Published by github-actions[bot] over 1 year ago
Changelog
v0.60.0 (2023-03-28)
Added Features
- feat: disable CPE-based matching by default for javascript [PR #1180] [westonsteimel]
Additional Changes
- Improve --by-cve report performance [Issue #1185] [PR #1188] [westonsteimel]
Published by github-actions[bot] over 1 year ago
Changelog
v0.59.1 (2023-03-09)
Bug Fixes
- fix: correct APK CPE version comparison logic [PR #1165] [westonsteimel]