grype
A vulnerability scanner for container images and filesystems
APACHE-2.0 License
Bot releases are visible (Hide)
Published by anchoreops over 2 years ago
Changelog
v0.43.0 (2022-07-18)
Added Features
- Remove matching for main go module matcher [PR #829]
- Add --only-notfixed to complete the existing and useful --only-fixed [Issue #824]
Bug Fixes
- Cannot concurrently access sqlite DB within a single process [Issue #155]
- False positive of CVE-2020-16250 and CVE-2020-16251 [Issue #712]
Published by anchoreops over 2 years ago
Changelog
v0.42.0 (2022-07-11)
Added Features
- Templates for grype output. HTML template [Issue #724]
- grype db diff command [Issue #764]
Bug Fixes
- panic: runtime error: index out of range [0] with length 0 [Issue #821]
Published by anchoreops over 2 years ago
Changelog
v0.41.0 (2022-07-06)
Features
- Upgrade to a new vulnerability database schema v4 [PR #803]
Bug Fixes
- Grype Busy Box Vulnerabilities resolved [Issue #510]
- Vulnerabilities now reported under php (composer) [Issue #797]
- Grype outputs listed properly [Issue #801]
- Grype db update command now shows spinner [Issue #805]
Published by anchoreops over 2 years ago
Changelog
v0.40.1 (2022-06-24)
Features
- update syft to v0.49.0 release
Bug Fixes
- grype fixed version cyclonedxjson [Issue #762]
- Include php in Grype supported languages [Issue #792]
Published by anchoreops over 2 years ago
Changelog
v0.40.0 (2022-06-17)
Added Features
- Be clear about version and data staleness [Issue #240]
- Add a dockerized workflow for local dev [Issue #782]
- Update grype documentation to include golang [Issue #787]
Bug Fixes
- "Matcher failed to parse version" when scanning a Ruby project using bundler 2.2.0 or newer [Issue #767]
- GHSA-x24g-9w7v-vprh included in grype 0.38.0 [Issue #779]
- Template pipelines don't seem to work in 0.39.0 [Issue #784]
Published by anchoreops over 2 years ago
Changelog
v0.39.0 (2022-06-09)
Features
- Support newer versions of 'rpm' that use Sqlite for the db instead of BerkeleyDB [Issue #469]
Bug Fixes
- Template errors don't lead to non-zero exit status [Issue #623]
- Issues with Grype's handling of template output for invalid templates [Issue #625]
- Grype reports some critical Vault CVE on itself [Issue #676]
Published by anchoreops over 2 years ago
Published by anchoreops over 2 years ago
Changelog
v0.37.0 (2022-05-13)
Added Features
- Add Dotnet support [PR #747] [ckotzbauer]
Security Fixes
- Bump github.com/hashicorp/go-getter from 1.5.9 to 1.5.11 [PR #742] [dependabot]
Bug Fixes
- Unable to determine the OS distribution (Ubuntu 20.04.4 LTS) [Issue #684]
Published by anchoreops over 2 years ago
Changelog
v0.36.0 (2022-04-29)
Added Features
- Add support for cyclonedx 1.4 and VEX [Issue #591]
- Read attestation file, validate attestation, produce vulnerability report [Issue #644]
Bug Fixes
- Panic while running scan on directory [Issue #715]
Published by anchoreops over 2 years ago
Changelog
v0.35.0 (2022-04-13)
Added Features
- Indicate location of vulnerability [Issue #561]
- Optional External Data Source Reference for Maven Packages [Issue #711]
Bug Fixes
- False positive (critical) on GHSA-8v27-2fg9-7h62 [Issue #632]
- False Positive on CVE-2020-36518 [Issue #692]
- Matches should be sorted by package name for template output [Issue #696]
- panic: runtime error: invalid memory address or nil pointer dereference [Issue #702]
Published by anchoreops over 2 years ago
Changelog
v0.34.4 (2022-03-21)
Bug Fixes
- Correct issue with SARIF dir scan relative paths [Issue #682] [kzantow]
- Update Syft lib to 0.42.1 [Issue #683]
Published by anchoreops over 2 years ago
Changelog
v0.34.3 (2022-03-16)
Bug Fixes
- Panic: runtime error - when utilizing the vulnerability scanner on an cyclonedx sbom file input [Issue #669] [kzantow]
Published by anchoreops over 2 years ago
Changelog
v0.34.1 (2022-03-15)
Added Features
- Add platform selection [PR #666] [wagoodman]
- Add SARIF report output [Issue #304] [kzantow]
- Support CycloneDX as SBOM input to grype [Issue #481] [kzantow]
Bug Fixes
- Issue in Installation. err: anchore/grype err hash_sha256_verify unable to find checksum [Issue #577] [spiffcs]
Published by anchoreops over 2 years ago
Changelog
v0.33.0 (2022-02-15)
Added Features
- Add ability to merge matches [PR #602] [wagoodman]
- Allow for ingestion of SPDX SBOM documents as input [Issue #395]
Bug Fixes
- Grype stuck on some images [Issue #549]
Published by anchoreops over 2 years ago
Changelog
v0.32.0 (2022-01-20)
Features
- Upgrade Grype to latest version of syft. See full release for details.
Bug Fixes
- Error scanning SBOM from file: unsupported package metadata type: file [Issue #592]
Docker images
docker pull anchore/grype:v0.32.0
Published by anchoreops almost 3 years ago
Changelog
v0.31.1 (2022-01-11)
Added Features
- Update Containerd dependency to fix GHSA-mvff-h3cj-wj9c
Bug Fixes
- Grype installation contains vulnerability GHSA-mvff-h3cj-wj9c [Issue #583]
Docker images
docker pull anchore/grype:v0.31.1