Bug Fixes extract the quality gate debug artifact outside the checkout [PR #3875 @wagoodman] incorrect constraint for versionless purls in openvex [PR #3874 @kzantow] report additional version-range records for a package [PR #3782 @jspilman] report a package's vulnerability as added or removed only when its affected record set changes [PR #3784 @jspilman] report the lowest overlapping AlmaLinux fi…
Added Features OS End of life warnings should account for SupportEnd date from the distro release information [Issue #3230] [PR #3787 @tomersein] Licensing: copyright owner missing, needed for Debian packaging [Issue #3501] [PR #3791 @wagoodman] Bug Fixes fix(db-build) allow configuring sqlite cache size at db build time [PR #3814 @willmurphyscode] Carry AlmaLinux fix dates onto replaced RHEL matc…
Bug Fixes run unit tests on windows and fix the handle leaks it surfaced [PR #3766 @wagoodman] Table presenter appends a spurious ", ..." to the FIX column when all fix versions are already shown [Issue #3760] [PR #3770 @arpitjain099] Dependencies 9 dependency changes (9 updated). Updated (9 packages) github.com/anchore/go-rpmdb v0.2.1 → v0.2.2 github.com/anchore/stereoscope v0.3.3 → v0.3.4 github…
Added Features Mark SLES as a comprehensive distro [PR #3732 @willmurphyscode] Store NVD SSVC decision points in a new v6 decorator table [PR #3725 @wagoodman] Adding Locations column to html template which help with triaging [PR #3092 @santrancisco] Bug Fixes sign release checksums with a sigstore bundle [PR #3759 @wagoodman] chainguard osv package ecosystem should be package type [PR #3758 @kzan…
Added Features Expose distro-fixed dropped matches via ignoredMatches so --show-suppressed can surface them [Issue #3450] [PR #3705 @philroche] Licensing: copyright owner missing, needed for Debian packaging [Issue #3501] Bug Fixes fixes typo in cpe example input for cpe-direct scan [PR #3679 @zhill] --by-cve: which advisory record survives the merge varies between runs [Issue #3630] Additional Ch…
Added Features apk matcher does alias aware aggregation [PR #3634 @crosleyzack] Bug Fixes prevent panic on portage versions without digits [PR #3655 @ashvinctrl] grype vex does not match oci purl with repository_url [Issue #3657] [PR #3659 @spiffcs] Old JVM version comparisons sometimes incorrect [Issue #2701] [PR #3583 @Eljees] CVSSv4 calculation can produce incorrect vulnerability severity [Issu…
Added Features Include vulnerable ranges in CycloneDX output format [Issue #3512] [PR #3519 @somaz94] Bug Fixes honor match.rust.using-cpes configuration [PR #3611 @Dashtid] Dependencies 11 dependency changes (11 updated). 2 vulnerabilities remediated. 🟢 Remediated (2) GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5 GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5 Updated (11 pa…
Bug Fixes Ensure channel parsing is consistent [PR #3603 @wagoodman] Scope Go GHSA twins by shared CVE [PR #3592 @wagoodman] do not cache a comparator that failed to build [PR #3567 @arpitjain099] Add fix date to rhel minor records created from rhsa [PR #3585 @wagoodman] grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #3591] panic: index out of range in distro.parseVe…
Added Features duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode] add chainguard osv transformer [PR #3474 @crosleyzack] populate package architecture for matching [PR #3504 @willmurphyscode] lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs] Deduplicate Go matches that are aliases of each other (same CVE reported und…
Added Features emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode] Merge Go vuln matches with GHSA matches [Issue #3515] Bug Fixes only emit records for stdlib [PR #3527 @willmurphyscode] mark hummingbird distro as rolling [PR #3521 @willmurphyscode] disable go stdlib CPE matching by default [PR #3517 @willmurphyscode] merge in custom ranges when applicable [PR #3514 @willmurphys…
Added Features Add ability to scan zarf packages [#3329 #3366 @brandtkeller] Additional Changes respect withdrawn status of Go Vuln DB OSV records [#3495 @willmurphyscode] Govulndb OSV transformer [#3485 @willmurphyscode] (Full Changelog)
Added Features Include Ubuntu 26.04 "resolute" in distro codenames [#3397 @anchore-oss-update-bot] source RPM filtering on Hummingbird [#3410 @willmurphyscode] Bug Fixes use relatedVulnerabilities description as fallback in SARIF output [#3271 @axidex] improve platform CPE determination logic [#3470 @westonsteimel] normalize uppercase V in semantic version comparison [#3461 @immanuwell] purl handl…
Added Features Expand ignore rules to owned sub packages of distro packages [#3368 #3326 @kzantow] Additional Changes update anchore dependencies [#3391 @anchore-oss-update-bot] (Full Changelog)
Bug Fixes apply overlap by ownership removal to dynamically created relationships [#3363 @kzantow] compare mismatched package / db versions [#3372 @kzantow] Grype doesn't recognize debian component when "group" : "debian" is specified [#2967] HelpURI missing information in SARIF output [#2874 #3351 @will-bates11] (Full Changelog)
Added Features db diff for v6 [#3277 @kzantow] add ProvideFromReader for in-memory SBOM processing [#3344 @jspilman] match on hummingbird [#3331 @willmurphyscode] CSAF vex transformer [#3349 @willmurphyscode] curated mapping of known CPE to grype package specifiers [#3332 @westonsteimel] templates/html.tmpl - Add Grype version and vulnerability DB version [#2877 #3345 @kenvez] Bug Fixes normalise…
Added Features suppress GHSA matches on language packages in fixed APKs [#3282 @willmurphyscode] Bug Fixes use Syft for decoding CPEs [#3058 @chovanecadam] Additional Changes bump github.com/buger/jsonparser to v1.1.2 [#3297 @willmurphyscode] update quality gate labels [#3293 @westonsteimel] (Full Changelog)
Bug Fixes CVE-2025-12183 is not detected even if vulnerable jar is present [#3205] Additional Changes migrate fixtures to testdata [#3263 @wagoodman] (Full Changelog)
Added Features Strip v prefix from apk versions [#3239 @wagoodman] Bug Fixes missing EPSS/KEV should not be fatal error [#3224 @willmurphyscode] Additional Changes update build flag to use provenance=false [#3243 @spiffcs] update to check-latest golang for ci [#3238 @spiffcs] enable fedora OS transformer [#3232 @willmurphyscode] Port grype-db lib to grype [#3149 @wagoodman] (Full Changelog)
Added Features enable disabling EOL warnings [#3204 @willmurphyscode] Bug Fixes fix fallback on major only distro [#3213 @willmurphyscode] VEX Documents still not working with syft sbom [#3167] VEX: minimal OpenVEX Example not working [#3212] Additional Changes support more accurate scanning for postmarketos [#3182 @westonsteimel] charmbracelet/bubbletea erases grype ui status line [#3214 @spiffcs…