Grype: baixar versions anteriors

Added Features
- OS End of life warnings should account for SupportEnd date from the distro release information [Issue #3230] [PR #3787 @tomersein]
- Licensing: copyright owner missing, needed for Debian packaging [Issue #3501] [PR #3791 @wagoodman]

Bug Fixes
- fix(db-build) allow configuring sqlite cache size at db build time [PR #3814 @willmurphyscode]
- Carry AlmaLinux fix dates onto replaced RHEL matches [PR #3773 @wagoodman]
- carry fix availability through extended support fix merging [PR #3809 @bot190]
- upgrade to golang.org/x/net v0.61.0 [PR #3802 @westonsteimel]
- Swift Package Manager packages miss GitHub Swift advisories (searched by identity, not repository path) [Issue #3795] [PR #3713 @az-catch]

Additional Changes
- bump go-make module and action together [PR #3793 @wagoodman]

Dependencies
50 dependency changes (47 updated, 1 added, 2 removed). 5 vulnerabilities remediated.
🟢 Remediated (5)
- GO-2026-6603 (High) — golang.org/x/net
- GO-2026-6610 (High) — golang.org/x/net
- GO-2026-6611 (High) — golang.org/x/net
- GO-2026-6612 (Critical) — golang.org/x/net
- GO-2026-6617 (High) — golang.org/x/net
Updated (47 packages)
- cloud.google.com/go/auth v0.23.2 → v0.23.3
- cloud.google.com/go/compute/metadata v0.9.0 → v0.9.1
- cloud.google.com/go/storage v1.65.1 → v1.68.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.33.0 → v1.34.0
- github.com/anchore/syft v1.54.1 → v1.55.0
- github.com/aws/aws-sdk-go-v2 v1.44.0 → v1.47.1
- github.com/aws/aws-sdk-go-v2/config v1.32.40 → v1.33.6
- github.com/aws/aws-sdk-go-v2/credentials v1.19.39 → v1.20.6
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.40 → v1.20.1
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.40 → v1.5.4
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.40 → v2.8.4
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.41 → v1.5.4
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.10.0 → v1.11.5
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.40 → v1.14.4
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.41 → v1.20.4
- github.com/aws/aws-sdk-go-v2/service/s3 v1.108.0 → v1.114.0
- github.com/aws/aws-sdk-go-v2/service/signin v1.6.0 → v1.10.1
- github.com/aws/aws-sdk-go-v2/service/sso v1.34.0 → v1.38.1
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.39.0 → v1.43.1
- github.com/aws/aws-sdk-go-v2/service/sts v1.46.0 → v1.51.1
- github.com/github/go-spdx/v2 v2.7.0 → v2.7.1
- github.com/go-git/go-billy/v5 v5.9.1 → v5.9.2
- github.com/go-git/go-git/v5 v5.19.2 → v5.19.3
- github.com/google/s2a-go v0.1.9 → v0.1.10
- github.com/googleapis/enterprise-certificate-proxy v0.3.20 → v0.3.22
- github.com/googleapis/gax-go/v2 v2.24.0 → v2.24.1
- github.com/gookit/color v1.6.1 → v1.6.2
- github.com/gpustack/gguf-parser-go v0.26.3 → v0.26.4
- github.com/hashicorp/go-getter v1.8.9 → v1.8.10
- github.com/pb33f/ordered-map/v2 v2.3.1 → v2.3.2
- github.com/pjbgf/sha1cd v0.6.0 → v0.7.0
- github.com/spiffe/go-spiffe/v2 v2.7.0 → v2.8.1
- golang.org/x/crypto v0.57.0 → v0.58.0
- golang.org/x/net v0.59.0 → v0.61.0 (🟢 remediated GO-2026-6603, GO-2026-6610, GO-2026-6611, GO-2026-6612, GO-2026-6617)
- golang.org/x/oauth2 v0.36.0 → v0.37.0
- golang.org/x/sync v0.23.0 → v0.24.0
- golang.org/x/sys v0.48.0 → v0.49.0
- golang.org/x/term v0.46.0 → v0.47.0
- golang.org/x/text v0.42.0 → v0.43.0
- golang.org/x/tools v0.50.0 → v0.51.0
- google.golang.org/api v0.294.0 → v0.299.0
- google.golang.org/genproto/googleapis/rpc v0.0.0-da73d73 → v0.0.0-b142276
- google.golang.org/grpc v1.83.2 → v1.84.0
- modernc.org/cc/v4 v4.29.2 → v4.29.7
- modernc.org/ccgo/v4 v4.35.0 → v4.36.1
- modernc.org/libc v1.75.7 → v1.77.1
- modernc.org/sqlite v1.59.0 → v1.60.1
Added (1 package)
- github.com/pb33f/go-yaml v0.1.0
Removed (2 packages)
- github.com/klauspost/cpuid/v2 v2.3.0
- go.yaml.in/yaml/v4 v4.0.0-rc.2
(Full Changelog)

Bug Fixes
- run unit tests on windows and fix the handle leaks it surfaced [PR #3766 @wagoodman]
- Table presenter appends a spurious ", ..." to the FIX column when all fix versions are already shown [Issue #3760] [PR #3770 @arpitjain099]

Dependencies
9 dependency changes (9 updated).
Updated (9 packages)
- github.com/anchore/go-rpmdb v0.2.1 → v0.2.2
- github.com/anchore/stereoscope v0.3.3 → v0.3.4
- github.com/anchore/syft v1.54.0 → v1.54.1
- github.com/docker/cli v29.8.1+incompatible → v29.8.2+incompatible
- github.com/klauspost/compress v1.20.0 → v1.20.1
- github.com/secure-systems-lab/go-securesystemslib v0.11.0 → v0.11.1
- github.com/sigstore/protobuf-specs v0.5.1 → v0.5.2
- github.com/sigstore/sigstore v1.10.8 → v1.10.11
- github.com/sylabs/sif/v2 v2.24.1 → v2.24.2
(Full Changelog)

Added Features
- Mark SLES as a comprehensive distro [PR #3732 @willmurphyscode]
- Store NVD SSVC decision points in a new v6 decorator table [PR #3725 @wagoodman]
- Adding Locations column to html template which help with triaging [PR #3092 @santrancisco]

Bug Fixes
- sign release checksums with a sigstore bundle [PR #3759 @wagoodman]
- chainguard osv package ecosystem should be package type [PR #3758 @kzantow]
- include qualifiers for unaffected packages [PR #3734 @kzantow]
- render TUI log lines on their own rows, with colors and a small header [PR #3735 @wagoodman]
- match.dpkg.using-cpes (and match.rpm.using-cpes) is accepted but has no effect [Issue #3746] [PR #3747 @amitschendel]
- embedded spaces in bin location breaks install.sh [Issue #2809] [PR #3738 @bIackr0se]
- False positives: --add-cpes-if-none maps tomcat-embed-el to apache:tomcat CPE [Issue #3730]
- match.rpm.using-cpes has no effect [Issue #3752] [PR #3753 @amitschendel]
- Import metadata digest is not in the expected format [Issue #3388]
- Issue Pulling DB update [Issue #3586]

Dependencies
88 dependency changes (59 updated, 27 added, 2 removed). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/sdk
- GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2
Toolchains (1)
- Go minimum version: 1.26.3 → 1.26.8
Updated (59 packages)
- github.com/Microsoft/hcsshim v0.15.0-rc.1 → v0.15.0-rc.4
- github.com/anchore/bubbly v0.2.1 → v0.2.2
- github.com/anchore/go-logger v0.1.1 → v0.2.0
- github.com/anchore/go-rpmdb v0.2.0 → v0.2.1
- github.com/anchore/stereoscope v0.3.2 → v0.3.3
- github.com/anchore/syft v1.52.0 → v1.54.0
- github.com/bmatcuk/doublestar/v4 v4.10.0 → v4.10.2
- github.com/containerd/containerd/api v1.11.1 → v1.12.0
- github.com/containerd/containerd/v2 v2.3.5 → v2.4.1 (🟢 remediated GHSA-pg57-6jwg-q645)
- github.com/containerd/log v0.1.0 → v0.2.0
- github.com/containerd/ttrpc v1.2.8 → v1.2.9
- github.com/containerd/typeurl/v2 v2.2.3 → v2.3.0
- github.com/cyphar/filepath-securejoin v0.6.1 → v0.7.0
- github.com/docker/cli v29.8.0+incompatible → v29.8.1+incompatible
- github.com/docker/docker-credential-helpers v0.9.5 → v0.9.8
- github.com/dustin/go-humanize v1.0.1 → v1.1.0
- github.com/erofs/go-erofs v0.3.0 → v0.3.1
- github.com/felixge/httpsnoop v1.0.4 → v1.1.0
- github.com/fsnotify/fsnotify v1.9.0 → v1.10.1
- github.com/glebarez/go-sqlite v1.22.0 → v1.23.0
- github.com/go-jose/go-jose/v4 v4.1.4 → v4.1.5
- github.com/go-logr/logr v1.4.3 → v1.4.4
- github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 → v2.30.0
- github.com/hashicorp/hcl/v2 v2.24.0 → v2.25.0
- github.com/magiconair/properties v1.18.11 → v1.18.12
- github.com/mattn/go-runewidth v0.0.21 → v0.0.27
- github.com/mattn/go-sqlite3 v1.14.23 → v1.14.48
- github.com/moby/sys/user v0.4.0 → v0.4.1
- github.com/moby/sys/userns v0.1.0 → v0.2.1
- github.com/nwaples/rardecode/v2 v2.2.0 → v2.4.1
- github.com/olekukonko/tablewriter v1.1.4 → v1.1.5
- github.com/openvex/go-vex v0.2.8 → v0.2.9
- github.com/package-url/packageurl-go v0.1.5 → v0.1.7
- github.com/sirupsen/logrus v1.9.4 → v1.10.2
- github.com/ulikunitz/xz v0.5.16 → v0.5.17
- github.com/zclconf/go-cty v1.16.3 → v1.19.0
- go.etcd.io/bbolt v1.4.3 → v1.5.0
- go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.68.0 → v0.71.0
- go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 → v0.71.0
- go.opentelemetry.io/otel v1.44.0 → v1.46.0
- go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 → v1.46.0 (🟢 remediated GHSA-8wmf-6v46-5gfg)
- go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 → v1.46.0 (🟢 remediated GHSA-8wmf-6v46-5gfg)
- go.opentelemetry.io/otel/metric v1.44.0 → v1.46.0
- go.opentelemetry.io/otel/metric/x v0.66.0 → v0.68.0
- go.opentelemetry.io/otel/sdk v1.44.0 → v1.46.0 (🟢 remediated GHSA-8wmf-6v

Added Features
- Expose distro-fixed dropped matches via ignoredMatches so --show-suppressed can surface them [Issue #3450] [PR #3705 @philroche]
- Licensing: copyright owner missing, needed for Debian packaging [Issue #3501]

Bug Fixes
- fixes typo in cpe example input for cpe-direct scan [PR #3679 @zhill]
- --by-cve: which advisory record survives the merge varies between runs [Issue #3630]

Additional Changes
- OpenVEX transformer drops the namespace from Go module PURLs [Issue #3680] [PR #3683 @arpitjain099]
- Docs missing for include-aliases [Issue #3663] [PR #3671 @dev-rehaann]

Dependencies
54 dependency changes (54 updated). 6 vulnerabilities remediated.
🟢 Remediated (6)
- GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc
- GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2
- GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc
- GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc
- GO-2026-6354 (High) — golang.org/x/crypto
- GO-2026-6355 (High) — golang.org/x/crypto
Updated (54 packages)
- cloud.google.com/go/auth v0.22.0 → v0.23.2
- cloud.google.com/go/iam v1.11.0 → v1.12.0
- cloud.google.com/go/logging v1.18.0 → v1.19.0
- cloud.google.com/go/monitoring v1.29.0 → v1.30.0
- cloud.google.com/go/storage v1.64.0 → v1.65.1
- github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0
- github.com/anchore/go-sync v0.1.1 → v0.1.2
- github.com/anchore/stereoscope v0.3.1 → v0.3.2
- github.com/anchore/syft v1.51.1 → v1.52.0
- github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20
- github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40
- github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41
- github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0
- github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0
- github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0
- github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0
- github.com/aws/smithy-go v1.27.6 → v1.28.1
- github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv)
- github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible
- github.com/google/go-containerregistry v0.21.9 → v0.22.1
- github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20
- github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0
- github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3
- github.com/hashicorp/go-getter v1.8.8 → v1.8.9
- github.com/klauspost/compress v1.19.2 → v1.20.0
- github.com/moby/moby/api v1.55.0 → v1.56.0
- github.com/moby/moby/client v0.5.1 → v0.6.0
- github.com/pandatix/go-cvss v0.6.2 → v0.6.4
- github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8
- golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355)
- golang.org/x/mod v0.40.0 → v0.41.0
- golang.org/x/time v0.15.0 → v0.16.0
- google.golang.org/api v0.292.0 → v0.294.0
- google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1
- google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1
- google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42
- google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc)
- google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12
- modernc.org/cc/v4 v4.29.1 → v4.29.2
- modernc.org/ccgo/v4 v4.

Added Features
- apk matcher does alias aware aggregation [PR #3634 @crosleyzack]

Bug Fixes
- prevent panic on portage versions without digits [PR #3655 @ashvinctrl]
- grype vex does not match oci purl with repository_url [Issue #3657] [PR #3659 @spiffcs]
- Old JVM version comparisons sometimes incorrect [Issue #2701] [PR #3583 @Eljees]
- CVSSv4 calculation can produce incorrect vulnerability severity [Issue #3656]
- Grype 0.90.0 DB update failed [Issue #3629]

Dependencies
72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.
🟢 Remediated (3)
- GO-2026-5158 (Medium) — go.opentelemetry.io/otel
- GO-2026-6179 (High) — golang.org/x/mod
- GO-2026-6180 (High) — golang.org/x/mod
Updated (70 packages)
- cel.dev/expr v0.25.1 → v0.25.2
- cloud.google.com/go/auth v0.18.2 → v0.22.0
- cloud.google.com/go/iam v1.5.3 → v1.11.0
- cloud.google.com/go/logging v1.13.1 → v1.18.0
- cloud.google.com/go/longrunning v0.8.0 → v1.2.0
- cloud.google.com/go/monitoring v1.24.3 → v1.29.0
- cloud.google.com/go/storage v1.61.3 → v1.64.0
- cloud.google.com/go/trace v1.11.7 → v1.16.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.32.0 → v1.33.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.55.0 → v0.57.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock v0.55.0 → v0.57.0
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.55.0 → v0.57.0
- github.com/anchore/stereoscope v0.3.0 → v0.3.1
- github.com/anchore/syft v1.51.0 → v1.51.1
- github.com/aws/aws-sdk-go-v2 v1.41.5 → v1.43.4
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.8 → v1.7.16
- github.com/aws/aws-sdk-go-v2/config v1.32.12 → v1.32.35
- github.com/aws/aws-sdk-go-v2/credentials v1.19.12 → v1.19.34
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.20 → v1.18.35
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.21 → v1.4.35
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.21 → v2.7.35
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.22 → v1.4.36
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.7 → v1.13.15
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.13 → v1.9.28
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.21 → v1.13.35
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.21 → v1.19.36
- github.com/aws/aws-sdk-go-v2/service/s3 v1.97.3 → v1.106.5
- github.com/aws/aws-sdk-go-v2/service/signin v1.0.8 → v1.5.4
- github.com/aws/aws-sdk-go-v2/service/sso v1.30.13 → v1.33.4
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.35.17 → v1.38.4
- github.com/aws/aws-sdk-go-v2/service/sts v1.41.9 → v1.45.4
- github.com/aws/smithy-go v1.24.2 → v1.27.6
- github.com/containerd/containerd/v2 v2.3.3 → v2.3.4
- github.com/containerd/platforms v1.0.0-rc.4 → v1.0.0-rc.5
- github.com/docker/cli v29.6.1+incompatible → v29.7.2+incompatible
- github.com/docker/go-connections v0.7.0 → v0.8.1
- github.com/fatih/color v1.18.0 → v1.19.0
- github.com/google/go-containerregistry v0.21.7 → v0.21.9
- github.com/google/pprof v0.0.0-6e76a2b → v0.0.0-ef3492d
- github.com/googleapis/enterprise-certificate-proxy v0.3.14 → v0.3.19
- github.com/googleapis/gax-go/v2 v2.17.0 → v2.23.0
- github.com/hashicorp/aws-sdk-go-base/v2 v2.0.0-beta.72 → v2.0.0-beta.74
- github.com/hashicorp/go-getter v1.8.6 → v1.8.8
- github.com/hashicorp/go-version v1.8.0 → v1.9.0
- github.com/klauspost/compress v1.19.1 → v1.19.2
- github.com/mattn/go-isatty v0.0.20 → v0.0.24
- github.com/moby/moby/client v0.5.0 → v0.5.1
- github.com/spiffe/go-spiffe/v2 v2.6.0 → v2.7.0
- github.com/stretchr/objx v0.5.2 → v0.5.3
- github.com/stretchr/testify v1.11.1 → v1.12.1
- go.opentelemetry.io/contrib/detectors/gcp v1.43.0 → v1.44.0
- go.opentelemetry.io/otel v1.43.0 → v1.44.0 (🟢 remediated GO-2026-5158)
- go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.40.0 → v1.44.0
- go.opentelemetry.io/otel/metric v1.43.0

Added Features
- Include vulnerable ranges in CycloneDX output format [Issue #3512] [PR #3519 @somaz94]

Bug Fixes
- honor match.rust.using-cpes configuration [PR #3611 @Dashtid]

Dependencies
11 dependency changes (11 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
- GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5
Updated (11 packages)
- github.com/anchore/syft v1.50.0 → v1.51.0
- github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
- github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15
- github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
- github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j)
- github.com/klauspost/compress v1.19.0 → v1.19.1
- github.com/magiconair/properties v1.8.10 → v1.18.11
- github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3
- github.com/ulikunitz/xz v0.5.15 → v0.5.16
- go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
- modernc.org/sqlite v1.54.0 → v1.55.0
(Full Changelog)

Bug Fixes
- Ensure channel parsing is consistent [PR #3603 @wagoodman]
- Scope Go GHSA twins by shared CVE [PR #3592 @wagoodman]
- do not cache a comparator that failed to build [PR #3567 @arpitjain099]
- Add fix date to rhel minor records created from rhsa [PR #3585 @wagoodman]
- grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #3591]
- panic: index out of range in distro.parseVersion for VERSION_ID=v [Issue #3588] [PR #3589 @matiasinsaurralde]
- False Positive: GO-2026-5932 [Issue #3573]

Dependencies
30 dependency changes (30 updated). 1 vulnerability remediated.
🟢 Remediated (1)
- GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc
Updated (30 packages)
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.31.0 → v1.32.0
- github.com/anchore/stereoscope v0.2.2 → v0.3.0
- github.com/anchore/syft v1.48.0 → v1.50.0
- github.com/cncf/xds/go v0.0.0-ee656c7 → v0.0.0-dba9d58
- github.com/containerd/containerd/v2 v2.3.2 → v2.3.3
- github.com/docker/cli v29.5.3+incompatible → v29.6.1+incompatible
- github.com/envoyproxy/go-control-plane/envoy v1.36.0 → v1.37.0
- github.com/envoyproxy/protoc-gen-validate v1.3.0 → v1.3.3
- github.com/gkampitakis/go-snaps v0.5.22 → v0.5.23
- github.com/gpustack/gguf-parser-go v0.24.1 → v0.25.0
- github.com/moby/moby/api v1.54.2 → v1.55.0
- github.com/moby/moby/client v0.4.1 → v0.5.0
- github.com/pelletier/go-toml/v2 v2.3.1 → v2.4.3
- go.opentelemetry.io/contrib/detectors/gcp v1.39.0 → v1.43.0
- golang.org/x/crypto v0.53.0 → v0.54.0
- golang.org/x/mod v0.37.0 → v0.38.0
- golang.org/x/net v0.56.0 → v0.57.0
- golang.org/x/sync v0.21.0 → v0.22.0
- golang.org/x/sys v0.46.0 → v0.47.0
- golang.org/x/term v0.44.0 → v0.45.0
- golang.org/x/text v0.39.0 → v0.40.0
- golang.org/x/tools v0.47.0 → v0.48.0
- google.golang.org/genproto/googleapis/api v0.0.0-9d38bb4 → v0.0.0-afd174a
- google.golang.org/genproto/googleapis/rpc v0.0.0-6f92a3b → v0.0.0-afd174a
- google.golang.org/grpc v1.80.0 → v1.82.1 (🟢 remediated GHSA-hrxh-6v49-42gf)
- modernc.org/cc/v4 v4.28.4 → v4.29.0
- modernc.org/ccgo/v4 v4.34.4 → v4.34.6
- modernc.org/gc/v3 v3.1.3 → v3.1.4
- modernc.org/libc v1.73.4 → v1.74.1
- modernc.org/sqlite v1.53.0 → v1.54.0
(Full Changelog)

Added Features
- duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode]
- add chainguard osv transformer [PR #3474 @crosleyzack]
- populate package architecture for matching [PR #3504 @willmurphyscode]
- lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs]
- Deduplicate Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA) [Issue #3511] [PR #3509 @spiffcs]
- Support Ubuntu ESM [Issue #3544] [PR #3546 @wagoodman]

Bug Fixes
- regenerate v6.1.8 blob and sql schemas [PR #3574 @spiffcs]
- rhel version streams [PR #3572 @kzantow]
- Grype doesn't match u-boot in SBOM if type is set to firmware [Issue #2537]
- Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go [Issue #1782]
- Zarf scans emit warnings for consistently unreadable files (i.e., included non-SBOMs) [Issue #3516] [PR #3545 @brandtkeller]
- Fail parsing github actions [Issue #3220]
- Go vulnerability returned when installed version is greater than fixed version [Issue #3520]

Dependencies
14 dependency changes (11 updated, 3 added).
Updated (11 packages)
- github.com/anchore/go-rpmdb v0.1.0 → v0.2.0
- github.com/anchore/syft v1.46.0 → v1.48.0
- github.com/klauspost/compress v1.18.6 → v1.19.0
- golang.org/x/text v0.38.0 → v0.39.0
- golang.org/x/tools v0.46.0 → v0.47.0
- gorm.io/gorm v1.31.1 → v1.31.2
- modernc.org/cc/v4 v4.28.2 → v4.28.4
- modernc.org/ccgo/v4 v4.34.0 → v4.34.4
- modernc.org/gc/v3 v3.1.2 → v3.1.3
- modernc.org/libc v1.72.3 → v1.73.4
- modernc.org/sqlite v1.51.0 → v1.53.0
Added (3 packages)
- github.com/mattn/go-sqlite3 v1.14.23
- gorm.io/driver/sqlite v1.6.0
- howett.net/plist v1.0.1
(Full Changelog)

Added Features
- emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode]
- Merge Go vuln matches with GHSA matches [Issue #3515]

Bug Fixes
- only emit records for stdlib [PR #3527 @willmurphyscode]
- mark hummingbird distro as rolling [PR #3521 @willmurphyscode]
- disable go stdlib CPE matching by default [PR #3517 @willmurphyscode]
- merge in custom ranges when applicable [PR #3514 @willmurphyscode]
- exclude linux-kbuild deb indirect matches by default [PR #3506 @westonsteimel]
- avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
- Support reading CycloneDX 1.7 SBOMs [Issue #3373]
- Grype cannot read mariadb version correctly [Issue #3452]
- grype hangs when downloading certain images using registry client [Issue #3492]
- Can we get a fix for these Critical findings reported for grype [Issue #3484]

Additional Changes
- Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #3493]
- Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #3494]

Dependencies
35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.
🟢 Remediated (5)
- GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
- GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
- GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
- GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
- GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2
Updated (31 packages)
- github.com/ProtonMail/go-crypto v1.4.0 → v1.4.1
- github.com/anchore/bubbly v0.2.0 → v0.2.1
- github.com/anchore/clio v0.1.0 → v0.1.1
- github.com/anchore/fangs v0.1.0 → v0.1.1
- github.com/anchore/go-collections v0.1.0 → v0.1.1
- github.com/anchore/go-homedir v0.1.0 → v0.1.1
- github.com/anchore/go-logger v0.1.0 → v0.1.1
- github.com/anchore/go-lzo v0.1.0 → v0.1.1
- github.com/anchore/go-macholibre v0.1.0 → v0.1.1
- github.com/anchore/go-make v0.5.0 → v0.8.0
- github.com/anchore/go-struct-converter v0.1.0 → v0.2.0-rc2
- github.com/anchore/go-sync v0.1.0 → v0.1.1
- github.com/anchore/stereoscope v0.2.1 → v0.2.2
- github.com/anchore/syft v1.45.1 → v1.46.0
- github.com/charmbracelet/colorprofile v0.4.1 → v0.4.3
- github.com/clipperhouse/displaywidth v0.10.0 → v0.11.0
- github.com/clipperhouse/uax29/v2 v2.6.0 → v2.7.0
- github.com/containerd/containerd/v2 v2.3.1 → v2.3.2 (🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp)
- github.com/docker/cli v29.4.3+incompatible → v29.5.3+incompatible
- github.com/google/go-containerregistry v0.21.6 → v0.21.7
- github.com/mattn/go-runewidth v0.0.19 → v0.0.21
- github.com/spdx/tools-golang v0.5.7 → v0.6.0-rc4
- github.com/sylabs/sif/v2 v2.24.0 → v2.24.1
- golang.org/x/crypto v0.52.0 → v0.53.0
- golang.org/x/mod v0.36.0 → v0.37.0
- golang.org/x/net v0.55.0 → v0.56.0
- golang.org/x/sync v0.20.0 → v0.21.0
- golang.org/x/sys v0.45.0 → v0.46.0
- golang.org/x/term v0.43.0 → v0.44.0
- golang.org/x/text v0.37.0 → v0.38.0
- golang.org/x/tools v0.45.0 → v0.46.0
Added (3 packages)
- github.com/piprate/json-gold v0.7.0
- github.com/pquerna/cachecontrol v0.0.0-1555304
- github.com/tailscale/hujson v0.0.0-ecc657c
Removed (1 package)
- github.com/google/osv-scanner v1.9.2
(Full Changelog)

Added Features
- Add ability to scan zarf packages [#3329 #3366 @brandtkeller]

Additional Changes
- respect withdrawn status of Go Vuln DB OSV records [#3495 @willmurphyscode]
- Govulndb OSV transformer [#3485 @willmurphyscode]
(Full Changelog)

Added Features
- Include Ubuntu 26.04 "resolute" in distro codenames [#3397 @anchore-oss-update-bot]
- source RPM filtering on Hummingbird [#3410 @willmurphyscode]

Bug Fixes
- use relatedVulnerabilities description as fallback in SARIF output [#3271 @axidex]
- improve platform CPE determination logic [#3470 @westonsteimel]
- normalize uppercase V in semantic version comparison [#3461 @immanuwell]
- purl handling in cgr maven libs [#3420 @willmurphyscode]
- Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#3037 #3089 @wasup-yash]
- Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#3101 #3396 @Dashtid]
- Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#3442 #3475 @msnandhis]
- zsh completion fails [#2933 #3433 @brandtkeller]
(Full Changelog)

Added Features
- Expand ignore rules to owned sub packages of distro packages [#3368 #3326 @kzantow]

Additional Changes
- update anchore dependencies [#3391 @anchore-oss-update-bot]
(Full Changelog)

Bug Fixes
- apply overlap by ownership removal to dynamically created relationships [#3363 @kzantow]
- compare mismatched package / db versions [#3372 @kzantow]
- Grype doesn't recognize debian component when "group" : "debian" is specified [#2967]
- HelpURI missing information in SARIF output [#2874 #3351 @will-bates11]
(Full Changelog)

Added Features
- db diff for v6 [#3277 @kzantow]
- add ProvideFromReader for in-memory SBOM processing [#3344 @jspilman]
- match on hummingbird [#3331 @willmurphyscode]
- CSAF vex transformer [#3349 @willmurphyscode]
- curated mapping of known CPE to grype package specifiers [#3332 @westonsteimel]
- templates/html.tmpl - Add Grype version and vulnerability DB version [#2877 #3345 @kenvez]

Bug Fixes
- normalise version constraint types in v6 db [#3328 @westonsteimel]
- set alpm ecosystem for Arch Linux packages [#3324 @westonsteimel]
- spec-compliant CPE string formatting for db search commands [#3308 @westonsteimel]
- Update APK NAK handling to be based on ownership-by-file-overlap relationship [#3267 #3286 @kzantow]
- Wrong version output [#3306]

Additional Changes
- update anchore dependencies [#3321 @anchore-oss-update-bot]
- update tool versions [#3319 @anchore-oss-update-bot]
(Full Changelog)

Added Features
- suppress GHSA matches on language packages in fixed APKs [#3282 @willmurphyscode]

Bug Fixes
- use Syft for decoding CPEs [#3058 @chovanecadam]

Additional Changes
- bump github.com/buger/jsonparser to v1.1.2 [#3297 @willmurphyscode]
- update quality gate labels [#3293 @westonsteimel]

(Full Changelog)

Bug Fixes
- CVE-2025-12183 is not detected even if vulnerable jar is present [#3205]
Additional Changes
- migrate fixtures to testdata [#3263 @wagoodman]
(Full Changelog)

Added Features
- Strip v prefix from apk versions [#3239 @wagoodman]
Bug Fixes
- missing EPSS/KEV should not be fatal error [#3224 @willmurphyscode]
Additional Changes
- update build flag to use provenance=false [#3243 @spiffcs]
- update to check-latest golang for ci [#3238 @spiffcs]
- enable fedora OS transformer [#3232 @willmurphyscode]
- Port grype-db lib to grype [#3149 @wagoodman]
(Full Changelog)

Added Features
- enable disabling EOL warnings [#3204 @willmurphyscode]
Bug Fixes
- fix fallback on major only distro [#3213 @willmurphyscode]
- VEX Documents still not working with syft sbom [#3167]
- VEX: minimal OpenVEX Example not working [#3212]
Additional Changes
- support more accurate scanning for postmarketos [#3182 @westonsteimel]
- charmbracelet/bubbletea erases grype ui status line [#3214 @spiffcs]
- bump labels and add several test images [#3215 @westonsteimel]
- improve VEX product and subcomponent matching [#3168 @dariozachow]
(Full Changelog)

Additional Changes
- support context cancellation while finding vuln matches [#3200 @luhring]
(Full Changelog)

Added Features
- Add secureos distro [#3086 @divolgin]
- add hex matcher for Erlang/Elixir ecosystem [#3194 @willmurphyscode]
Bug Fixes
- disable version fallback in EOL query [#3195 @willmurphyscode]
- VEX documents with docker.io registry reference not matching, require index.docker.io instead [#2818 #3172 @jainlakshya]
(Full Changelog)

Added Features
- warn about packages from EOL distros [#3171 @willmurphyscode]
- make it configurable what grype assumes when incoming package to grype is missing dpkg/RPM epoch [#2964 #2976 @willmurphyscode]
Bug Fixes
- RHEL EUS: --only-fixed should filter out matches are not fixed in the current EUS version [#2847 #3181 @willmurphyscode]
Additional Changes
- support scientific linux [#3175 @westonsteimel]
(Full Changelog)

Added Features
- Add archlinux matcher to grype [#3154 @willmurphyscode]
(Full Changelog)

Bug Fixes
- preserve local version segment in constraints for PEP 440 comparison [#3146 @willmurphyscode]
Additional Changes
- correct help text for return code for fail-on severity option [#3138 @u-ways]
(Full Changelog)

Bug Fixes
- Use specifier matching rules when comparing python versions [#3121 @wagoodman]
(Full Changelog)

Bug Fixes
- Since version 0.104.0 shaded jars are not reported [#3098]
- db search fails with misleading message (out of memory) when no db is present [#3049 #3077 @JvD-Ericsson]
Additional Changes
- replace os.Chdir with t.Chdir in test code [#3067 @joonas]
(Full Changelog)

Bug Fixes
- redact during file output [#3068 @kzantow]
- Unaffected match table does not filter results if CPE matching is enabled [#3056 #3066 @kzantow]
Additional Changes
- migrate grype to use mholt/archives instead of anchore fork [#3036 @joonas]
(Full Changelog)

Added Features
- Add --from flag [#3035 @wagoodman]
- Let a suppression expire to prevent that one will forget to resolve a vulnerability [#3031]
Bug Fixes
- Unnormalized fix version triggers false-positive in mssql-jdbc [#3042 #3034 @jamestexas]
Additional Changes
- junit template use CDATA block to prevent XML parse errors [#3019 @nvtkaszpir]
- Keep nested loggers labeled [#3040 @wagoodman]
(Full Changelog)

Added Features
- Allow hyphen in version string [#3021 @willmurphyscode]
- Respect rpmmod PURL qualifier [#3020 @willmurphyscode]
(Full Changelog)

Added Features
- Use Alma Linux specific advisories for Alma Linux scans [#2745 #2939 @willmurphyscode]
Bug Fixes
- Bitnami packages with CPEs are not matched against CPE-based vulnerabilities [#2997]
Additional Changes
- add markdown template [#2987 @sebdanielsson]
(Full Changelog)

Bug Fixes
- Panic error scanning images with v0.101.0 on some java dependencies [#3002]
(Full Changelog)

Added Features
- Add cyclonedx to RpmMetadata [#2935 @sfc-gh-rmaj]
- grype db search can filter by fixed state [#2968 @willmurphyscode]
- Support using VEX documents with directory scans and SBOMs [#2471 #2811 @alegrey91]
Bug Fixes
- Issue installing Grype using documented curl command [#2985]
- Advisory ID blank in JSON output [#2965]
Additional Changes
- update flags with v3 to not use default config [#3000 @spiffcs]
- fix Cosign documentation URL in installer [#2995 @lime]
- set advisory id again [#2979 @willmurphyscode]
- add db schema validation [#2962 @willmurphyscode]
(Full Changelog)

Added Features
- Add unaffected package and CPE stores [#2888 @wagoodman]
- use unaffected match table to remove appropriate vulns [#2886 @CrosleyZack]
(Full Changelog)

Bug Fixes
- Present fix available version in grype JSON output [#2905 @wagoodman]
- detect patch numbers in fuzzy version comparison [#2844 @willmurphyscode]
- Make timestamp in output configurable (so that results are more reproducible) [#522 #2724 @gabetrau]
- Grype .98 misidentifies the container package version [#2884]
(Full Changelog)

Added Features
- Add fix availability information to DB schema [#2862 @wagoodman]
- feat[raspbian]: support vulnerability matching for raspbian [#2893 @westonsteimel]
- CSAF support [#1826 @juan131]
Bug Fixes
- include channel in grype db search output [#2873 @willmurphyscode]
- add UnmarshalJSON to fix availability blob [#2889 @willmurphyscode]
- Grype misdetect Grafana version [#2783]
Breaking Changes
- CSAF support [#1826 @juan131]
(Full Changelog)

Added Features
- move debian 13 (trixie) to released and debian 14 (forky) to testing/sid/unstable [#2861 @westonsteimel]
(Full Changelog)

Grype v0.97.2
Added Features
- new syft version adds binary classifier for hashicorp vault [#4121 @willmurphyscode]
Bug Fixes
- fix: update syft's nondeterministic Java archive purl and improve groupID for better matching [#3521 #4118 @kzantow]
(Full Changelog)

Bug Fixes
- Multiple EUS advisories where only some are fixed result in unexpected vulnerabilities [#2840 #2841 @kzantow]
(Full Changelog)

Added Features
- Add support for RHEL EUS [#2446 #2787 @wagoodman]
Bug Fixes
- Error scanning snap "unsupported source: source.SnapMetadata" [#2819 #2821 @kzantow]
Additional Changes
- add channel to os / distro [#2782 @wagoodman]
(Full Changelog)

Added Features
- Added the EPSS score and KEV indications as CycloneDX vulnerabilities.ratings entries [#2695 #2765 @AlinaPodoba]
Bug Fixes
- The go run and go install broken due to useless redirect directive in go.mod [#2777 #2780 @stefanb]
- EPSS implementation using percentile instead of percent probability [#2778 #2785 @wagoodman]
- Latest version of grype with V6 schema lists incorrect URL for v6 database [#2513]
Additional Changes
- Add more detail around cataloging and DB load log statements [#2779 @wagoodman]
- add version set and combined constraint [#2763 @wagoodman]
- add v6 OS store [#2766 @wagoodman]
(Full Changelog)

Added Features
- Add string severity to db search json results [#2730 @wagoodman]
- Add package specifier overrides for kb, dpkg, and apkg [#2742 @westonsteimel]
Bug Fixes
- show related NVD records for non-NVD matches [#2755 @kzantow]
- assume that a vulnerability with no ranges is always vulnerable [#2759 @wagoodman]
- DB should hydrate for when the client has new features [#2758 @wagoodman]
- show relationship back to NVD for all CVE ids [#2756 @westonsteimel]
- properly escape CPE segments [#2731 @kzantow]
- msrc matcher should search by package ecosystem, not by distro [#2748 @westonsteimel]
- Grype does not report any vulnerabilities for CPEs with target_sw field set to value that does not correspond to known package type [#2768 #2772 @willmurphyscode]
- malformed CPE in grype db search output [#2767 #2769 @westonsteimel]
- vex documents from the --vex flag do get processed or applied to the output correctly [#1836 #2741 @willmurphyscode]
Additional Changes
- replace deprecated GoReleaser configurations [#2729 @emmanuel-ferdman]
- specify types for all match details [#2762 @wagoodman]
- Refactor the version package [#2735 @wagoodman]
(Full Changelog)

Added Features
- Add echo os to grype [#2647 @orizerah]
Bug Fixes
- Nonroot can't load local docker image with docker socket bind [#2721 #2723 @kzantow]
- "Harden Container Runtime with Non-Root User" breaks --output usage [#2720 #2723 @kzantow]
(Full Changelog)

Added Features
- Add support for MinimOS [#2627 @Daniel-Wachter]
- Use the upstream Bitmani vulndb data for matching [#1609 #2538 @juan131]
- Support rubygems specific version comparision [#2646 #2712 @willmurphyscode]
Bug Fixes
- Harden Container Runtime with Non-Root User [#2716 @wagoodman]
- valid cpes in db search output [#2706 @westonsteimel]
- Always show results with json output for db search commands [#2692 @wagoodman]
- False positive: CVE-2025-5702 reported with High severity on glibc 2.34 (wrong severity and affected version) [#2718]
(Full Changelog)

Bug Fixes
- unpin dockerfile base images to prevent wget TLS errors [#2671 @spiffcs]
- Parse java group ID and artifact ID from PURL when missing [#2675 @wagoodman]
- Grype can't update DB in docker volume (regression) [#2517 #2672 @willmurphyscode]
Additional Changes
- Remove getDB() from the v6 DB reader [#2669 @wagoodman]
(Full Changelog)

(Full Changelog)

Bug Fixes
- Various false positives starting with 0.91.1 [#2618 #2621 @willmurphyscode]
(Full Changelog)

Bug Fixes
- Assume that empty versions should match on all possible versions [#2591 @wagoodman]
- Fix severity field in db search vuln [#2589 @wagoodman]
- Recover from panic within a matcher [#2590 @wagoodman]
- Should only check maven central if pom info is missing [#2216 #2547 @tdunlap607]
- grype db search GHSA-mrrh-fwg8-r2c3 doesn't return results [#2530]
- Grype stopped reporting vulnerabilities after upgrade [#2608 #2610 @willmurphyscode]
- Grype does not handle cache-dir containing ~ correctly [#2599 #2600 @kzantow]
- Grype should expand ~ in paths in config file [#2024 #2600 @kzantow]
- False Positive: Multiple old CVEs in chromium 134.0.6998.117 for apk ecosystem [#2581]
- Missing grype DB update from 20250411 [#2593]
- Does not fill in the Level field of the SARIF result object [#2511 #2571 @bdovaz]
Additional Changes
- add timing info to log output [#2597 @kzantow]
- Replace os.ReadDir with afero.ReadDir for consistency [#2579 @joe-ton]
(Full Changelog)

Added Features
- Add v5 namespace emulation to db search output [#2539 @wagoodman]
- Add CVSS metrics in search JSON output [#2568 @wagoodman]
- Exit with a different return code for a failed scan [#1922]
Bug Fixes
- Use data driven approach when detecting Alpine:edge and Debian:sid [#2556 @wagoodman]
- db list should render out full URLs for text format [#2553 @wagoodman]
- grype db import fails since v0.88 and above [#2542 #2546 @kzantow]
(Full Changelog)

Added Features
- Match vulnerabilities by distro name when no version specified [#2521 #2534 @kzantow]
- Allow DB import from a URL [#2134 #2532 @wagoodman]
- Add the DB url to the JSON descriptor block [#356 #2529 @wagoodman]
(Full Changelog)

Bug Fixes
- Ensure fatal error from maven search bubbles up [#2518 @luhring]
- Source URLs missing/broken in output with latest release [#2520 #2523 @kzantow]
- Grype results set a vulnerability as its own related vulnerability [#2514 #2515 @kzantow]
(Full Changelog)

[!IMPORTANT]
As of Grype v0.88.0, the listing file which hosts the URLs of databases to download has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.
Added Features
- Show suggested fixed version when there are multiple listed [#2264 #2271 @tomersein]
Bug Fixes
- Check for vulnerability database update failed with unsupported protocol scheme when referencing local file [#2507 #2508 @wagoodman]
(Full Changelog)

Added Features
- Add KEV information to v6 DB [#2464 @wagoodman]
- Add pretty format option [#2406 @tomersein]
- Add configuration for maven rate limit functionality [#2397 @rawlingsj]
- Allow specifying literal CPEs via the CLI [#2463 @wagoodman]
- Add KEV & EPSS to db search schema [#2481 @wagoodman]
- Update vulnerability matchers to use v6 DB schema [#2132 #2311 @kzantow]
- Configure and use new V6 DB distribution URLs [#2126 #2439 @kzantow]
Bug Fixes
- fix golang 1.24 versions when not semver compliant [#2486 @xnox]
- error out on maven search rate limiting [#2460 @luhring]
- CPE search failed when considering target software for unknown package type [#2434 #2438 @westonsteimel]
- Grype Does Not Clean TMPDIR When Running in a Docker Container [#2500]
- GetMavenPackageBySha can be rate limited by maven central, grype will silently fail which results in inconsistent scan results [#2383]
- Grype exits with error on JSON output with PURL input [#2360]
- Removal of temporary files not working on Windows [#2233 #2439 @kzantow]
- grype db status reports "valid" when the DB is missing [#2077 #2439 @kzantow]
- grype db status doesn't always check the db's checksum and validity [#1648 #2439 @kzantow]
- False positive of CVE-2023-45853 on apt zlib1g/now 1:1.2.13.dfsg-1 package [#2412 #2474 @westonsteimel]
- GHSA-93ww-43rr-79v3 / CVE-2024-10039 does not get patched version [#2408]
- "grype config" output swaps comments for search-indexed-archives / search-unindexed-archives [#2409 #2414 @spiffcs]
Breaking Changes
- Remove DB schema v3 and v4 code [#2435 @wagoodman]
- Replace grype db diff with grype db search --modified-after and --published-after flags [#2129 #2439 @kzantow]
Additional Changes
- Refactor presenters to use static model over dynamic lookups [#2492 @wagoodman]
- update syft to 1.20 [#2473 @kzantow]
(Full Changelog)

Added Features
- Question: Custom Vulnerability Sources CSAF [#2337]
- vex: Add package name to VEX product identifiers [#1905 #2355 @ferozsalam]
Bug Fixes
- fix upstream match for linux-.-headers-. [#2320 @barnuri]
- external-sources: throttle requests to maven central to avoid being rate limited for large sets of java dependencies [#2384 @rawlingsj]
- Clean up config help text [#2347 @wagoodman]
(Full Changelog)

Security Fixes
- archiver has been archived - replace with archives fork [#2304 #2313 @spiffcs]
Bug Fixes
- archiver has been archived - replace with archives fork [#2304 #2313 @spiffcs]
- Grype panics on certain output formats for PURL inputs [#2324 #2328 @willmurphyscode]
- FP of upstream linux [#2326]
Additional Changes
- move v5-specific interfaces and implementations to the v5 package [#2322 @kzantow]
- Fix broken link to cosign documentation [#2321 @uaqben]
(Full Changelog)

Added Features
- Add missing package information for Sarif report [#2267 #2254 @GeorgeLS]
Bug Fixes
- ignore linux-aws-headers-.* as well like linux-headers-.* [#2295 @barnuri]
Breaking Changes
- Remove DB v1 & v2 schemas [#2278 @wagoodman]
Additional Changes
- refactor v5-specific code out of core packages [#2299 @kzantow]
(Full Changelog)

Added Features
- Add support for gradle in Java [#2236]
- Prefer direct match information over indirect matches [#1931 #2241 @wagoodman]
Bug Fixes
- Restore log on UI teardown [#2248 @wagoodman]
Additional Changes
- Display warnings even when -v is not passed and no tty is present [#2180 #2268 @willmurphyscode]
- core dependencies: latest syft v1.17.0 and latest stereoscope v0.0.9 [#2275 @willmurphyscode]
(Full Changelog)

Added Features
- Add support for scanning single purl from the CLI [#2225 #2223 @wagoodman]
Bug Fixes
- Docker reports 0 vulnerabilities. Same file reports many vulnerabilites when ran directly on linux server [#2235]
- Flaky checks on STDIN for purl provider [#2192 #2223 @wagoodman]
- Missing alpine patch version yields inaccurate results [#2222 #2226 @wagoodman]
Additional Changes
- update Syft to v1.16.0 [#2237 @anchore-actions-token-generator]
(Full Changelog)

Updates
- update CI to install golang at the latest version [#1949 @spiffcs]
- Grype is now built with the latest version of Golang at v1.22.x. This resolves a few security findings that would have been flagged against the v0.79.0 binary for using an older version of the Golang standard library.
(Full Changelog)

Added Features
- Upgrade syft to v0.91.0 (and CycloneDX to v1.5) [#1508 @wagoodman]
Bug Fixes
- Grype doesn't exit cleanly on error [#1492 #1505 @kzantow]
Additional Changes
- Fix typo in flag on Readme [#1501 @robszumski]
- pin cache versions [#1495 @spiffcs]