Grype Versions Save

Bug Fixes

• update ignored vulnerability count in tui [#1837 @kzantow]
• SARIF output not compatible with GitHub [#1518 #1838 @kzantow]

(Full Changelog)

Additional Changes

• update Syft to v1.3.0 [#1832 @anchore-actions-token-generator]

(Full Changelog)

Added Features

• add linux and libc-dev headers ignore rules for debian packages [#1809 @zhill]
• use Go main module version when possible [#1797 @luhring]

Additional Changes

• Add providers' pull date to DB metadata structure [#1795 @asomya]
• config: add config opt in golang pseudo version main module comparison [#1816 @spiffcs]

(Full Changelog)

Added Features

• Database download timeouts [#1731 #1777 @willmurphyscode]

Bug Fixes

• Disable matching kernel vulnerabilities by default for indirect matches against the 'kernel-headers' packages [#1762 #1787 @zhill]

Additional Changes

• Update Syft to v1.2.0 [#1803], which fixes https://github.com/anchore/grype/issues/1792

(Full Changelog)

Added Features

• update syft source providers [#1727 @kzantow]
• enable http timeout [#1777 @willmurphyscode]

Bug Fixes

• use "path/filepath" to build file path [#1767 @seiyab]
• Suppress warnings when matching go packages with devel version [#1752 @wagoodman]
• not showing poco CVEs from syft generated sbom [#1737]

(Full Changelog)

Bug Fixes

• return exit codes from install script [#1725 @hacst]
• GitHub code scanning alerts missing information [#1715 #1720 @kzantow]

Additional Changes

• update Syft to v0.105.1 [#1728]

(Full Changelog)

Bug Fixes

• ensure version output to stdout [#1709 @kzantow]
• Seeing "WARN some package(s) are missing CPEs" but it's not clear why [#1634 #1710 @willmurphyscode]

(Full Changelog)

Additional Changes

• Bump Syft in Grype to pull in unmarshaling fix [#1703 @willmurphyscode]

(Full Changelog)

Security Fixes

• Upgrade syft to v0.103.1 [#1688 @wagoodman]

(Full Changelog)

Bug Fixes

• Fix matching when RPM modularity is a factor [#1679 @wagoodman]
• VEX documents not taken into account when --fail-on is set [#1639 #1657 @ferozsalam]

Additional Changes

• break assumption that syft cpe.CPE is wfn.Attributes [#1675 @willmurphyscode]

(Full Changelog)