Bug Fixes

• correct logic checking cpe target software component against package type [#1658 @westonsteimel]

Additional Changes

• update Syft to v1.9.0 [#1986 @anchore-actions-token-generator]

(Full Changelog)

Bug Fixes

• use location RealPath not String() for match sorting [#1950 @luhring]

(Full Changelog)

Updates

• update CI to install golang at the latest version [#1949 @spiffcs]
• Grype is now built with the latest version of Golang at v1.22.x. This resolves a few security findings that would have been flagged against the v0.79.0 binary for using an older version of the Golang standard library.

(Full Changelog)

Added Features

• Installation script: Support checksum signature verification [#1627 #1670 @hibare]

Bug Fixes

• fix match sort ordering for different locations [#1944 @luhring]
• Sort order for matches should consider fix info [#1933 @wagoodman]
• Go main module pseudo version matching: turn off by default [#1894 @luhring]
• Inconsistent naming of matchDetails.searchedBy.package field [#1877 #1900 @kzantow]

(Full Changelog)

Added Features

• add config command [#1876 @kzantow]

Bug Fixes

• ask catalog for package, rather than type asserting [#1857 @willmurphyscode]
• Disable TUI for simple commands [#1872 @wagoodman]
• False Positive: CVE-2023-42282 not affected in SUSE ecosystem [#1813]
• False positive GHSA-jr9c-h74f-2v28/CVE-2022-0905 reported for Non-vulnerable Gitea version [#1416]

Additional Changes

• Update syft to v1.5.0 [#1897 @wagoodman]

(Full Changelog)

Additional Changes

• update Syft to v1.4.1 [#1855 @anchore-actions-token-generator]

(Full Changelog)

Additional Changes

• Remove providers' pull information from DB metadata file [#1846 @asomya]

(Full Changelog)

Bug Fixes

• update ignored vulnerability count in tui [#1837 @kzantow]
• SARIF output not compatible with GitHub [#1518 #1838 @kzantow]

(Full Changelog)

Additional Changes

• update Syft to v1.3.0 [#1832 @anchore-actions-token-generator]

(Full Changelog)

Added Features

• add linux and libc-dev headers ignore rules for debian packages [#1809 @zhill]
• use Go main module version when possible [#1797 @luhring]

Additional Changes

• Add providers' pull date to DB metadata structure [#1795 @asomya]
• config: add config opt in golang pseudo version main module comparison [#1816 @spiffcs]

(Full Changelog)