Bug Fixes

• Panic error scanning images with v0.101.0 on some java dependencies [#3002]

(Full Changelog)

Added Features

• Add cyclonedx to RpmMetadata [#2935 @sfc-gh-rmaj]
• grype db search can filter by fixed state [#2968 @willmurphyscode]
• Support using VEX documents with directory scans and SBOMs [#2471 #2811 @alegrey91]

Bug Fixes

• Issue installing Grype using documented curl command [#2985]
• Advisory ID blank in JSON output [#2965]

Additional Changes

• update flags with v3 to not use default config [#3000 @spiffcs]
• fix Cosign documentation URL in installer [#2995 @lime]
• set advisory id again [#2979 @willmurphyscode]
• add db schema validation [#2962 @willmurphyscode]

(Full Changelog)

Added Features

• Add unaffected package and CPE stores [#2888 @wagoodman]
• use unaffected match table to remove appropriate vulns [#2886 @crosleyzack]

(Full Changelog)

Bug Fixes

• Present fix available version in grype JSON output [#2905 @wagoodman]
• detect patch numbers in fuzzy version comparison [#2844 @willmurphyscode]
• Make timestamp in output configurable (so that results are more reproducible) [#522 #2724 @gabetrau]
• Grype .98 misidentifies the container package version [#2884]

(Full Changelog)

Added Features

• Add fix availability information to DB schema [#2862 @wagoodman]
• Add support vulnerability matching for raspbian [#2893 @westonsteimel]
• Add Vex CSAF support [#1826 @juan131]

Bug Fixes

• include channel in grype db search output [#2873 @willmurphyscode]
• add UnmarshalJSON to fix availability blob [#2889 @willmurphyscode]
• Grype misdetect Grafana version [#2783]

Breaking Changes

• CSAF support [#1826 @juan131]

(Full Changelog)

Added Features

• move debian 13 (trixie) to released and debian 14 (forky) to testing/sid/unstable [#2861 @westonsteimel]

(Full Changelog)

Grype v0.97.2

Added Features

• new syft version adds binary classifier for hashicorp vault [#4121 @willmurphyscode]

Bug Fixes

• fix: update syft's nondeterministic Java archive purl and improve groupID for better matching [#3521 #4118 @kzantow]

(Full Changelog)

Bug Fixes

• Multiple EUS advisories where only some are fixed result in unexpected vulnerabilities [#2840 #2841 @kzantow]

(Full Changelog)

Added Features

• Add support for RHEL EUS [#2446 #2787 @wagoodman]

Bug Fixes

• Error scanning snap "unsupported source: source.SnapMetadata" [#2819 #2821 @kzantow]

Additional Changes

• add channel to os / distro [#2782 @wagoodman]

(Full Changelog)

Syft Improvments

• Update to latest version of syft v1.29.0

Performance Improvements

• Create ignore regex objects conditionally[#2805 @wagoodman ]

(Full Changelog)