v0.80.1

Bug Fixes

• CVE-2024-3154 found with latest version [#1834 #2091 @spiffcs]

Additional Changes

• Update Syft to 1.12.2 [#2108]

(Full Changelog)

v0.80.0

Added Features

• Add info subcommand in order to query grype db vulnerabilities [#1629 #2031 @tomersein]

Bug Fixes

• correctly close the db file in v4/v5 stores [#2066 @AndreiStefanie]
• Grype panics with a nil pointer dereference error when given an empty string argument [#2063 #2064 @lucasrod16]
• Ignoring search results when CPE is not set in the SBOM [#2039 #2040 @aeg]
• "No vulnerability database update available" when actually the check for an update was unsuccessful [#310 #1247 @shanedell]
• CycloneDX output metadata.properties set to null instead of empty array or omitted [#1759]

Additional Changes

• update Syft to v1.11.1 [#2071 @anchore-actions-token-generator]
• add grype version to db network operations [#2062 @kzantow]

(Full Changelog)

v0.79.6

Bug Fixes

• Failed to parse constraint of CVE-2024-6345 which fails the scan [#2048 #2049 @wagoodman]

(Full Changelog)

v0.79.5

Bug Fixes

• Grype failed to load vulnerability database: database metadata not found [#1885 #2033 @willmurphyscode]

Additional Changes

• update to Syft 1.11.0 [#2047 @kzantow]
• add grype version to application update check headers [#2021 @kzantow]

(Full Changelog)

v0.79.4

Bug Fixes

• Disable ui before run function on db status [#2008 @wagoodman]

Additional Changes

• update Syft to v1.10.0 [#2019 @anchore-actions-token-generator]

(Full Changelog)

v0.79.3

Bug Fixes

• correct logic checking cpe target software component against package type [#1658 @westonsteimel]

Additional Changes

• update Syft to v1.9.0 [#1986 @anchore-actions-token-generator]

(Full Changelog)

v0.79.2

Bug Fixes

• use location RealPath not String() for match sorting [#1950 @luhring]

(Full Changelog)

v0.79.1

Updates

• update CI to install golang at the latest version [#1949 @spiffcs]
• Grype is now built with the latest version of Golang at v1.22.x. This resolves a few security findings that would have been flagged against the v0.79.0 binary for using an older version of the Golang standard library.

(Full Changelog)

v0.79.0

Added Features

• Installation script: Support checksum signature verification [#1627 #1670 @hibare]

Bug Fixes

• fix match sort ordering for different locations [#1944 @luhring]
• Sort order for matches should consider fix info [#1933 @wagoodman]
• Go main module pseudo version matching: turn off by default [#1894 @luhring]
• Inconsistent naming of matchDetails.searchedBy.package field [#1877 #1900 @kzantow]

(Full Changelog)

v0.78.0

Added Features

• add config command [#1876 @kzantow]

Bug Fixes

• ask catalog for package, rather than type asserting [#1857 @willmurphyscode]
• Disable TUI for simple commands [#1872 @wagoodman]
• False Positive: CVE-2023-42282 not affected in SUSE ecosystem [#1813]
• False positive GHSA-jr9c-h74f-2v28/CVE-2022-0905 reported for Non-vulnerable Gitea version [#1416]

Additional Changes

• Update syft to v1.5.0 [#1897 @wagoodman]

(Full Changelog)