Anchore

No entries match these filters. Clear filters

1. Faster Answers, Fewer False Positives with Anchore Enterprise v6.3 (2026-10-27) Oct 27, 2026 · issue 129

   v6.3 adds Quick Package Search (by name, version, or PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously.), vulnerability-worsening alerts, and AI model policy gating with Fail or Warn outcomes.

   • Search for affected packages by name, name-plus-version, or PURL before a CVE is published — or when one never gets assigned — using the new Quick Package Search.
   • Anchore Enterprise now fires detailed notifications when a known vulnerability's CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. score or severity, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score, or CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. status changes after initial triage.
   • Discovered AI models (GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. and Docker Models) are now reported as packages inside application versions, making them visible in the same inventory as other components.
   • Gate AI models in pipeline policy with two outcomes — Fail (hard stop) or Warn (flag for parallel vetting) — using the new packages policy gate for AI models.

   4 details in Everything

   • New supported platform Ubuntu ESM vulnerability data feed support
2. What EU CRA’s 24-hour deadline means for your SBOM (2026-09-29) Sep 29, 2026 · issue 095

   Anchore Enterprise adds EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market. quickstart with product-lifecycle SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. modeling, continuous KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-gated policy evaluation, and VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. export via anchorectl.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Model a product and released version in Anchore Enterprise so every subsequent scan, policy evaluation, and VDR export is scoped to that release rather than an ad-hoc image scan.
   copy

   $ anchorectl app add iot-gateway \
     --contact-name "Product Security Officer" \
     --contact-email psirt@example.com \
     --description "Industrial IoT gateway - product with digital elements"
   
   anchorectl app version add 2.4.0 --app iot-gateway --status released --release-date 2026-06-15

   Attach a live container image and a supplier-delivered CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOM as assets to a release version, then enforce a KEV-blocking CRA policy in CI so the build fails if any exploited vulnerability is present.
   copy

   $ anchorectl app version asset add container-image-remote registry.example.com/iot-gateway/web-console:2.4.0 \
     --app iot-gateway --version 2.4.0 --asset web-console --wait
   
   anchorectl app version asset add sbom telemetry-module-1.8.0.cdx.json \
     --app iot-gateway --version 2.4.0 --asset telemetry-module -t device --wait
   
   anchorectl app update iot-gateway --policy-id eu-cra-baseline
   anchorectl app version policy status get 2.4.0 --app iot-gateway --fail-based-on-results

   When a KEV match triggers a policy_status_changed alert, record a VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. assessment and export a Vulnerability Disclosure Report ready for ENISAENISAThe European Union Agency for Cybersecurity, an EU body that publishes threat landscapes, guidelines, and standards to help member states and organisations raise their cyber defences. SRP submission — all before the 24-hour CRA clock expires.
   copy

   $ anchorectl app version vex add 2.4.0 --app iot-gateway \
     --vuln-id CVE-2022-22965 \
     --pkg-name spring-beans \
     --pkg-type java-archive \
     --pkg-version 5.3.17 \
     --status affected \
     --action-statement "Security update 2.4.1 ships the supplier's fixed component."
   
   anchorectl app version export vdr 2.4.0 --app iot-gateway -f iot-gateway-2.4.0-vdr.cdx.json

   • Adds anchorectl app add and anchorectl app version add subcommands to model a product as an App and each release as a Version, enabling product-level (not scan-level) compliance tracking.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds anchorectl app version asset add container-image-remote and anchorectl app version asset add sbom subcommands to attach heterogeneous assets — direct container images or supplier-delivered SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. — to a versioned product release.
   • Adds anchorectl app update --policy-id and anchorectl app version policy status get --fail-based-on-results to attach and evaluate a CRA-focused policy (blocking on any KEV-listed finding) at the product level in CI.
   • Adds anchorectl app version vex add subcommand with --vuln-id, --pkg-name, --pkg-type, --pkg-version, --status, and --action-statement flags to record engineering VEX annotations against a specific release.
   • Adds anchorectl app version export vdr subcommand (with -f for output file) to generate a Vulnerability Disclosure Report bundling product identity, component inventory, and VEX analysis into a single CycloneDX document suitable for ENISA SRP submission.

   +3 more show less

   • Exports a unified SBOM per release version in CycloneDX and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. formats once all assets are attached.
   • Emits policy_status_changed notifications at the Application Version level whenever a release's compliance outcome shifts, with subscription endpoints including Webhooks, Slack, Teams, Jira, GitHub, and email.
   • Continuously re-evaluates every stored SBOM against updated vulnerability data and policy automatically — flagging a newly non-compliant release the moment underlying data changes, not at the next scheduled scan.

   8 details in Everything

3. 6.2.0 Sep 23, 2026 · release notes

   Anchore Enterprise v6.2.0 adds Go symbol matching, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.-driven policy gates, AI model cataloging, and concurrent scanning.

   • Go vulnerability matching now uses GoVulnDB symbols to reduce false positives; controlled by golang.capture-symbols config key (extended-stdlib, stdlib, all, none).
   • AI models in GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. format are cataloged as content; retrieved via GET /images/{image_digest}/content/model.
   • Analysis failure reasons now returned in API responses for centralized, distributed, and one-time scans.
   • VEX assessment status (not_affected, affected, fixed, under_investigation) drives Application Version policy results; vulnerabilities gate supports annotation_status and missing_annotation parameters.
   • Application vulnerability-packages trigger supports anchore_score and anchore_score_comparison parameters for policy rules.

   +5 more show less

   • Events raised when Application Version policy outcome changes (pass/warn/fail transitions).
   • /apps/{app_id}/versions/{version_id}/packages-search API gains has_vulnerabilities and severity filters.
   • CSV exports for vulnerability, package, and compliance now include Asset ID, Asset Name, Asset Class, and Asset Type columns.
   • Application log output can be set to JSON via ANCHORE_LOG_FORMAT environment variable.
   • UI Contents tab supports filtering packages by vulnerability presence and severity; Compliance tab filters by VEX annotation status.

   10 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Go vulnerability findings are renamed from CVE IDs to GO-advisory IDs (e.g., CVE-2022-23806 becomes GO-2021-0319). Allowlists and deny-lists keyed on the original CVE may miss new findings if they do not account for GO- IDs or aliases.
   • !CSV export format changed: rows are now One row per finding per asset instead of One row per finding, with new columns Asset ID, Asset Name, Asset Class, and Asset Type replacing aggregated counts.
   • !The legacy SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. group event type has been removed; /service/event-types no longer advertises it.
4. FedRAMP & CMMC in 2026: what actually changed for your Authority to Operate (ATO) (2026-09-22) Sep 22, 2026 · issue 089

   Anchore Enterprise policy bundle v2026.1 adds a dedicated STOP gate for CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal.-listed vulnerabilities mapped to NIST 800-53NIST 800-53A catalog of security and privacy controls for U.S. federal information systems, published by NIST. Cyber tools cite it to map their findings or features to a recognized compliance framework. SI-2.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Fail a CI/CD build immediately on any CISA KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.-listed vulnerability and get the specific NIST control and finding — not just a pass/fail — so the result is directly traceable for an ATO assessor.
   copy

   $ anchorectl image check <image> --detail -f

   • Surfaces per-control failure detail via anchorectl image check <image> --detail -f, returning the specific control and finding that failed rather than a pass/fail count, enabling assessors to trace results to a named requirement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Incorporates CISA's Known Exploited VulnerabilitiesKnown Exploited VulnerabilitiesCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. (KEV) list and EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. exploit prediction scores alongside CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. in the policy engine for risk-based vulnerability prioritization.
   • Supports POA&MPOA&MA Plan of Action and Milestones: a US federal government document that tracks known security weaknesses in a system, the remediation steps planned, and the deadlines for completing them, required under FISMA compliance. enforcement through policies, gates, and time-bound allowlists, letting a non-compliant finding be allowlisted with an explicit remediation date rather than silently ignored or blocking all builds.
   • Extends policy enforcement from build time into live Kubernetes clusters via a runtime inventory and admission controller that blocks non-compliant workloads before scheduling.
   • Surfaces per-control failure detail via anchorectl image check <image> --detail -f, returning the specific control and finding that failed rather than a pass/fail count, enabling assessors to trace results to a named requirement.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Supports POA&MPOA&MA Plan of Action and Milestones: a US federal government document that tracks known security weaknesses in a system, the remediation steps planned, and the deadlines for completing them, required under FISMA compliance. enforcement through policies, gates, and time-bound allowlists, letting a non-compliant finding be allowlisted with an explicit remediation date rather than silently ignored or blocking all builds.
   • Extends policy enforcement from build time into live Kubernetes clusters via a runtime inventory and admission controller that blocks non-compliant workloads before scheduling.

   1 more in Everything

5. Extending Supply Chain Security to AI Models with Anchore Enterprise v6.2 (2026-09-15) Sep 15, 2026 · issue 082

   Anchore Enterprise v6.2 adds AI/ML model SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. detection, MCP ServerMCP ServerA process that exposes tools, resources, and prompts over Anthropic's Model Context Protocol, letting an AI agent call external APIs or local services through a standardised interface. for agent integration, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.-aware policies, and local SBOM generation.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Natively inspects container images for AI/ML model artifacts, including GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. files and Docker Model structures, indexing them as packages in the central SBOM catalog alongside traditional software components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the Anchore Enterprise MCP Server, a lightweight container image that gives AI agents and tools direct, structured access to vulnerability findings, policy evaluation results, and SBOM catalog data without custom API integration scripts.
   • Adds policy support for VEX annotations, allowing policies to automatically factor in VEX status values such as not_affected or fixed to suppress false positives and prevent unnecessary build breaks.
   • Triggers automated notifications whenever a policy outcome changes at the application version level, alerting security teams when a previously compliant artifact becomes non-compliant.
   • Enables filtering of packages within an application version by associated vulnerability severity (Critical, High, Medium) to accelerate targeted remediation.

   +1 more show less

   • Supports local SBOM generation and output during image scanning workflows, enabling developers to inspect component inventories and compliance status before pushing artifacts to central registries.
   • Natively inspects container images for AI/ML model artifacts, including GGUFGGUFThe single-file model format used by llama.cpp and Ollama, holding the weights, usually quantized, together with the tokenizer and settings needed to run the model locally. files and Docker Model structures, indexing them as packages in the central SBOM catalog alongside traditional software components.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Introduces the Anchore Enterprise MCP Server, a lightweight container image that gives AI agents and tools direct, structured access to vulnerability findings, policy evaluation results, and SBOM catalog data without custom API integration scripts.
   • Triggers automated notifications whenever a policy outcome changes at the application version level, alerting security teams when a previously compliant artifact becomes non-compliant.
   • Enables filtering of packages within an application version by associated vulnerability severity (Critical, High, Medium) to accelerate targeted remediation.

   2 more in Everything

6. Anchore + AI Just Got Easier: The Anchore Enterprise MCP Server (2026-09-03) Sep 3, 2026 · issue 069

   Anchore Enterprise MCPMCPModel Context Protocol, a standard for connecting AI applications to external tools and data sources. A compatible server exposes capabilities an assistant can use through a common interface. server gives AI agents native access to vulnerability findings, policy results, and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. data without custom glue code.

   • Exposes curated MCP tools covering key API properties for specific security objectives (triage, policy checks, risk reporting), with a fallback to generic API invocation for broader coverage.
   • Handles large payload management, pagination, and consistent response handling automatically within the MCP server, enabling agentic workflows to query Anchore at scale.

   2 details in Everything

7. Your Kubernetes cluster is running images your registry scan never checked (2026-09-01) Sep 1, 2026 · release notes

   Anchore Enterprise introduces a Kubernetes inventory agent to track live cluster images and drift from registry scans

   └──▷ TRY IT
   Configure the agent to overwrite existing image records and set a 7-day TTLTTLTime to live, a limit on how long data remains valid or how far a packet can travel. Caches use a time limit; IP packets use a hop limit. for runtime data retention.
   copy

   $ helm upgrade my-inventory anchore/k8s-inventory --set 'k8sInventory.inventory_ingest_overwrite=true' --set 'k8sInventory.inventory_ttl_days=7'

   • Adds helm install anchore/k8s-inventory subpackage for the new Kubernetes inventory agent that polls the K8s API directly.
   • Enables policy evaluation and blocking against live runtime images via Kubernetes Admission Controller when configured.

   2 details in Everything

8. Operationalizing SBOMs to Boost Incident Response Velocity with Anchore Enterprise v6.1 (2026-08-20) Aug 20, 2026 · release notes

   Anchore Enterprise v6.1 introduces Vulnerability Search, VM scan coverage, and POA&MPOA&MA Plan of Action and Milestones: a US federal government document that tracks known security weaknesses in a system, the remediation steps planned, and the deadlines for completing them, required under FISMA compliance.-as-code.

   • Adds Vulnerability Search feature to query the centralized SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. catalog against new vulnerability feeds for instant blast radius analysis
   • Adds native filesystem scanning support for virtual machines alongside container images
   • Enables importing third-party vendor-provided SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. formats
   • Adds POA&M-as-code capability allowing management of allowlists and remediation plans within security workflows
   • Expands the unified asset model to support global compliance regulations including EU CRAEU CRAEU Cyber Resilience Act, a European Union regulation requiring manufacturers and publishers of products with digital elements to meet mandatory cybersecurity standards before selling into the EU market.

   5 details in Everything

9. What your SBOM inventory misses if it only covers containers (2026-08-18) Aug 18, 2026 · issue 056

   Anchore Enterprise adds VM filesystem and disk-image SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation as first-class assets alongside containers

   └──▷ TRY IT
   Scan a live VM's full filesystem and attach the resulting SBOM to an application version for unified querying alongside container assets.
   copy

   $ anchorectl app add my-vm-fleet --contact-name "Platform Team"
   anchorectl app version add 2026-06-01 --app my-vm-fleet
   anchorectl app version asset add filesystem / \
     --app my-vm-fleet \
     --version 2026-06-01 \
     --asset web-server-vm \
     --type virtual_machine_disk \
     --wait

   Generate an SBOM from an offline VM disk image (read-only, no agent required) — useful for forensic analysis or scanning golden-image templates before fleet cloning.
   copy

   $ sudo qemu-nbd --read-only --connect=/dev/nbd0 disk.qcow2
   sudo mount -o ro /dev/nbd0p1 /mnt/vm
   anchorectl app version asset add filesystem /mnt/vm \
     --app my-vm-fleet \
     --version 2026-06-01 \
     --asset web-server-vm-image \
     --type virtual_machine_disk \
     --wait

   • Adds anchorectl app version asset add filesystem subcommand with --type virtual_machine_disk flag to generate SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. from live VM filesystems or mounted disk images and attach them to an application version.
   • Supports scanning VM disk images offline (read-only, no agent) via QEMUQEMUAn open-source machine emulator and virtualizer that lets software run a guest OS or CPU architecture on a different host, giving cyber tools an isolated, inspectable execution environment without dedicated hardware. NBD mount — sudo qemu-nbd --read-only --connect=/dev/nbd0 disk.qcow2 — enabling forensic and golden-image workflows.
   • Skips pseudo-filesystems (/proc, /sys) by default when scanning /, making full-root filesystem analysis safe; narrower paths (/usr, /opt, /srv) are also supported for faster targeted scans.
   • Unifies container images (anchorectl app version asset add container-image), VM filesystems, and third-party SBOMs (anchorectl app version asset add sbom) as three asset types under one application version for cross-asset querying.
   • Imports and exports CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. (JSON and XML) and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. (JSON and tag-value) formats; generated SBOMs include NTIA minimum elements: supplier name, component name, version, purl, dependency relationships, SBOM author, and timestamp.

   5 details in Everything

10. 6.0.0 Aug 13, 2026 · release notes

    Anchore Enterprise 6.0 adds Apps, Assets, and Jobs framework with new public APIs and UI navigation

    • Apps model organizes software under App Versions which roll up Assets (container images/SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.) for aggregated SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. content, vulnerability findings, and policy compliance results.
    • New application-editor and application-delete RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles manage access to the Apps model hierarchy.
    • Public APIs expose the new Apps API for managing Apps, Versions, and Assets via standard endpoints.
    • Standardized error model with structured error codes in public API responses including a lookup endpoint for code details and documented remediation guidance.
    • SBOM ingestion supports Syft, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence., and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. formats (with SPDX 3SPDX 3An open standard from the Linux Foundation for expressing software bill-of-materials data, letting cyber tools exchange dependency, license, and vulnerability metadata in a machine-readable, interoperable format..x upload/download supported; analysis not yet functional).

    +3 more show less

    • Anchore Score (0-100) now blends CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., severity, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. signals on vulnerability findings with source attribution.
    • Asynchronous Jobs framework handles asset analysis, SBOM import, and export operations, visible within the App Version UI.
    • Exports support SBOM (SPDX/CycloneDX), VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports. (CycloneDX JSON/VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable.-aware), VEX document, and CSV formats for vulnerabilities/packages/policy.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The legacy Application APIs (GET/POST/PUT/DELETE /v2/applications and associated version/artifact endpoints) are deprecated; use the new Apps API instead.
    • !The legacy Source APIs (GET/POST/DELETE /v2/sources and related content/vuln/sbom endpoints) are deprecated; use the new Apps APIs instead.
    • !System Feed APIs (PUT/DELETE /v2/system/feeds/{feed}) no longer function and will return a 501 Not Implemented error.
    • !The legacy webhooks subsystem and its configuration file entries have been removed; use the Notifications system instead.
    • !The OpenStack Swift object store driver has been removed.
    • !Deprecated feed- and dataset-sync event types (system.feeds.sync.* and system.dataset.sync.*) have been removed.
    • !Legacy Kubernetes and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. runtime vulnerability report tables are dropped from the database.
    • !The deprecated policy feed sync configuration options have been removed.
    • !The enable_owned_package_filtering configuration option has been removed.
    • !The stale_feed_data policy trigger has been removed for SBOM policies and is no longer included in the default policy.
    • !Experimental Imported SBOM APIs ( /exp/sboms and /exp/sbom-groups ) have been removed; use Apps instead.
    • !Artifact Lifecycle Policy (ALP) rules for imported SBOMs have been removed.
    • !Bookmarked legacy URLs (/sboms, etc.) now 301-redirect to /applications.
11. 6.0.1 Aug 13, 2026 · release notes

    Anchore Enterprise 6.0.1 requires PostgreSQL 17+ with pg_cron and enforces pre-flight DB checks at startup.

    • Anchore Enterprise v6.0.x supports new (greenfield) deployments only; upgrades from v5.x are blocked
    • Requires PostgreSQL 17 or greater with the pg_cron extension installed and accessible by Anchore Enterprise

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrades from v5.x deployments are blocked; an existing deployment that attempts to roll out v6.0.x will not start.
12. 6.1.0 Aug 13, 2026 · release notes

    Anchore Enterprise v6.1.0 adds arm64 support, in-place DB at-rest encryption, new policy packs, quick vulnerability search, and migration from v5.x.

    • Adds linux/arm64 support for Enterprise, UI, AnchoreCTL, and all integrations via multi-architecture images
    • Enables at-rest encryption for sensitive database columns with AES-256-GCMAES-256-GCMAES encryption in Galois/Counter Mode, which encrypts data and detects tampering in one pass. It is the default cipher for TLS and most disk and cloud encryption. using a keyring defined in the config file
    • Bundles ASD8, PCI-DSSPCI-DSSThe Payment Card Industry Data Security Standard, security requirements for protecting payment account data. It covers organizations that store, process or transmit that data and relevant service providers., and CMMC compliance policy packs in addition to refreshed existing packs
    • Adds quick vulnerability search by ID without requiring an App Version context
    • Automatically fans out policy re-evaluation to affected App Versions when a policy changes

    +13 more show less

    • Allows downloading documents produced by asynchronous jobs directly from the job interface
    • Captures database diagnostics in support bundles for faster troubleshooting
    • Makes per-service resource limits configurable
    • Respects and enforces runtime entitlements
    • Sorts policy findings by rule name
    • Accepts free-text comments on license create, update, and retrieval operations
    • Adds v2_severity, v3_severity, and v4_severity fields to the per-source CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. assessment in the read-only vulnerability API
    • Supports uid and gid parameters for the SUID or GUID set files policy gate/trigger
    • Recognizes Hummingbird as a supported distribution in the vulnerability.vulnerability_data_unavailable trigger
    • Imports CycloneDX 1.7CycloneDX 1.7An OWASP-maintained Software Bill of Materials standard and schema; version 1.7 adds attestations and evidence fields, giving cyber tools a richer, machine-readable format for expressing supply-chain trust claims. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. documents alongside previously supported formats
    • Handles RPM modularity consistently at the SBOM boundary during SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. scans
    • Uses the configured tmp_dir for all subprocessing and temporary files
    • Improves garbage collection for deleted objects, jobs, and component catalog

    18 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Crosses a major version boundary requiring migration from v5.x with planned downtime
    • !Database is upgraded to PostgreSQL 17
    • !User passwords are always stored hashed and are no longer configurable
13. 5.0.0 Aug 11, 2026 · release notes

    Anchore v5 introduces inventory overwrite config, new distro gate, fix-observed date API fields, and image-developer RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role.

    └──▷ TRY IT
    Call the V2 API to get vulnerability details including the date a fix was observed.
    copy

    $ GET /v2/images/{image_digest}/vuln/{vuln_type}

    • Adds inventory_ingest_overwrite configuration option to Runtime Inventory to store only the most recent inventory per cluster/namespace
    • Adds fix_observed_at field to the response of the GET /v2/images/{image_digest}/vuln/{vuln_type} endpoint for available fixes
    • Adds new distro policy gate with deny trigger requiring Name, Version, and Operation parameters
    • Adds image-developer RBAC role to limit users to viewing images, vulnerabilities, policies and policy evaluations
    • Adds the scheduledQueryExecutions query for pagination of specific scheduled query executions

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The anchore-cli is deprecated and removed from docker.io/anchore/enterprise image; AnchoreCTL is now the only supported CLI tool.
    • !KAI (Kubernetes Automated Inventory) is no longer compatible with Enterprise v5.0.0, requiring migration to anchore-k8s-inventory.
    • !Support for REM (Remote Execution Manager) is deprecated and no longer supported in Enterprise v5.0.0.
    • !The Analyzer Service no longer supports multiple analysis threads; the concurrentTasksPerWorker Helm Chart value is removed.
    • !Enterprise v5.0.0 requires Postgres 13 or greater.
14. 5.1.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.1.0 adds API Keys support, dark mode UI, and Java SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. version columns

    • API Keys are now supported for authentication with Anchore Enterprise, generated via the System > Accounts view in the UI or the new endpoint.
    • UI Theme: A Dark Mode toggle has been added to the top right of the application interface, defaulting to the system theme but overrideable by the user.
    • Artifact Analysis > SBOM view now includes a Version column specifically for the Java sub-tab.
    • Runtime report filters for Labels now support multiple labels.
    • image-lifecycle and registry-editor RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. roles are available to manage archival rules and private registry credentials respectively.

    5 details in Everything

15. 5.10.0 Aug 11, 2026 · release notes

    Anchore Enterprise 5.10 introduces the Data Syncer service and vulnerability exclusion in Policy Engine.

    • Replaces the legacy Feed Service with the new Data Syncer Enterprise service for system synchronization
    • Adds a new vulnerability exclusion mechanism to the Policy Engine

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Feed Service is deprecated and no longer supported; Enterprise installations must use the Data Syncer service
    • !Support for OpenStack Swift object storage has been deprecated
16. 5.11.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.11.0 adds system-admin RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role, new users API endpoints, k8s-inventory health checks, and policy value parameter support

    • Adds the system-admin RBAC role to grant administrative privileges to non-admin account members.
    • New GET /v2/accounts/users endpoint returns a list of all users in the system, including their roles and associated accounts.
    • New GET /v2/accounts/{account_name}/users-with-roles endpoint lists users granted roles in a specific account.
    • Adds support for the value parameter in policy checks where the check parameter is exists or not exists.
    • New AnchoreCTL commands to view integration health status for k8s-inventory agents.

    +1 more show less

    • New GET /v2/integrations/k8s-inventory/health and GET /v2/integrations/k8s-inventory/health/{agent_id} API endpoints for agent health monitoring.

    6 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for OpenStack Swift object storage has been deprecated and is no longer supported.
    • !Ruby Gems and NPMs package feeds and policy gates are EOL and no longer supported.
    • !The Feed Service is deprecated and replaced by the Data Syncer service; it is no longer supported in Enterprise installations.
17. 5.12.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.12.0 adds image-delete RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data source for policies, resource-limits API, and DB pool metrics.

    • Adds image-delete RBAC role to allow users to delete images, sources, and archives from the system
    • New EPSS Score Comparison and EPSS Percentile Comparison parameters available in the Vulnerabilities policy gate and Package trigger
    • Added GET /v2/system/resource-limits endpoint to return currently enabled resource limits and their usage
    • New metrics anchore_db_pool_size, anchore_db_pool_available, and anchore_db_pool_in_use added for database pool monitoring

    4 details in Everything

18. 5.13.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.13.0 adds malware scanning for images >4GB and max scan time config.

    • Adds support for Malware Scanning on images larger than 4 GB by splitting them into 2 GB chunks during analysis
    • Adds malware.clamav.max_scan_time configuration key to analyzer_config.yaml to set the maximum time allowed for a single malware scan

    2 details in Everything

19. 5.14.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.14.0 introduces system configuration API endpoints, a UI Configuration view, and new fields in vulnerability reports.

    • API now supports viewing and dynamically changing system configuration values via GET /v2/system/configurations, PATCH /v2/system/configurations, GET /v2/system/configurations/{config_key}, PUT /v2/system/configurations/{config_key}, and DELETE /v2/system/configurations/{config_key}.
    • Adds ability to toggle the ClamAV Malware Scanner via services.analyzer.analyzer_scanner_config.malware.clamav.enabled using the new configuration API.
    • Adds global log level setting logging.log_level and per-service log level settings (e.g., services.apiext.logging.log_level) configurable via the system configuration API.
    • New Configuration view in the UI System tab allows admins to verify and manage system settings, including editing log levels and enabling ClamAV.
    • Report templates Runtime Inventory, Images by Vulnerability, and Artifacts by Vulnerability now include the Artifact Vulnerable From field.

    5 details in Everything

20. 5.15.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.15.0 adds commit SHA/build datetime to API, improves UI dark mode persistence and table visibility

    • GET /v2/version now returns the commit SHA and build datetime for the Enterprise Image in its response.
    • UI dark/light mode preference is now preserved across browser tabs within the same browser.

    2 details in Everything

21. 5.16.0 Aug 11, 2026 · release notes

    Anchore Enterprise 5.16 adds ignore_dir to SUID/GID gate, license normalization, image hints in SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., and custom login messages

    • files Gate with suid or guid set Trigger now accepts the ignore_dir parameter to exclude directories from setuid/setgid checks.
    • Package License Names are normalized to the SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. License List for newly analyzed images.
    • Image Hints results are visible in downloaded SBOMs (Syft, SPDX, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence.) for newly analyzed images.
    • Administrators can configure a custom login screen message and title via the UI.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Policy gates using license fields (e.g., GPL-2.0) may need updates to match normalized SPDX names (e.g., GPL-2.0-only).
    • !Upgrading from v5.0.0-v5.15.x requires database downtime for automatic schema changes.
    • !FIPSFIPSA set of US federal standards published by NIST that define approved cryptographic algorithms and modules; cyber tools use it to meet compliance requirements in government and regulated environments. enabled hosts with Amazon RDS must upgrade to Postgres 16 or greater.
22. 5.17.0 Aug 11, 2026 · release notes

    Per-account Prometheus metrics and image license content API in Anchore Enterprise v5.17.0

    • Per-account Prometheus metrics available by setting services.catalog.account_prometheus_metrics to true in the Helm chart.
    • New endpoint GET /v2/images/{image_digest}/content/licenses provides detailed software license info for each package in an image.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The ts field in the GET /v2/system/feeds response is replaced by data_service_built_at and enterprise_received_at; other existing timestamps are deprecated.
    • !Support for OpenStack Swift object storage is removed/deprecated; deployments must use supported alternatives.
23. 5.18.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.18.0 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. Management UI, Anchore Score, OS CVE filter, and new CLI flags.

    • New Imported SBOMs tab in the UI allows uploading SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format./CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for inventory and vulnerability analysis
    • New Anchore Score composite metric combines CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and CISA KEVCISA KEVA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing vulnerabilities confirmed to be actively exploited in the wild, giving cyber tools a vetted, authoritative prioritization signal. for vulnerability prioritization
    • New Show OS CVEs filter in Artifact Analysis > Vulnerabilities alongside existing Show Non-OS CVEs toggle
    • New GET /v2/images/{image_digest}/content/licenses endpoint exposes license content (value: other-indeterminate) when ID is unknown
    • New max_scan_time configuration option exposed via API and UI to control ClamAV malware scan timeout in milliseconds

    +2 more show less

    • Chrome binary detection added to the vulnerability scan engine
    • Automated CSV export of detailed vulnerability data from uploaded SBOMs

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The enterprise-gitlab-scan plugin is deprecated; users should migrate to using AnchoreCTL directly
24. 5.18.1 Aug 11, 2026 · release notes

    Anchore v5.18.1 removes Data Syncer dataset size limits and deprecates OpenStack Swift support

    • Removes storage size limitations in the Data Syncer Service for reliable retrieval of large Anchore datasets

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading from v5.0.0-v5.17.x requires database downtime due to automatic schema changes
25. 5.19.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.19.0 adds STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. evaluation support, one-time stateless scanning, priority analysis queues, and custom UI banners.

    └──▷ TRY IT
    Perform a lightweight vulnerability and policy scan without persisting the result in the database.
    copy

    $ anchorectl image one-time-scan <pull string>

    • Adds support for STIG evaluations via Static STIG AddOn entitlement
    • Adds GET /v2/images/{image_digest}/stig, POST /v2/images/{image_digest}/stig, PUT /v2/images/{image_digest}/stig/{evaluation_uuid}, DELETE /v2/images/{image_digest}/stig/{evaluation_uuid}, and GET /v2/images/{image_digest}/stig/{evaluation_uuid}/file API endpoints for STIG management
    • Adds policy gate stig to enforce STIG compliance in policy bundles
    • Adds system statistic stig_evaluation_inventory to track STIG evaluation counts
    • Adds one-time stateless image scanning capability via POST /v2/scan API endpoint

    +5 more show less

    • Adds AnchoreCTL command anchorectl image one-time-scan <pull string> for stateless scans
    • Adds system statistic stateless_sbom_evaluation to track stateless scan counts
    • Adds priority analysis queue feature configurable via services.catalog.analysis_queue_priority Helm chart value
    • Adds new Prometheus deployment metrics for monitoring Anchore Enterprise
    • Allows custom banners in the UI via UI deployment configuration

    10 details in Everything

26. 5.19.3 Aug 11, 2026 · release notes

    Anchore Enterprise v5.19.3 removes data size limits on the Data Syncer service and deprecates OpenStack Swift and legacy webhooks.

    • Enables the Data Syncer Service to handle Anchore datasets without size limitations, ensuring reliable storage and retrieval.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The webhook system managed in the configuration file is being deprecated in favor of the more advanced notification system.
27. 5.2.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.2.0 adds account-viewer role, /system/statistics API endpoint, and reporting volume config.

    • Adds account-viewer system role for listing all accounts within Anchore Enterprise
    • Adds services.reports.use_volume configuration to direct the Report Service to use disk space instead of memory for report generation
    • Adds /system/statistics API endpoint to return various system statistics and counters over time

    3 details in Everything

28. 5.21.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.21.0 adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. EUS and STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. on Kubernetes support; KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use./EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. via API; UI score inputs

    • Supports Red Hat Enterprise Linux (RHEL) Extended Update Support (EUS) data when scanning container images for vulnerabilities.
    • Enables STIG Evaluations on Kubernetes Containers.
    • Adds KEV and EPSS vulnerability data to the GET /v2/images/{image_digest}/vuln endpoint response.
    • Adds KEV and EPSS vulnerability data to the GET /v2/sources/{source_id}/vuln endpoint response.
    • Adds support for selecting images that are in a failed analysis state for deletion via Artifact Lifecycle Policies.

    +1 more show less

    • Adds a number input field to the CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. Score filter in the Imported SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. > Vulnerabilities tab for precise minimum score entry.

    6 details in Everything

29. 5.23.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.23.0 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. VDRVDRA Virtual Data Room is a secure, hosted document repository used for controlled sharing of sensitive files during due diligence, audits, or investigations, giving cyber tools a governed environment to exchange evidence or reports./VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. API endpoints, Prometheus metrics, and UI export capabilities.

    • New API endpoints for CycloneDX Vulnerability Disclosure Reports (VDR): GET /v2/images/{image_digest}/vuln/{vuln_type}/cyclonedx-json and GET /v2/images/{image_digest}/vuln/{vuln_type}/cyclonedx-xml.
    • New API endpoint for CycloneDX Vulnerability Exploitability eXchangeVulnerability Exploitability eXchangeA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. (VEX) documents: GET /v2/images/{image_digest}/vex/cyclonedx-json and GET /v2/images/{image_digest}/vex/cyclonedx-xml.
    • New Prometheus metrics to track Object Store usage: anchore_object_store_bucket_object_count and anchore_object_store_total_bucket_size.
    • UI feature allows exporting vulnerability data in VDR (CycloneDX) and VEX formats via the new Export dialog.
    • New API endpoint for STIGSTIGA configuration standard published by DISA that specifies hardening requirements for a given OS, application, or device, giving cyber tools a concrete checklist to audit or enforce against. profiles: GET /v2/stig-profiles.

    +2 more show less

    • Added PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. field to GET /exp/sboms/{sbom_uuid}/packages response object.
    • Improved SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import endpoints (GET /v2/sources{source_id}/sbom/native-json) now return file data on newly imported sources.

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for OpenStack Swift object storage has been deprecated.
30. 5.24.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.24.0 adds imported SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. policy evaluation, matched CPEs in findings, session timeout config, and System Statistic tracking.

    • GET /exp/sboms/{sbom_uuid}/check endpoint added to check the policy evaluation status of an imported SBOM
    • matched_on_cpes field now included in vulnerability findings from GET /v2/images/{image_id}/vuln, GET /v2/vulnerability-scan, and GET /v2/scan endpoints
    • Policy Evaluation Policy now supports evaluating imported SBOM artifacts against policies with package, denylist, and stale feed data triggers

    3 details in Everything

31. 5.25.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.25.0 adds lifecycle policy for Imported SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., new RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role, and API filters.

    • Adds Artifact Lifecycle Policy support for Imported SBOMs to enable automatic deletion based on user-defined criteria
    • Adds a user-viewer role in the system domain providing read-only access to user-related information
    • Adds a username query parameter to the GET /v2/accounts/users endpoint to filter the user list
    • Adds a type query parameter to the GET /exp/sboms endpoint to filter Imported SBOMs by type
    • Adds an annotations query parameter to the GET /exp/sboms endpoint to filter Imported SBOMs by annotation

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for OpenStack Swift object storage has been deprecated
    • !The enterprise-gitlab-scan plugin is being deprecated in favor of using AnchoreCTL directly
    • !The webhook system managed in the configuration file is being deprecated in favor of the notification system
    • !Archived images from versions prior to v4.0.0 can no longer be restored into the active dataset
32. 5.26.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.26.0 adds support for VMware PhotonOS, Fedora, SecureOS, Arch Linux, CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. matching API control, and new UI filters/roles.

    • Adds vulnerability data source support for VMware PhotonOS, enabling vulnerability monitoring for images based on PhotonOS.
    • Adds vulnerability data source support for Fedora, including EPEL packages sourced from the Bodhi update system.
    • Adds vulnerability matching and policy evaluation support for SecureOS and Arch Linux.
    • Adds configurable CPE matching behavior via the API for GitHub-covered ecosystems, now disabled by default for new deployments.
    • Adds a Disputed by Vendor filter in the Vulnerabilities tab to filter vulnerabilities where the distribution vendor’s assessment differs from NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. and no fix is planned.

    +3 more show less

    • Adds filtering of imported SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. by Annotation entries, supporting compound filter criteria of up to five key-value pairs.
    • Replaces the Compliance Recommendation filter with a boolean Has Recommendation filter for display control.
    • Adds a new user-viewer role assignable to groups or users for viewing all users across accounts via AnchoreCTL or API.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Images analyzed prior to Anchore Enterprise v4.0.0 will be updated to indicate that their analysis has failed, as Anchore Enterprise no longer supports the analysis artifacts produced prior to v4.0.0.
    • !Images archived prior to Anchore Enterprise v4.0.0 can no longer be restored into the active dataset.
33. 5.4.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.4.0 adds AUDIT event logs for API endpoints and a new /system/deployment-history endpoint.

    • Adds AUDIT event logging for specified API endpoints in the API Service
    • Adds /system/deployment-history endpoint to retrieve future upgrade history
    • Adds CVEs column to vulnerability reports

    3 details in Everything

34. 5.5.0 Aug 11, 2026 · release notes

    Anchore Enterprise 5.5.0 adds API endpoints for keys/creds and anchorectl download, structured logging config, Ubuntu 24.04 feed support.

    • Adds GET /system/anchorectl endpoint to download the compatible version of AnchoreCTL directly from the product.
    • Adds /v2/user/api-keys, /v2/user/api-keys/{key_name}, /v2/user/credentials, and /v2/accounts/{account_name}/users/{username}/credentials endpoints for API key and credential management.
    • Adds anchoreConfig.logging.structured_logging, anchoreConfig.logging.file_rotation_rule, and anchoreConfig.logging.file_retention_rule helm chart controls to configure structured logging output and rotation rules.
    • Integrates Ubuntu 24.04 Feed Provider support for vulnerability detection.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The default feed provider configuration now imports results every six (6) hours using Anchore-produced workspaces; ensure access to https://enterprise.vunnel.feed.anchore.io is maintained.
35. 5.5.1 Aug 11, 2026 · release notes

    Anchore Enterprise v5.5.1 changes feed import defaults and improves report performance

    • Changes default feed provider configuration to import Anchore results every six hours, enabling NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. enrichment with Anchore data and GitHub Security Advisories access under firewall constraints.
    • Improves responsiveness of the Runtime Images by Vulnerability report, reducing generation time under certain conditions.

    2 details in Everything

36. 5.6.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.6.0 adds analyzed_since flag to image APIs, new policy conditions, and UI pagination.

    • Adds analyzed_since optional parameter to /v2/images and /v2/summaries/image-tags API endpoints to limit results to recently analyzed artifacts.
    • Artifact Lifecycle Policies now support a new condition to preserve base images from removal during retention enforcement.
    • Image Selection view in the UI now uses server-side pagination, filtering, and sorting for registry, repository, and tag tiers.
    • Dashboard view loads pending metrics asynchronously to improve Time to Interactive (TTI) on login.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading from v5.0.0-v5.3.0 or v5.4.x-v5.5.0 requires database downtime due to automatic schema changes.
37. 5.7.0 Aug 11, 2026 · release notes

    Anchore Enterprise 5.7.0 adds user-defined base image overrides, SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management.-only mode, and API key management for RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists.

    • Adds anchore.user/marked_base_image annotation to override the system-determined base image for vulnerability checks
    • Enables auto base digest selection in /v2/images/{image_digest}/check and /v2/images/{image_digest}/vuln/{vuln_type} endpoints by accepting auto as the base_digest parameter
    • Disables native user API access via anchoreConfig.user_authentication.disallow_native_users config key
    • Enables SSO-only mode (disabling local login) via sso_auth_only configuration option
    • Allows admin users to create API Keys for managing Accounts, User Groups, and RBAC Roles

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for OpenStack Swift object storage is deprecated
    • !Package Feeds for Ruby Gems and NPMs are deprecated
38. 5.8.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.8.0 introduces KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. ingestion as a Vulnerability Annotation feed and a new KEV List Trigger for policy gates

    • The KEV list is now available to be ingested as a Vulnerability Annotation feed within the Feed Service, enabled by default in the helm chart.
    • A new KEV List Trigger is now available as part of the Vulnerability Policy Gate.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Support for OpenStack Swift has been deprecated.
    • !Package Feeds and Policy Gates for Ruby Gems and NPMs are now deprecated.
39. 5.9.0 Aug 11, 2026 · release notes

    Anchore Enterprise v5.9.0 adds new package types, ancestry denylisting, and API query params for tags and statistics.

    • Adds exclude_existing_tags query parameter to POST /v2/repositories to limit analysis to newly created tags
    • Expands supported package types including ArchLinux alpm, CocoaPods, Conan, Dart Pub, Erlang/OTPOTPOne-time password: a short-lived numeric or alphanumeric code valid for a single authentication attempt, generated via TOTP or HOTP standards, giving cyber tools phishing-resistant second-factor verification without stored shared secrets., GitHub Action Workflows, Linux Kernel Module, NixOS packages, and others
    • Adds ancestry gate support for denylisting ancestor images by tag or digest
    • Adds runtime flag to GET /v2/summaries/image-tags endpoint to filter tags found in the runtime inventory
    • Extends GET /v2/system/statistics endpoint with new account and inventory fields: account_creation, account_inventory, user_creation, user_inventory, report_execution_inventory, image_inventory, and source_inventory

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The Feed Service is deprecated and will be replaced by a new Enterprise service in v5.10.0
    • !Support for OpenStack Swift object storage has been deprecated
    • !Package Feeds and Policy Gates for Ruby Gems and NPMs are now deprecated
    • !The enterprise-gitlab-scan plugin is being deprecated in favor of using AnchoreCTL directly
    • !Upgrading from v5.0.0-v5.8.1 requires database downtime due to automatic schema changes
40. 4.4.0 Jun 16, 2026 · release notes

    Anchore Enterprise v4.4.0 adds SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format./CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export endpoints, Ancestry Policy Gate, and Ubuntu 22.10 feed support.

    • Enterprise API now supports downloading SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDX and CycloneDX formats via new endpoints /images/{imageDigest}/sboms/spdx-json, /images/{imageDigest}/sboms/cyclonedx-json, /sources/{source_id}/sbom/spdx-json, and /sources/{source_id}/sbom/cyclonedx-json.
    • New Image Ancestry Policy Gate allows verification that a specified image contains an approved base image.
    • Vulnerability data is now available for the Ubuntu 22.10 (Kinetic Kudu) feed group.
    • Configuration option enable_package_db_load added to disable the package.verify policy trigger and reduce database load.
    • AnchoreCTL binary for linux x86 is now packaged into the docker.io/anchore/enterprise image.

    +1 more show less

    • Tech Preview: Enterprise Reporting provides a global endpoint for queries including data from all accounts.

    6 details in Everything

41. 4.8.0 Dec 5, 2025 · release notes

    Anchore Enterprise v4.8.0 adds Kubernetes/ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. vulnerability reports, config-driven resource reduction, and UI repository toggle control

    • Adds Vulnerabilities by Kubernetes Container report template for filtering vulnerabilities within Kubernetes containers.
    • Adds Vulnerabilities by ECS Containers report template for filtering vulnerabilities within ECS containers.
    • Adds ANCHORE_POLICY_ENGINE_ENABLE_IMAGES_BY_VULN_QUERY environment variable to disable the /v1/query/images/by_vulnerability API and stop SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. vulnerability rescans for resource reduction.
    • Adds services.policy_engine.enable_images_by_vulnerability_api config key in config.yaml for Helm deployments to control image-by-vulnerability query functionality.
    • Adds enable_add_repositories property to config-ui.yaml allowing suppression of Watch Repository toggles in the UI registry and repository view tables.

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Setting the new configuration options to false disables the /v1/query/images/by_vulnerability API (returning 501) and stops SBOM vulnerability rescans.
42. 5.22.0 Nov 28, 2025 · release notes

    Anchore Enterprise v5.22.0 adds VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. annotations, direct object store access, and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. list integration

    • Adds object_store.direct_access config key to Helm values for direct object store access from all services
    • Adds new vuln-annotator-editor RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role for creating and modifying vulnerability annotations
    • Adds VEX document generation via the GET /v2/images/{image_digest}/vex/openvex API endpoint
    • Adds KEV List flag to Policy vulnerability Gate package Trigger with a new option for known exploited vulnerabilities
    • Adds PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. field to vulnerability response objects in GET /v2/images/{image_digest}/vuln/{vuln_type}, GET /v2/sources/{source_id}/vuln/{vuln_type}, POST /v2/vulnerability-scan, and POST /v2/scan

    +1 more show less

    • Adds PURL support in Artifact Analysis UI with a dedicated column in the Contents table

    6 details in Everything

43. 2.0.0 Sep 30, 2024 · release notes

    Anchore Enterprise 2.0 adds configurable GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. dashboard, GraphQL reporting service, and LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory. integration

    • Adds a new configurable GUI dashboard with metrics time series for container image status
    • Introduces the Enterprise Reporting Service exposing full container image information via a flexible GraphQL interface
    • Adds LDAP/AD identity management integration with flexible RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. account and user subsystem mappings

    3 details in Everything

44. 2.1.0 Sep 30, 2024 · release notes

    Anchore Enterprise 2.1 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management./SAMLSAMLA standard for passing signed identity assertions between a sign-in provider and an application. It lets a user sign in through their organization's identity provider. auth, GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. vulnerability feeds from VulnDB, and Policy Hub integration.

    • Adds configurable filtered reports (tabular HTML, JSON, or CSV) for image, security, and policy status in the GUI Reports control
    • Adds Single-Sign-On integration support for Okta, Keycloak, and Enterprise IDPIDPA service that authenticates users and supplies identity information to other applications. It is the sign-in authority behind many single sign-on systems. systems via SAML/token-based authentication for API and client integrations
    • Incorporates third-party vulnerability data feeds from Risk Based Security (VulnDB) to enhance image scanning results
    • Enables viewing, listing, and importing pre-made policies from the Anchore Policy Hub via the Policy Hub GUI

    4 details in Everything

45. 2.2.0 Sep 30, 2024 · release notes

    Anchore Enterprise 2.2 introduces notifications for GitHub/Jira/Slack/Teams, a new System Dashboard UI, and Harbor v1.10++ support

    • Adds Anchore Enterprise Notifications capability to send system, user, and workload level events to GitHub, Jira, Slack, and Microsoft Teams.
    • Adds a new System Dashboard in the Enterprise GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands. to review deployment status, troubleshoot issues, and view service roles.
    • Adds full support for CNCF Harbor project v1.10++ as an integrated artifact registry.

    3 details in Everything

46. 2.3.1 Sep 30, 2024 · release notes

    Anchore Enterprise 2.3.1 adds relative time windows to Reporting GraphQL API and CVE blacklisting policy rules.

    • Adds since parameter to Reporting service's GraphQL API queries to specify time ranges using a relative window (e.g., last 30 days) instead of absolute start/end dates
    • Adds licenses field (array type) to API responses for content packages, supplementing the existing comma-delimited license string field

    2 details in Everything

47. 2.3.2 Sep 30, 2024 · release notes

    Anchore Enterprise 2.3.2 adds relative time windows to Reporting GraphQL API and CVE blacklisting in policy language

    • Adds support for specifying time ranges using a relative window (e.g., last 30 days) as new parameters in the Reporting service’s GraphQL API.

    1 detail in Everything

48. 4.1.0 Sep 30, 2024 · release notes

    Anchore Enterprise 4.1.0 adds source-to-image SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. drift detection, CVE false positive reduction feed, and image archive rules with last_seen_in_days.

    • src2img-sbom-drift-policy-gate and src2img-sbom-drift-trigger detect when source repository SBOM packages are missing from the built container image.
    • New 'anchore:exclusions' vulnerability feed automatically excludes known false positives using Grype database schema Version 4.
    • archival_rule_exclusion.last_seen_in_days allows archive rules to skip images with active runtime inventory records seen within N days.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Embedded Inventory Mode Feature is deprecated and will be removed in v4.2.0.
    • !Configuration variable ANCHORE_VULNERABILITIES_PROVIDER is no longer supported.
    • !Configuration variable ANCHORE_ENTERPRISE_FEEDS_THIRD_PARTY_DRIVERS_ENABLED is no longer supported.
49. 4.1.1 Sep 30, 2024 · release notes

    Anchore Enterprise 4.1.1 adds a Recommendation field to policy rules for remediation guidance and overhauls service logs with detailed timestamped routing info.

    • Adds a Recommendation field to Policy Rules visible in image policy check results, allowing creators to provide generic fix hints
    • Overhauls service log output to display detailed timestamped information categorized by level, including accessed routes, connection details, configuration details, and major runtime operations

    2 details in Everything

50. 4.2.0 Sep 30, 2024 · release notes

    Anchore Enterprise 4.2.0 adds SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. strict mode, node.js binary detection, and vendor-only vulnerability filtering

    • Adds saml.strict_mode config key to enforce pre-allocated SSO users for login
    • Adds detection of non-packaged node.js binaries during image analysis
    • Adds Vendor Only CVE client-side filter to the Vulnerabilities tab in the UI
    • Adds Kubernetes page optimized presentational view for high analytical volume via client config parameters

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Removed the Kubernetes Runtime Inventory Embedded mode and associated cluster configuration APIs; deploy KAI into the cluster directly in inventory mode instead.
51. 4.3.0 Sep 30, 2024 · release notes

    Anchore Enterprise 4.3.0 adds runtimeInventoryUnscannedImages report query, repo-analyzer RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role, Wolfi OS feed support, and application version vulnerability queries.

    • Adds the runtimeInventoryUnscannedImages report query to list runtime inventory images that have not been analyzed
    • Introduces a new repo-analyzer RBAC Role to create repository subscriptions as a companion to image-analyzer
    • Enables vulnerability matching for Wolfi OS Packages by importing the Wolfi Security Feed
    • API now supports querying a list of vulnerabilities found for a specific Application Version

    4 details in Everything

52. 4.5.0 Sep 30, 2024 · release notes

    Anchore Enterprise 4.5.0 adds report-admin RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. role and SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export to Artifact Analysis.

    • Adds report-admin as a new RBAC Role for users who need to work with scheduled queries without other write permissions
    • Enables download of SBOM data from the Artifact Analysis view in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and OWASPOWASPA nonprofit foundation that publishes open standards, guides, and ranked vulnerability lists—most famously the OWASP Top 10—giving cyber tools a vendor-neutral benchmark to test or report against. CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. formats alongside the native JSON format

    2 details in Everything

53. 4.6.0 Sep 30, 2024 · release notes

    Anchore Enterprise 4.6.0 adds a DELETE API for runtime inventory contexts and introduces an inherit parameter to Vulnerability Package Triggers.

    • Adds /enterprise/inventories DELETE endpoint to remove runtime inventory contexts no longer reported by KAI
    • Adds the inherit parameter to Vulnerability Package Triggers to control whether base image vulnerabilities are considered
    • Deprecates policy triggers using blacklist/whitelist terminology in favor of denylist/allowlist (existing entries work until policy update)
    • Improves Inventory Watcher logging conciseness at info level
    • Adds global metrics anchore_monitor_inventory_contexts_monitored_total, anchore_monitor_inventory_images_total (found), anchore_monitor_inventory_images_total (success), and anchore_monitor_inventory_images_total (fail) for runtime inventory monitoring

    +2 more show less

    • Adds analyzer status metrics: anchore_analyzer_status (waiting), anchore_analyzer_status (error), anchore_analyzer_status (processing), and anchore_analyzer_dequeue_latency
    • Improves analysis job re-queue detection time from hours to minutes when an analyzer shuts down

    7 details in Everything

54. 4.7.0 Sep 30, 2024 · release notes

    Anchore Enterprise v4.7.0 adds new Runtime Inventory Agents, K8s namespace vulnerability reporting, and AnchoreCTL SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. import.

    • Adds anchore-k8s-inventory and anchore-ecs-inventory as new Runtime Inventory Agents for accessing Kubernetes and ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. environments
    • Introduces a new Vulnerabilities by Kubernetes Namespace report template to filter findings by namespace
    • Makes the account email field editable via API endpoints
    • Adds a new parameter to the Vulnerability Package trigger to control behavior for base image vulnerabilities
    • Enables Container Image SBOM generation and import from AnchoreCTL without Syft, supporting secret scans and filesystem metadata analysis

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Upgrading from an Anchore Enterprise version prior to v4.2.0 requires a sequential upgrade to v4.2.0 or v4.3.0 before proceeding to v4.7.0
55. 4.8.1 Sep 30, 2024 · release notes

    Anchore Enterprise v4.8.1 adds configuration options to disable specific vulnerability reports

    • Adds ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_K8S_NAMESPACE, ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_K8S_CONTAINER, and ANCHORE_ENTERPRISE_REPORTS_GENERATE_VULN_ECS_CONTAINER environment variables for Docker Compose users to control report generation
    • Adds anchoreEnterpriseReports.vulnerabilitiesByK8sNamespace, anchoreEnterpriseReports.vulnerabilitiesByK8sContainer, and anchoreEnterpriseReports.vulnerabilitiesByEcsContainer configuration keys in Helm values.yaml to control vulnerability reports

    2 details in Everything

56. 4.9.0 Sep 30, 2024 · release notes

    Anchore Enterprise 4.9.0 adds V2 API for migration, configurable import sizes, and new policy metadata capture.

    • Exposes the Anchore Enterprise V2 API as a consolidated endpoint for customers migrating from the distributed V1 APIs prior to v5.0.0
    • Adds ANCHORE_MAX_IMPORT_CONTENT_SIZE_MB environment variable and Helm value max_import_content_size_mb to configure the maximum image import size (default 100 MB)
    • Adds ANCHORE_MAX_IMPORT_SOURCE_SIZE_MB environment variable and Helm value max_source_import_size_mb to configure the maximum source repository import size (default 100 MB)
    • Enables Policy Engine to capture and persist observed date and fix observed date for vulnerability provider sync data to support consistent max days since fix evaluations

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The distributed V1 API files are deprecated in favor of the consolidated V2 API; customers using direct V1 API access must migrate prior to Enterprise v5.0.0
57. 4.9.2 Sep 30, 2024 · release notes

    Anchore Enterprise v4.9.2 adds policy_action to evaluation details and fixes V2 API subscription value handling.

    • Evaluation Details field of Policy Evaluations will contain a policy_action field
    • GET /v2/images/{image_digest}/check returns both final_action and policy_action
    • GET /v2/subscriptions and GET /v2/subscriptions/{subscription_id} now return repo_update subscription_value data in V2 API format

    3 details in Everything

58. 4.9.4 Sep 30, 2024 · release notes

    Anchore Enterprise 4.9.4 adds software downgrade support and fixes for Windows container analysis and feed sync

    • Adds the ability to execute a software downgrade from a patch release to a release within the same Major.Minor version numbers.
    • Fixes an issue that prevented new Windows OS containers from being analyzed properly, enabling correct reporting for these workloads.
    • Ensures image digests match when an image is analyzed within Enterprise (centralised analysis) versus when the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. is imported via AnchoreCTL (distributed analysis).

    3 details in Everything