https://cybertoolchain.io/tools/clair New releases and features in Clair, tracked by The Cyber Toolchain. en Wed, 10 Dec 2025 18:34:49 GMT https://github.com/quay/clair/releases/tag/v4.9.0 https://github.com/quay/clair/releases/tag/v4.9.0 Wed, 10 Dec 2025 18:34:49 GMT Clair v4.9.0 adds SPDX encoder, configurable VEX timeout, SUSE dynamic distro support, and NVD 2.0 CVSS data • Adds `updaters.config.rhel-vex.compressed_file_timeout` config key to control the download timeout for RHEL VEX archives • Adds SPDX-2.3 document encoding capability for index reports via a new encoder • Switches CVSS enrichment from NVD 1.1 to NVD 2.0 JSON feeds • Adds dynamic discovery support for `suse.linux.enterprise.server` and `opensuse.leap` distributions Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair https://github.com/quay/clair/releases/tag/v4.8.0 https://github.com/quay/clair/releases/tag/v4.8.0 Wed, 09 Oct 2024 20:19:32 GMT Clair v4.8.0 adds CSAF/VEX updater, CPE2.3 matching, iterator-based DB updates, and clairctl admin pre-migration • Adds `csaf/vex` updaters for Red Hat security data, replacing the deprecated RHEL OVAL v2 updaters • Adds `IgnoreUnpatched` config key to the RHEL matcher (moved from updater) • Extends Updater interface with `UpdateVulnerabilitiesIter` method and `EnrichmentUpdater` with `UpdateEnrichmentsIter` for iterator-based database updates • Adds NIST IR 7696 CPE2.3 Name Matching support for CPE pattern matching • Adds `clairctl -D admin pre v4.8.0` subcommand to manually clean deprecated OVAL vulnerabilities Breaking changes: • Deprecated updaters that rely on Red Hat OVAL v2 security data are removed in favor of CSAF/VEX data; a database migration deletes existing OVAL-originated vulnerabilities Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair https://github.com/quay/clair/releases/tag/v4.7.4 https://github.com/quay/clair/releases/tag/v4.7.4 Wed, 01 May 2024 16:59:42 GMT Clair v4.7.4 adds `O_TMPFILE` fallback for temp file downloads and improves OSV severity parsing • Adds `O_TMPFILE` fallback logic in `libindex` so Clair handles deployments that do not support the `O_TMPFILE` flag. • Improves OSV advisory parsing to extract severity from `.database_specific` when the native `.severity` object is missing. • Updates Debian updater logic to correctly record source packages instead of relying on inaccurate metadata heuristics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair https://github.com/quay/clair/releases/tag/v4.7.3 https://github.com/quay/clair/releases/tag/v4.7.3 Mon, 26 Feb 2024 19:42:53 GMT Clair v4.7.3 adds rhcc/rhel sideband compression support, PGP V4 signature handling for RPMs, and alpine edge reporting via claircore v1.5.25. • `rhel` and `rhcc` indexers can now use compressed local files for data storage • RPM indexers support PGP V4 signatures • Alpine `edge` versions are supported for vulnerability reporting • Minimum TLS version for Clair servers is enforced to 1.2 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair https://github.com/quay/clair/releases/tag/v4.7.2 https://github.com/quay/clair/releases/tag/v4.7.2 Mon, 09 Oct 2023 20:27:15 GMT Adds `admin index create` command for concurrent DB indexes and Grafana dashboards for deletion metrics. • Adds contrib Grafana dashboards that visualize deletion-related metrics exposed by the API Breaking changes: • Removes support for the CRDA integration (the CRDA API has been decommissioned) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair https://github.com/quay/clair/releases/tag/v4.7.0 https://github.com/quay/clair/releases/tag/v4.7.0 Thu, 27 Jul 2023 21:17:12 GMT Adds `admin` subcommand and `delta pprof` endpoints; enables mutex/blocking profiles by default. • `admin` subcommand to clairctl for managing Clair state (e.g., deleting pyupio vulns). • New `/delta_pprof` endpoints for introspection of profiling data. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair https://github.com/quay/clair/releases/tag/v4.5.0 https://github.com/quay/clair/releases/tag/v4.5.0 Fri, 04 Nov 2022 15:20:36 GMT Clair v4.5.0 adds the `delete` subcommand to `clairctl` for removing vulnerabilities. • Removes support for Windows 386 binary targets. Breaking changes: • Windows 386 binaries are no longer published; upgrade your build environment to a supported architecture. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/clair