Grype

No entries match these filters. Clear filters

1. v0.121.0 Oct 19, 2026 · issue 114

   Grype v0.121.0 adds OS SUPPORT_END date fallback for end-of-life warnings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v0.121.0 https://github.com/anchore/grype.git
   # already have the repo? check out this version:
   $ git checkout v0.121.0

   • Falls back to the SUPPORT_END date from OS release information when generating end-of-life warnings, so distros that publish a support-end date but no explicit EOL date are now flagged correctly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

2. docs update Oct 9, 2026 · issue 098
   • New supported platform Dart/pub package support
3. docs update Oct 9, 2026 · issue 098
   • New supported platform vcpkg manifest support via vcpkg-manifest-cataloger
   • New supported platform Conan C++ package manager support
4. docs update Oct 9, 2026 · issue 098
   • New supported platform Portage package URL type support
5. docs update Oct 6, 2026 · issue 096
   • New supported platform Dart pub package support
6. docs update Oct 6, 2026 · issue 096
   • New supported platform vcpkg manifest cataloger support
7. docs update Oct 6, 2026 · issue 096

   Grype adds a calculated risk score (0.0–100.0) combining CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it., EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching., and other severity metrics.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

8. docs update Oct 3, 2026 · issue 093
   • New supported platform Dart pub package support
9. docs update Oct 3, 2026 · issue 093
   • New supported platform vcpkg manifest cataloger support
   • New supported platform Conan package support
10. docs update Oct 3, 2026 · issue 093
    • New supported platform Portage package URL type support
11. v0.120.0 Oct 2, 2026 · issue 093

    Grype v0.120.0 adds NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. SSVCSSVCA decision-support framework for vulnerability prioritization, maintained by CISA and Carnegie Mellon's CERT/CC, that uses stakeholder-specific decision trees to guide patch and remediation timing instead of relying on numeric scores alone. decision points, a Locations column in HTML reports, and SLES comprehensive distro coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.120.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.120.0

    • Stores NVD SSVC decision points in a new v6 decorator table, exposing GetSsvcs for richer vulnerability prioritization data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
    • Adds a Locations column to the HTML report template to aid vulnerability triage.
    • Stores NVD SSVC decision points in a new v6 decorator table, exposing GetSsvcs for richer vulnerability prioritization data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 more in Everything

12. v0.119.0 Sep 17, 2026 · issue 078

    Grype now surfaces distro-fixed suppressed matches via --show-suppressed using the new include-matcher-suppressions option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.119.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.119.0

    └──▷ USE IT
    Permanently enable suppressed-matcher match visibility in your Grype config so every scan includes distro-fixed dropped matches in its ignored output.
    .grype.yaml copy

    include-matcher-suppressions: true
    show-suppressed: true

    • Adds include-matcher-suppressions config key (yaml: include-matcher-suppressions) to expose matches internally dropped by matchers — such as distro-fixed and built-in false-positive records — in the ignoredMatches output, making them visible when --show-suppressed is used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

    1 detail in Everything

13. v0.118.0 Aug 27, 2026 · release notes

    Grype v0.118.0 adds alias-aware aggregation for the apk matcher to improve SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. matching accuracy.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.118.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.118.0

    • apk matcher does alias aware aggregation

    1 detail in Everything

14. v0.117.0 Aug 10, 2026 · issue 042

    Grype v0.117.0 adds vulnerable version ranges to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. output and fixes Rust CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. matching via match.rust.using-cpes.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.117.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.117.0

    └──▷ TRY IT
    Enable CPE-based matching for Rust crates when scanning an image, so vulnerabilities reachable only via CPE (e.g. openssl rust-crate) are no longer silently missed.
    copy

    $ GRYPE_MATCH_RUST_USING_CPES=true grype alpine:latest

    • Adds vulnerable version ranges to CycloneDX output format, giving richer remediation context in CycloneDX SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    1 detail in Everything

15. v0.116.0 Jul 16, 2026 · issue 018

    Grype v0.116.0 adds Go symbol-based reachability analysis, Ubuntu ESM support, architecture-aware matching, and Chainguard OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.116.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.116.0

    • Adds lightweight Go symbol reachability analysis to suppress false positives for stdlib, golang.org/x, and third-party Go vulnerability advisories — only flags binaries that actually import the vulnerable symbols.
    • Deduplicates Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA).
    • Supports Ubuntu ESM (Extended Security Maintenance) vulnerability matching.
    • Adds a Chainguard OSV transformer for processing Chainguard vulnerability data.
    • Duplicates RHSA advisories across all applicable RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. minor versions for more complete RHEL coverage.

    5 details in Everything

16. v0.116.0 Jul 16, 2026 · issue 004

    Grype v0.116.0 adds Go symbol-based reachability analysis, Ubuntu ESM support, architecture-aware matching, and Chainguard OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. integration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.116.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.116.0

    • Adds lightweight Go symbol reachability analysis to suppress false positives for stdlib, golang.org/x, and third-party Go vulnerability advisories — only flags binaries that actually import the vulnerable symbols.
    • Deduplicates Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA).
    • Supports Ubuntu ESM (Extended Security Maintenance) vulnerability matching.
    • Adds a Chainguard OSV transformer for processing Chainguard vulnerability data.
    • Duplicates RHSA advisories across all applicable RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. minor versions for more complete RHEL coverage.

    5 details in Everything

17. v0.115.0 Jun 26, 2026 · release notes

    Grype v0.115.0 adds govulndb-sourced golang.org/x/net vulnerability detection and deduplicates Go vuln/GHSA matches.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.115.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.115.0

    • Emits vulnerabilities for golang.org/x/net packages sourced from govulndb, expanding Go ecosystem coverage.
    • Merges duplicate Go vulnerability matches with their corresponding GHSA matches to reduce noise in scan results.

    2 details in Everything

18. v0.115.0 Jun 26, 2026 · issue 003

    Grype v0.115.0 adds golang.org/x/net vuln detection from govulndb and deduplicates Go/GHSA matches.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.115.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.115.0

    └──▷ TRY IT
    Scan a Go project image to surface golang.org/x/net CVEs now sourced directly from govulndb, with deduplication against GHSA entries.
    copy

    $ grype <your-go-image>:latest

    • Adds detection of golang.org/x/net vulnerabilities sourced from govulndb, expanding Go ecosystem coverage.
    • Merges duplicate Go vuln matches with their corresponding GHSA matches to reduce noise in scan results.

    2 details in Everything

19. v0.114.0 Jun 5, 2026 · release notes

    Grype v0.114.0 adds Zarf package scanning and improved Go Vulnerability DB OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.114.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.114.0

    └──▷ TRY IT
    Scan a Zarf package archive directly to find vulnerabilities before deployment.
    copy

    $ grype path/to/package.zst

    • Adds ability to scan Zarf packages for vulnerabilities.
    • Adds a GoVulnDB OSV transformer for improved Go vulnerability data processing.
    • Respects withdrawn status of Go Vuln DB OSV records, reducing false-positive findings.

    3 details in Everything

20. v0.114.0 Jun 5, 2026 · issue 003

    Grype v0.114.0 adds Zarf package scanning and a Go Vuln DB OSVOSVOpen Source Vulnerabilities, a vulnerability database and schema maintained by Google that gives cyber tools a machine-readable, cross-ecosystem format for querying and sharing CVE-style advisories. transformer for richer Go vulnerability data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.114.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.114.0

    └──▷ TRY IT
    Scan a Zarf package archive for vulnerabilities across all bundled SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in a single pass, with findings traceable to each source image.
    copy

    $ grype zarf:path/to/package.tar.zst -o json

    • Adds zarf: scan target to scan all SBOMs within a Zarf package archive (.tar.zst), with per-finding provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build. traced back to the originating image via package annotations.
    • Adds a Go Vuln DB OSV transformer to ingest and process govulndb records in OSV format, enabling broader Go vulnerability coverage.
    • Respects withdrawn status of Go Vuln DB OSV records, suppressing false-positive findings from retracted advisories.

    3 details in Everything

21. v0.113.0 Jun 3, 2026 · release notes

    Grype v0.113.0 adds Ubuntu 26.04 resolute support and source RPM filtering on Hummingbird.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.113.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.113.0

    • Adds Ubuntu 26.04 resolute to recognized distro codenames for accurate vulnerability matching.
    • Supports source RPM filtering on the Hummingbird matcher.

    2 details in Everything

22. v0.113.0 Jun 3, 2026 · issue 003

    Grype v0.113.0 adds Ubuntu 26.04 resolute support and source RPM filtering for Hummingbird/CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. matching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.113.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.113.0

    • Adds Ubuntu 26.04 resolute as a recognized distro codename for vulnerability matching.
    • Adds source RPM filtering for Hummingbird (CSAF VEX) matching, reducing false positives by distinguishing binary RPMs from source RPMs using an architecture qualifier.

    2 details in Everything

23. v0.112.0 May 1, 2026 · release notes

    Grype v0.112.0 extends ignore rules to owned sub-packages of distro packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.112.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.112.0

24. v0.111.0 Apr 9, 2026 · release notes

    Grype v0.111.0 adds db diff for v6, CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. support, Hummingbird matching, and in-memory SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. processing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.111.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.111.0

    • Adds db diff command support for v6 vulnerability databases.
    • Adds CSAF VEX transformer for applying CSAF-format VEX documents to scan results.
    • Adds vulnerability matching on Hummingbird packages.
    • Adds ProvideFromReader for in-memory SBOM processing without requiring a file on disk.
    • Adds curated mapping of known CPEs to Grype package specifiers for improved match accuracy.

    +1 more show less

    • HTML report template now includes Grype version and vulnerability DB version.

    6 details in Everything

25. v0.109.0 Feb 19, 2026 · release notes

    Grype v0.109.0 adds Fedora OS support, APK version normalization, and ports the grype-db library directly into Grype.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.109.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.109.0

    • Enables Fedora OS transformer so Fedora-based images are correctly matched against vulnerability data.
    • Strips the v prefix from APK versions for accurate version comparison during vulnerability matching.
    • Ports the grype-db library directly into Grype, consolidating database handling.

    3 details in Everything

26. v0.108.0 Feb 10, 2026 · release notes

    Grype v0.108.0 adds EOL warning suppression, improved VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. matching, and more accurate PostmarketOS scanning.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.108.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.108.0

    • Adds option to disable end-of-life (EOL) warnings in scan output.
    • Improves VEX product and subcomponent matching for more precise vulnerability exception handling.
    • Supports more accurate vulnerability scanning for PostmarketOS distributions.

    3 details in Everything

27. v0.107.0 Jan 29, 2026 · release notes

    Grype v0.107.0 adds SecureOS distro support and Erlang/Elixir (Hex) vulnerability matching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.107.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.107.0

    • Adds SecureOS distro recognition for vulnerability scanning.
    • Adds Hex ecosystem matcher to detect vulnerabilities in Erlang and Elixir packages.

    2 details in Everything

28. v0.106.0 Jan 27, 2026 · release notes

    Grype v0.106.0 warns on EOL distro packages, adds configurable epoch handling, and supports Scientific Linux.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.106.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.106.0

    • Adds warnings when scanned packages belong to end-of-life distributions.
    • New configurable behavior for how Grype handles missing dpkg/RPM epoch fields on incoming packages.
    • Adds support for Scientific Linux as a recognized distro.

    3 details in Everything

29. v0.105.0 Jan 15, 2026 · release notes

    Grype v0.105.0 adds native vulnerability matching for Arch Linux packages.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.105.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.105.0

30. advisory CVE-2025-65965 Nov 24, 2025 · issue 128
    • CVE-2025-65965: Credential disclosure vulnerability in Grype JSON output (affects < 0.104.1)⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
31. v0.104.0 Nov 17, 2025 · release notes

    Grype v0.104.0 adds a --from flag and expiring vulnerability suppressions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.104.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.104.0

    └──▷ TRY IT
    Scan a container image using a specific source with the new --from flag to control where Grype pulls the SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. or image from.
    copy

    $ grype --from <source> <target>

    • Adds --from flag to specify the source for vulnerability scanning input.
    • Supports expiring suppressions so ignored vulnerabilities are automatically re-surfaced after a set date, preventing stale waivers.

    2 details in Everything

32. v0.103.0 Nov 3, 2025 · release notes

    Grype v0.103.0 adds hyphen support in version strings and respects rpmmod PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously. qualifiers for more accurate matching.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.103.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.103.0

    • Supports hyphens in package version strings, enabling accurate matching for versions that include hyphens.
    • Respects the rpmmod PURL qualifier, improving vulnerability matching precision for modular RPM packages.

    2 details in Everything

33. v0.102.0 Oct 23, 2025 · release notes

    Grype v0.102.0 adds AlmaLinux-specific advisories and a built-in Markdown report template.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.102.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.102.0

    • Uses AlmaLinux-specific advisories when scanning AlmaLinux systems for more accurate vulnerability matching.
    • Adds a built-in Markdown output template for report generation.

    2 details in Everything

34. v0.101.0 Oct 15, 2025 · release notes

    Grype v0.101.0 adds fixed-state filtering to db search, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. support for directory/SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. scans, and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. RpmMetadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.101.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.101.0

    • Adds fixed-state filtering to grype db search so practitioners can narrow vulnerability lookups to only fixed (or only unfixed) entries.
    • Supports VEX documents when scanning directories and SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., enabling VEX-based vulnerability suppression beyond just container images.
    • Adds CycloneDX output support for RpmMetadata, enriching CycloneDX SBOMs with RPM package details.

    3 details in Everything

35. v0.100.0 Sep 15, 2025 · release notes

    Grype v0.100.0 adds unaffected package/CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. stores to suppress false-positive vulnerability matches

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.100.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.100.0

    • Adds unaffected package and CPE stores to the vulnerability database, enabling Grype to track which packages are explicitly marked as not affected.
    • Uses the unaffected match table to automatically remove vulnerability matches for packages confirmed unaffected, reducing false positives.

    2 details in Everything

36. v0.99.0 Aug 27, 2025 · release notes

    Grype v0.99.0 adds Raspbian vulnerability matching, VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. support, and fix availability data in DB schema.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.99.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.99.0

    • Adds fix availability information to the DB schema, surfacing whether a fix exists for matched vulnerabilities.
    • Supports vulnerability matching for Raspbian packages.
    • Adds VEX CSAF support for applying CSAF-format VEX documents to filter or contextualize scan results.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !CSAF support introduces a breaking change — existing setups using VEX or related configuration may require updates when upgrading.
37. v0.98.0 Aug 13, 2025 · release notes

    Grype v0.98.0 updates Debian distro tracking: Trixie (13) marked released, Forky (14) added as testing/sid/unstable.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.98.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.98.0

    • Classifies Debian 13 (Trixie) as a released distribution and adds Debian 14 (Forky) as testing/sid/unstable for vulnerability matching.

    1 detail in Everything

38. v0.97.2 Aug 8, 2025 · release notes

    Grype v0.97.2 adds binary classifier for HashiCorp Vault via updated Syft.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.97.2 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.97.2

39. v0.97.0 Jul 30, 2025 · release notes

    Grype v0.97.0 adds RHELRHELRed Hat Enterprise Linux, a commercially supported Linux distribution maintained by Red Hat, chosen by cyber tools for its long support lifecycle, certified hardware compatibility, and enterprise deployment prevalence. Extended Update Support (EUS) matching and distro channel tracking.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.97.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.97.0

    • Adds vulnerability matching support for RHEL Extended Update Support (EUS) streams.
    • Adds channel information to OS/distro detection for more precise distribution identification.

    2 details in Everything

40. v0.96.0 Jul 15, 2025 · release notes

    Grype v0.96.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores and KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use. indicators to CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. vulnerability ratings output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.96.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.96.0

41. v0.95.0 Jul 2, 2025 · release notes

    Grype v0.95.0 adds string severity to DB search JSON output and package specifier overrides for kb, dpkg, and apkg.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.95.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.95.0

    • Adds human-readable string severity field to db search JSON results for easier parsing and filtering.
    • Adds package specifier overrides for kb, dpkg, and apkg package types, giving finer control over vulnerability matching.

    2 details in Everything

42. v0.94.0 Jun 12, 2025 · release notes

    Grype v0.94.0 adds Echo OS vulnerability detection support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.94.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.94.0

43. v0.93.0 Jun 10, 2025 · release notes

    Grype v0.93.0 adds MinimOS scanning, Bitnami vuln DB matching, and RubyGems-native version comparison.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.93.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.93.0

    • Adds scanning support for MinimOS container images.
    • Integrates upstream Bitnami vulnerability database data for package matching.
    • Supports RubyGems-specific version comparison logic for more accurate Ruby vulnerability matching.

    3 details in Everything

44. v0.92.0 May 14, 2025 · release notes

    Grype v0.92.0 adds EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. scores and CISA Known Exploited Vulnerability flags to scan results, plus an improved HTML report template.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.92.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.92.0

    • Adds EPSS (Exploit Prediction Scoring SystemExploit Prediction Scoring SystemExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.) metrics to vulnerability scan results.
    • Adds indication of CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. (KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use.) in scan output.
    • Improves the built-in HTML report template for richer vulnerability output.

    3 details in Everything

45. v0.91.1 Apr 24, 2025 · release notes

    Grype v0.91.1 adds timing info to log output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.91.1 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.91.1

    └──▷ TRY IT
    Capture scan duration by grepping the log for timing data after running a standard scan.
    copy

    $ grype --log-level info <image> | grep "timing"

46. v0.91.0 Apr 1, 2025 · release notes

    Grype v0.91.0 adds CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. metrics in db search JSON output, v5 namespace emulation, and a new exit code for failed scans.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.91.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.91.0

    • Adds CVSS metrics to db search JSON output for richer vulnerability data in automated pipelines.
    • Adds v5 namespace emulation to db search output, improving compatibility when querying the vulnerability database.
    • Exits with a distinct return code when a scan fails (as opposed to a scan that completes but finds vulnerabilities), enabling more precise CI/CD error handling.

    3 details in Everything

47. v0.90.0 Mar 17, 2025 · release notes

    Grype v0.90.0 adds URL-based DB import, distro-name vulnerability matching, and DB URL in JSON output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.90.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.90.0

    └──▷ TRY IT
    Import the Grype vulnerability DB directly from a remote URL instead of a local file — useful in air-gapped pipelines where you host the DB on an internal server.
    copy

    $ grype db import https://internal.example.com/grype-db.tar.gz

    • Matches vulnerabilities by distro name even when no distro version is specified.
    • Supports importing the vulnerability database directly from a URL via grype db import.
    • Adds the database URL to the JSON descriptor block in scan output.

    3 details in Everything

48. v0.88.0 Mar 5, 2025 · release notes

    Grype v0.88.0 adds KEVKEVCISA's Known Exploited Vulnerabilities catalog, a list of vulnerabilities with evidence of exploitation in real attacks. It helps teams prioritize fixes for problems attackers already use./EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. data to v6 DB, a pretty output format, literal CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. input, and configurable Maven rate limiting.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.88.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.88.0

    └──▷ TRY IT
    Find all vulnerabilities published or modified after a specific date, replacing the old grype db diff workflow.
    copy

    $ grype db search --published-after 2025-01-01

    Get a human-readable scan report instead of the default table output.
    copy

    $ grype <image> -o pretty

    • Adds CISA Known Exploited VulnerabilitiesCISA Known Exploited VulnerabilitiesA catalog maintained by the US Cybersecurity and Infrastructure Security Agency listing CVEs confirmed to have been actively exploited in the wild, which cyber tools use as a high-signal prioritization feed for patching and scanning. (KEV) information to the v6 vulnerability database.
    • Adds KEV and EPSS fields to grype db search schema for richer vulnerability querying.
    • New pretty output format option for human-friendly scan results.
    • Allows specifying literal CPEs directly on the CLI as scan targets.
    • Adds configuration for Maven Central rate limit handling.

    +3 more show less

    • Replaces grype db diff with grype db search --modified-after and --published-after flags for filtering vulnerability changes.
    • Migrates database listing URL from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json.
    • Updates vulnerability matchers to use the v6 DB schema.

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !grype db diff has been removed; use grype db search --modified-after and --published-after flags instead.
    • !DB schema v3 and v4 code has been removed; databases using those schemas are no longer supported.
    • !The database listing URL has migrated from https://toolbox-data.anchore.io/grype/databases/listing.json to https://grype.anchore.io/databases/v6/latest.json; any tooling or config hardcoding the old URL must be updated.
49. v0.87.0 Jan 22, 2025 · release notes

    Grype v0.87.0 adds CSAFCSAFAn OASIS open standard for distributing machine-readable vulnerability advisories, letting cyber tools automate ingestion and correlation of vendor-issued security disclosures at scale. custom vulnerability sources and richer VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. product identifiers with package names.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.87.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.87.0

    • Supports CSAF as a custom vulnerability source, enabling teams to feed their own CSAF advisories into Grype scans.
    • Adds package name to VEX product identifiers, improving accuracy when applying VEX statements to matched vulnerabilities.

    2 details in Everything

50. v0.86.0 Dec 9, 2024 · release notes

    Grype v0.86.0 adds missing package info to SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. reports and drops legacy DB schemas v1 & v2.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.86.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.86.0

    • Adds missing package information fields to SARIF report output.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !DB v1 and v2 schemas are removed; any setup relying on these legacy database schema versions will break on upgrade.
51. v0.85.0 Nov 21, 2024 · release notes

    Grype v0.85.0 adds Gradle support for Java scanning and smarter direct-match prioritization.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.85.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.85.0

    • Adds support for scanning Gradle projects in Java dependency analysis.
    • Prefers direct vulnerability match information over indirect matches, improving match accuracy.

    2 details in Everything

52. v0.84.0 Nov 5, 2024 · release notes

    Grype v0.84.0 adds CLI support for scanning a single package by PURLPURLA Package URL — a community-maintained spec for identifying software packages across ecosystems (npm, PyPI, Maven, etc.) with a single, consistent string, letting cyber tools pinpoint exact dependencies unambiguously..

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.84.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.84.0

    └──▷ TRY IT
    Scan one specific package version for vulnerabilities using its PURL instead of an image or lockfile.
    copy

    $ grype 'pkg:pypi/requests@2.28.0'

    • Supports scanning a single PURL directly from the CLI, enabling targeted vulnerability lookups without a full image or SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue..

    1 detail in Everything

53. v0.83.0 Oct 28, 2024 · release notes

    Grype v0.83.0 adds hierarchical config file merging with profile support and a new db providers command.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.83.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.83.0

    └──▷ TRY IT
    List all vulnerability DB providers Grype recognises to verify coverage before an air-gapped DB refresh.
    copy

    $ grype db providers

    • Supports hierarchical merging of config files and named config profiles, letting teams layer shared and per-profile settings.
    • Adds db providers subcommand to list the vulnerability database providers Grype knows about.

    2 details in Everything

54. v0.82.0 Oct 7, 2024 · release notes

    Grype v0.82.0 adds WordPress plugin vulnerability scanning and configurable DB update throttling.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.82.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.82.0

    • Adds WordPress plugin vulnerability detection support.
    • Limits DB update checks to once every 2 hours by default (configurable), reducing overhead on repeated scans.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !v1–v5 DB distribution logic is split into a new legacy package, which may break integrations that import or depend on the previous package structure.
55. v0.81.0 Sep 25, 2024 · release notes

    Grype v0.81.0 adds vulnerability scanning support for Azure Linux 3.0.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.81.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.81.0

56. v0.80.0 Aug 20, 2024 · release notes

    Grype v0.80.0 adds a new db info subcommand to query vulnerability database details directly from the CLI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.80.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.80.0

    └──▷ TRY IT
    Query the local Grype vulnerability database for details on a specific vulnerability without running a full scan.
    copy

    $ grype db info

57. v0.79.0 Jun 14, 2024 · release notes

    Grype v0.79.0 adds checksum signature verification to the installation script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.79.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.79.0

58. v0.78.0 May 28, 2024 · release notes

    Grype v0.78.0 adds grype config command to manage configuration

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.78.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.78.0

59. v0.77.0 Apr 18, 2024 · release notes

    Adds golang.main_module_comparison config option to control Go module versioning in Grype v0.77.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.77.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.77.0

    • Adds golang.main_module_comparison configuration key to enable using the Go main module version for dependency resolution

    1 detail in Everything

60. v0.75.0 Apr 4, 2024 · release notes

    Grype v0.75.0 adds HTTP timeout configuration for source providers

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.75.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.75.0

    • Enable --http-timeout flag to control the duration for HTTP requests during SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. generation

    1 detail in Everything

61. v0.73.0 Nov 7, 2023 · release notes

    Grype v0.73.0 adds a reason field to ignore config and colorizes severity in table output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.73.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.73.0

    └──▷ TRY IT
    Scan a container and see colored severity levels directly in the terminal output
    copy

    $ grype quay.io/library/alpine:latest -o table

62. v0.72.0 Oct 20, 2023 · release notes

    Grype v0.72.0 adds --ignore-states for filtering by fix state and artifact signing support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.72.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.72.0

    └──▷ USE IT
    Scan a container image but ignore any vulnerabilities where the fix status is wont-fix or deferred
    shell copy

    grype --ignore-states wont-fix,deferred myimage:latest

    • Adds the --ignore-states flag to filter findings by their fix state
    • Implements checksum and artifact signing capabilities

    2 details in Everything

63. v0.70.0 Oct 10, 2023 · release notes

    Grype v0.70.0 updates Syft to v0.93.0 and enables golang stdlib matching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.70.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.70.0

    • Enables golang standard library vulnerability matching via the updated Syft dependency (v0.93.0)

    1 detail in Everything

64. v0.68.0 Sep 14, 2023 · release notes

    Grype v0.68.0 adds OpenVEXOpenVEXAn open specification and Go library, maintained by the OpenVEX community, for expressing VEX (Vulnerability Exploitability eXchange) statements in a standard JSON format so cyber tools can automate vulnerability triage. document support and an exit code flag for DB update checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.68.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.68.0

    └──▷ TRY IT
    Scan an image while applying OpenVEX documents to filter false positives or include exceptions.
    copy

    $ grype my-image:v1 --vex path/to/document.vex

    Fail the CI pipeline if Grype fails to update its vulnerability database.
    copy

    $ grype db update --db-check-fail-exit-code 1 || exit 1

    • Adds ability to ignore/add match results based on OpenVEX documents
    • Introduces --db-check-fail-exit-code option for the db update check

    2 details in Everything

65. v0.65.0 Jul 31, 2023 · release notes

    Grype v0.65.0 adds secondary sorting for default JSON output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.65.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.65.0

66. v0.64.1 Jul 17, 2023 · release notes

    Grype v0.64.1 ports the CLI UI to bubbletea

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.64.1 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.64.1

    • Ports the Grype UI to bubbletea for improved terminal interface handling

    1 detail in Everything

67. v0.64.0 Jul 13, 2023 · release notes

    Grype v0.64.0 adds multi-format output with -o flags for simultaneous file writes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.64.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.64.0

    └──▷ USE IT
    Generate SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. results for a CI system and JSON for downstream parsing in a single command.
    shell copy

    grype -o sarif=results.sarif -o json=results.json <image_name>

    • Adds -o flag to write findings to multiple formats and files in one invocation (e.g., -o sarif=output.sarif -o json=output.json)
    • Introduces the ability to specify distinct output files for each format using the new -o format=file syntax

    2 details in Everything

68. v0.63.0 Jun 21, 2023 · release notes

    Grype v0.63.0 adds package names to matchDetails and exposes Go template files for table reports

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.63.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.63.0

    • Always include the specific package name and version used in the vulnerability search in the matchDetails section of the output
    • Expose Go template file that produces the table report
    • Add a folder for community Go templates (see templates/README.md for more details)

    3 details in Everything

69. v0.62.0 May 22, 2023 · release notes

    Adds timestamp and image name to reports, Mariner distro support, Syft IDs in JSON output, and docs for config flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.62.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.62.0

    • Add support for Mariner distribution detection

    1 detail in Everything

70. v0.61.1 Apr 21, 2023 · release notes

    Grype v0.61.1 adds a timestamp field to JSON output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.61.1 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.61.1

    └──▷ USE IT
    Include a timestamp in the JSON report for correlating scan events with external logs or CI timestamps.
    shell copy

    grype ubuntu:20.04 -o json | jq '.timestamp'

71. v0.61.0 Apr 4, 2023 · release notes

    Grype v0.61.0 adds a config option to prefer the registry over local storage when scanning Docker images.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.61.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.61.0

    • Adds registry.prefer-remote configuration key to control whether Grype pulls an image from the remote registry or uses a locally cached/stored copy

    1 detail in Everything

72. v0.60.0 Mar 28, 2023 · release notes

    Grype v0.60.0 introduces --by-cve flag for CVE-focused reporting and changes default matching behavior for JavaScript

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.60.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.60.0

    • Disables CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently.-based matching by default for JavaScript packages, narrowing the vulnerability search surface

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !JavaScript package matching no longer uses CPE-based lookup by default, which may result in fewer reported vulnerabilities for JavaScript components compared to previous versions
73. v0.58.0 Mar 2, 2023 · release notes

    Grype v0.58.0 adds Artifact Hub distribution support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.58.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.58.0

    • artifacthub package index support added via the grype image for easier discovery and installation

    1 detail in Everything

74. v0.56.0 Jan 26, 2023 · release notes

    Adds local file paths to grype db diff via --local-db-path flag.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.56.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.56.0

    • Allows specifying local database files for comparison instead of only the default registry location

    1 detail in Everything

75. v0.55.0 Jan 4, 2023 · release notes

    Grype v0.55.0 now includes CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. component properties in output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.55.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.55.0

76. v0.54.0 Dec 13, 2022 · release notes

    Grype v0.54.0 adds ppc64le support and reports CVE numbers for GHSA matches

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.54.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.54.0

    • Adds official support for the ppc64le architecture platform.
    • Reports the relevant CVE number alongside GHSA identifiers in vulnerability output.

    2 details in Everything

77. v0.52.0 Nov 3, 2022 · release notes

    Grype v0.52.0 adds a --no-suppressed flag to view suppressed vulnerabilities and Ubuntu vulnerability specification support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.52.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.52.0

    • Adds Ubuntu as a supported Vulnerability Specification Source for detection coverage

    1 detail in Everything

78. v0.51.0 Oct 18, 2022 · release notes

    Grype v0.51.0 upgrades the internal vulnerability database schema to version 5.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.51.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.51.0

    • Supports the new schema_v5 vulnerability database format for improved detection accuracy and coverage.

    1 detail in Everything

79. v0.50.2 Sep 20, 2022 · release notes

    Grype v0.50.2 adds distro info to CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. generation and allows development installs via install.sh

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.50.2 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.50.2

    • install.sh now supports development installations.

    1 detail in Everything

80. v0.50.0 Sep 12, 2022 · release notes

    Grype v0.50.0 adds ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. Docker support and RPM package review capabilities

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.50.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.50.0

    • Grype gains the ability to review rpm packages for vulnerabilities.

    1 detail in Everything

81. v0.49.0 Sep 1, 2022 · release notes

    Grype v0.49.0 adds --skip-db-update flag to bypass database checks

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.49.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.49.0

    • Adds --skip-db-update CLI flag to disable automatic vulnerability DB checking and updating

    1 detail in Everything

82. v0.48.0 Aug 24, 2022 · release notes

    Adds s390x architecture support and improved no-OS-distribution messaging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.48.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.48.0

83. v0.45.0 Aug 3, 2022 · release notes

    Grype v0.45.0 adds support for inputting a simple package list and querying by CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. string

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.45.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.45.0

    └──▷ USE IT
    Scan a specific list of packages (e.g. from a requirements file) without building an image.
    shell copy

    grype -p "package-list.txt"

    Query vulnerability data for a specific CPE string directly.
    shell copy

    grype cpe:cpe:2.3:a:vendor:product:*:*:*:*:*:*:*:*

    • Accepts a simple package list as input (-p / --package-list) to scan specific packages without requiring a filesystem image or directory
    • Allows requesting vulnerability data by a single CPE string via the new cpe: input format

    2 details in Everything

84. v0.44.0 Jul 25, 2022 · release notes

    Grype v0.44.0 adds CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. match filtering and ARM32 architecture support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.44.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.44.0

    • Filter CPE matches by target software to reduce false positives
    • Add support for ARM32 (linux/armv7) architecture

    2 details in Everything

85. v0.43.0 Jul 18, 2022 · release notes

    Grype v0.43.0 adds --only-notfixed flag for CLI filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.43.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.43.0

    └──▷ TRY IT
    List only packages that still have a fix available but are currently not fixed in the scanned image.
    copy

    $ grype myimage:latest --only-notfixed

86. v0.42.0 Jul 11, 2022 · release notes

    Grype v0.42.0 adds HTML output templates and a db diff subcommand

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.42.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.42.0

    └──▷ TRY IT
    Compare the installed vulnerability database against a remote source to see what has changed.
    copy

    $ grype db diff

    Generate an HTML report by specifying a custom template file during a scan.
    copy

    $ grype myimage --template /path/to/report.html.tmpl

    • grype db diff subcommand added to inspect vulnerability database changes.
    • HTML template support for customizing grype CLI output format.

    2 details in Everything

87. v0.41.0 Jul 6, 2022 · release notes

    Grype v0.41.0 upgrades to vulnerability database schema v4 for new detection capabilities.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.41.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.41.0

    • Upgrades the internal vulnerability database schema from v3 to v4, enabling support for newer data structures and potential future features.

    1 detail in Everything

88. v0.40.0 Jun 17, 2022 · release notes

    Grype v0.40.0 adds Dockerized workflow for local development

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.40.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.40.0

89. v0.39.0 Jun 9, 2022 · release notes

    Grype v0.39.0 adds SQLite support for RPM databases

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.39.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.39.0

    • Support newer versions of rpm that use Sqlite for the db instead of BerkeleyDB

    1 detail in Everything

90. v0.38.0 May 23, 2022 · release notes

    Grype v0.38.0 adds .NET support for package vulnerability scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.38.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.38.0

    • Adds dotnet detection engine to expand the list of supported ecosystems

    1 detail in Everything

91. v0.37.0 May 13, 2022 · release notes
    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.37.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.37.0

    • Adds Dotnet support to detect .NET application components
92. v0.36.0 Apr 29, 2022 · release notes

    Grype v0.36.0 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. 1.4/VEXVEXA machine-readable statement from a vendor saying whether a CVE in a component actually affects their product. It is how a scanner is told to stop flagging a vulnerability that is not reachable. import support and attestation-based vulnerability reporting

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.36.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.36.0

    └──▷ TRY IT
    Scan a CycloneDX 1.4 SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. to generate a vulnerability report instead of scanning a filesystem or container directly.
    copy

    $ grype spdx:cyclonedx-1.4.json

    Read and validate an attestation file to produce a vulnerability report based on the attested build provenanceprovenanceEvidence recording where a software artifact came from and how it was built, including its source and build process. It helps a consumer check that the artifact matches a trusted build..
    copy

    $ grype attestation:attestation.json

    • Adds import support for CycloneDX 1.4 SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. and VEX artifacts to the scan input pipeline
    • Enables reading attestation files, validating their integrity, and producing a vulnerability report from the attested metadata

    2 details in Everything

93. v0.35.0 Apr 13, 2022 · release notes

    Grype v0.35.0 adds vulnerability location and Maven external data source support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.35.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.35.0

    • Indicate the specific file or package location where a vulnerability was found
    • Support optional external data source references for Maven packages

    2 details in Everything

94. v0.34.1 Mar 15, 2022 · release notes

    Grype v0.34.1 adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. input, and platform selection.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.34.1 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.34.1

    └──▷ USE IT
    Generate a SARIF report for CI/CD integration.
    shell copy

    grype --sarif my-app > results.sarif

    Scan a CycloneDX SBOM file instead of a container image or filesystem.
    shell copy

    grype sbom:cyclonedx:bom.xml

    Specify the architecture/platform for the scan target.
    shell copy

    grype --platform linux/amd64 my-image

    • Adds --sarif flag to enable SARIF report output for findings
    • Adds support for parsing CycloneDX format as SBOM input source
    • Adds --platform flag to specify the target platform for scanning

    3 details in Everything

95. v0.33.0 Feb 15, 2022 · release notes

    Grype v0.33.0 adds --merge flag and SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. input support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.33.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.33.0

96. v0.28.0 Dec 22, 2021 · release notes

    Adds path filtering for file system scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.28.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.28.0

97. v0.26.1 Dec 3, 2021 · release notes

    Grype v0.26.1 adds db list command and custom CA support for DB updates.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.26.1 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.26.1

    └──▷ USE IT
    Check the status of your local vulnerability database without running a full scan.
    shell copy

    grype db list

    • Adds the db list subcommand to display local database status
    • Supports custom CAs for db.update-url via new config keys

    2 details in Everything

98. v0.25.0 Nov 16, 2021 · release notes

    Grype v0.25.0 adds Rocky Linux vulnerability coverage and reuses existing registry auth configs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.25.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.25.0

    • Automatically uses existing registry authentication (e.g., Docker config) when scanning private images

    1 detail in Everything

99. v0.24.0 Oct 25, 2021 · release notes

    Grype v0.24.0 adds Linux ARM64ARM64The 64-bit instruction set architecture from ARM Holdings, used in modern mobile chips, Apple Silicon, and cloud server CPUs; tools target it to run natively on those platforms without emulation overhead. and Windows platform support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v0.24.0 https://github.com/anchore/grype.git
    # already have the repo? check out this version:
    $ git checkout v0.24.0

100. v0.23.0 Oct 11, 2021 · release notes

     Grype v0.23.0 adds a built-in -o flag to write scan reports directly to a file.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.23.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.23.0

     • -o, --output: Write the vulnerability report directly to a specified file path instead of stdout.

     1 detail in Everything

101. v0.22.0 Sep 30, 2021 · release notes

     Grype v0.22.0 adds the ability to ignore vulnerability matches.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.22.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.22.0

     • Adds support for ignoring specific vulnerability matches to reduce false positives

     1 detail in Everything

102. v0.21.0 Sep 28, 2021 · release notes

     Grype v0.21.0 adds data-driven language matching with a default matcher for both language and CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently..

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.21.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.21.0

     • Adds data-driven language matching to improve package identification accuracy
     • Enables default matcher combining language + CPE matching for broader vulnerability coverage

     2 details in Everything

103. v0.20.0 Sep 23, 2021 · release notes

     Grype v0.20.0 adds syft version to grype version output and allows CPECPECommon Platform Enumeration, an NIST-maintained naming scheme that gives software, hardware, and operating systems a structured, machine-readable identifier so cyber tools can match vulnerabilities to affected products consistently. parsing failures

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.20.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.20.0

104. v0.17.0 Aug 25, 2021 · release notes

     Grype v0.17.0 adds Pipfile.lock support via Syft

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.17.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.17.0

     • Added parser for Pipfile.lock to cataloger (via Syft)

     1 detail in Everything

105. v0.15.0 Jul 14, 2021 · release notes

     Grype v0.15.0 adds NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores to JSON output and vendor metadata for vulnerability fixes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.15.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.15.0

106. v0.13.0 Jun 2, 2021 · release notes

     Grype v0.13.0 adds NVDNVDThe National Vulnerability Database, maintained by NIST, is the U.S. government repository of CVE records enriched with CVSS scores and metadata; cyber tools query it to drive vulnerability prioritization. CVSSCVSSCommon Vulnerability Scoring System, a method for describing a vulnerability's characteristics and severity. Its score is not the probability that attackers will exploit it. scores and vendor fix metadata to JSON matches.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.13.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.13.0

107. v0.12.1 May 25, 2021 · release notes

     Grype v0.12.1 exposes database metadata and record source in JSON output

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.12.1 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.12.1

     • json presenter now includes a db_info block containing database version, namespace, and build timestamp

     1 detail in Everything

108. v0.11.0 Apr 22, 2021 · release notes

     Grype v0.11.0 enhances vulnerability analysis with Syft update and refined constraint parsing.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.11.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.11.0

     • Update underlying syft library to v0.15.1 for improved package detection capabilities
     • Refactor constraint expression parser to support quoted versions in version constraints

     2 details in Everything

109. v0.10.2 Apr 14, 2021 · release notes

     Grype v0.10.2 adds direct registry image pulling and user-defined output formats.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.10.2 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.10.2

     • Adds the ability to pull images directly from a container registry without requiring the Docker daemon
     • Adds support for user-defined output formats via a presenter mechanism

     2 details in Everything

110. v0.5.0 Nov 20, 2020 · release notes

     Adds --sbom flag to accept external SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. input documents

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.5.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.5.0

     └──▷ USE IT
     Scan a container image by providing its pre-generated SBOM JSON file directly to Grype.
     shell copy

     grype --sbom syft-output.json

     • Add support for using an SBOM input document instead of invoking syft's cataloging functionality

     1 detail in Everything

111. v0.2.0 Oct 23, 2020 · release notes

     Grype v0.2.0 adds package.json and gemspec catalogers for new language support

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.2.0 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.2.0

     └──▷ USE IT
     Scan a Node.js project directory for vulnerabilities using the new package.json cataloger.
     shell copy

     grype ./path/to/node/project

     • Adds package.json cataloger to scan JavaScript/Node.js dependencies

     1 detail in Everything

112. v0.1.0-beta.10 Prerelease Sep 25, 2020 · release notes

     Grype v0.1.0-beta.10 adds OCIOCIOpen Container Initiative standard, maintained by the Linux Foundation, defining the image format and runtime spec that container tools share so images built once run anywhere OCI-compliant. image scanning support and changes JSON presenter output structure

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.0-beta.10 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.1.0-beta.10

     • Adds oci:// URI scheme support for scanning container images via OCI registries
     • Changes the JSON presenter root from a sequence to a mapping object

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The JSON presenter output root is now an object (mapping) instead of an array (sequence), changing the top-level structure consumers parse.
113. v0.1.0-beta.9 Prerelease Sep 24, 2020 · release notes

     Grype v0.1.0-beta.9 adds --fail-on threshold support and CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. presenter fixes

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.0-beta.9 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.1.0-beta.9

     └──▷ USE IT
     Fail a CI pipeline immediately if any critical vulnerabilities are found.
     shell copy

     grype --fail-on critical <image>

     • Adds --fail-on CLI flag to set exit-code thresholds based on vulnerability severity counts

     1 detail in Everything

114. v0.1.0-beta.8 Prerelease Sep 21, 2020 · release notes

     Adds shell completion and changes JSON output to camelCase

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.0-beta.8 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.1.0-beta.8

     • Adds shell completion support via the Cobra utility (--generate-shell-completion)
     • Changes all JSON output keys from kebab-case to camelCase (e.g., package-name becomes packageName)

     2 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !All JSON output keys are now camelCase; existing parsers expecting kebab-case will break.
115. v0.1.0-beta.7 Prerelease Sep 9, 2020 · release notes

     Grype v0.1.0-beta.7 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. presenter support and --json output for the version command.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.0-beta.7 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.1.0-beta.7

     └──▷ USE IT
     Get the installed Grype version in a format suitable for scripting or CI logs
     shell copy

     grype version --json

     • Adds a new CycloneDX presenter format to export vulnerability matches as a CycloneDX SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue.
     • Adds --json flag to the version subcommand to allow machine-readable version output

     2 details in Everything

116. v0.1.0-beta.5 Prerelease Aug 10, 2020 · release notes

     v0.1.0-beta.5 adds APK package matching, a Count() helper, and the --scope flag to limit scanning scope.

     └──▷ GET THIS VERSION

     copy

     $ git clone --branch v0.1.0-beta.5 https://github.com/anchore/grype.git
     # already have the repo? check out this version:
     $ git checkout v0.1.0-beta.5

     └──▷ USE IT
     Generate shell completion for bash to enable auto-completion in your terminal.
     shell copy

     grype completion bash > /etc/bash_completion.d/grype

     • Adds shell completion script generation via a new CLI command
     • Introduces apk package type support for matching vulnerabilities in Alpine-based images
     • Adds --scope flag to control scan scope, defaulting to squashed (vs all-layers)

     3 details in Everything

     └──▷ BREAKING ON UPGRADE

     • !The default --scope value is now squashed instead of all-layers