https://cybertoolchain.io/tools/grype New releases and features in Grype, tracked by The Cyber Toolchain. en Mon, 19 Oct 2026 20:32:56 GMT https://github.com/anchore/grype/releases/tag/v0.121.0 https://github.com/anchore/grype/releases/tag/v0.121.0 Mon, 19 Oct 2026 20:32:56 GMT Grype v0.121.0 adds OS SUPPORT_END date fallback for end-of-life warnings⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Falls back to the `SUPPORT_END` date from OS release information when generating end-of-life warnings, so distros that publish a support-end date but no explicit EOL date are now flagged correctly.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.120.0 https://github.com/anchore/grype/releases/tag/v0.120.0 Fri, 02 Oct 2026 14:23:18 GMT Grype v0.120.0 adds NVD SSVC decision points, a Locations column in HTML reports, and SLES comprehensive distro coverage.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Stores NVD SSVC decision points in a new v6 decorator table, exposing `GetSsvcs` for richer vulnerability prioritization data.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds a Locations column to the HTML report template to aid vulnerability triage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.119.0 https://github.com/anchore/grype/releases/tag/v0.119.0 Thu, 17 Sep 2026 16:45:23 GMT Grype now surfaces distro-fixed suppressed matches via `--show-suppressed` using the new `include-matcher-suppressions` option.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ • Adds `include-matcher-suppressions` config key (yaml: `include-matcher-suppressions`) to expose matches internally dropped by matchers — such as distro-fixed and built-in false-positive records — in the `ignoredMatches` output, making them visible when `--show-suppressed` is used.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.117.0 https://github.com/anchore/grype/releases/tag/v0.117.0 Mon, 10 Aug 2026 16:54:43 GMT Grype v0.117.0 adds vulnerable version ranges to CycloneDX output and fixes Rust CPE matching via `match.rust.using-cpes`. • Adds vulnerable version ranges to CycloneDX output format, giving richer remediation context in CycloneDX SBOMs. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.116.0 https://github.com/anchore/grype/releases/tag/v0.116.0 Thu, 16 Jul 2026 16:52:20 GMT Grype v0.116.0 adds Go symbol-based reachability analysis, Ubuntu ESM support, architecture-aware matching, and Chainguard OSV integration. • Adds lightweight Go symbol reachability analysis to suppress false positives for stdlib, golang.org/x, and third-party Go vulnerability advisories — only flags binaries that actually import the vulnerable symbols. • Deduplicates Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA). • Supports Ubuntu ESM (Extended Security Maintenance) vulnerability matching. • Adds a Chainguard OSV transformer for processing Chainguard vulnerability data. • Duplicates RHSA advisories across all applicable RHEL minor versions for more complete RHEL coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.116.0 https://github.com/anchore/grype/releases/tag/v0.116.0 Thu, 16 Jul 2026 16:52:20 GMT Grype v0.116.0 adds Go symbol-based reachability analysis, Ubuntu ESM support, architecture-aware matching, and Chainguard OSV integration. • Adds lightweight Go symbol reachability analysis to suppress false positives for stdlib, golang.org/x, and third-party Go vulnerability advisories — only flags binaries that actually import the vulnerable symbols. • Deduplicates Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA). • Supports Ubuntu ESM (Extended Security Maintenance) vulnerability matching. • Adds a Chainguard OSV transformer for processing Chainguard vulnerability data. • Duplicates RHSA advisories across all applicable RHEL minor versions for more complete RHEL coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.115.0 https://github.com/anchore/grype/releases/tag/v0.115.0 Fri, 26 Jun 2026 11:42:04 GMT Grype v0.115.0 adds govulndb-sourced golang.org/x/net vulnerability detection and deduplicates Go vuln/GHSA matches. • Emits vulnerabilities for golang.org/x/net packages sourced from govulndb, expanding Go ecosystem coverage. • Merges duplicate Go vulnerability matches with their corresponding GHSA matches to reduce noise in scan results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.115.0 https://github.com/anchore/grype/releases/tag/v0.115.0 Fri, 26 Jun 2026 11:42:04 GMT Grype v0.115.0 adds golang.org/x/net vuln detection from govulndb and deduplicates Go/GHSA matches. • Adds detection of golang.org/x/net vulnerabilities sourced from govulndb, expanding Go ecosystem coverage. • Merges duplicate Go vuln matches with their corresponding GHSA matches to reduce noise in scan results. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.114.0 https://github.com/anchore/grype/releases/tag/v0.114.0 Fri, 05 Jun 2026 16:17:05 GMT Grype v0.114.0 adds Zarf package scanning and improved Go Vulnerability DB OSV support. • Adds ability to scan Zarf packages for vulnerabilities. • Adds a GoVulnDB OSV transformer for improved Go vulnerability data processing. • Respects withdrawn status of Go Vuln DB OSV records, reducing false-positive findings. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.114.0 https://github.com/anchore/grype/releases/tag/v0.114.0 Fri, 05 Jun 2026 16:17:05 GMT Grype v0.114.0 adds Zarf package scanning and a Go Vuln DB OSV transformer for richer Go vulnerability data. • Adds `zarf:` scan target to scan all SBOMs within a Zarf package archive (.tar.zst), with per-finding provenance traced back to the originating image via package annotations. • Adds a Go Vuln DB OSV transformer to ingest and process govulndb records in OSV format, enabling broader Go vulnerability coverage. • Respects withdrawn status of Go Vuln DB OSV records, suppressing false-positive findings from retracted advisories. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.113.0 https://github.com/anchore/grype/releases/tag/v0.113.0 Wed, 03 Jun 2026 14:19:21 GMT Grype v0.113.0 adds Ubuntu 26.04 'resolute' support and source RPM filtering on Hummingbird. • Adds Ubuntu 26.04 'resolute' to recognized distro codenames for accurate vulnerability matching. • Supports source RPM filtering on the Hummingbird matcher. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.113.0 https://github.com/anchore/grype/releases/tag/v0.113.0 Wed, 03 Jun 2026 14:19:21 GMT Grype v0.113.0 adds Ubuntu 26.04 "resolute" support and source RPM filtering for Hummingbird/CSAF VEX matching. • Adds Ubuntu 26.04 "resolute" as a recognized distro codename for vulnerability matching. • Adds source RPM filtering for Hummingbird (CSAF VEX) matching, reducing false positives by distinguishing binary RPMs from source RPMs using an architecture qualifier. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.112.0 https://github.com/anchore/grype/releases/tag/v0.112.0 Fri, 01 May 2026 19:12:37 GMT Grype v0.112.0 extends ignore rules to owned sub-packages of distro packages. • Extends ignore rules to cover owned sub-packages of distro packages, so a single ignore rule suppresses vulnerabilities across all related sub-packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.111.0 https://github.com/anchore/grype/releases/tag/v0.111.0 Thu, 09 Apr 2026 13:29:25 GMT Grype v0.111.0 adds db diff for v6, CSAF VEX support, Hummingbird matching, and in-memory SBOM processing. • Adds `db diff` command support for v6 vulnerability databases. • Adds CSAF VEX transformer for applying CSAF-format VEX documents to scan results. • Adds vulnerability matching on Hummingbird packages. • Adds `ProvideFromReader` for in-memory SBOM processing without requiring a file on disk. • Adds curated mapping of known CPEs to Grype package specifiers for improved match accuracy. • HTML report template now includes Grype version and vulnerability DB version. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.109.0 https://github.com/anchore/grype/releases/tag/v0.109.0 Thu, 19 Feb 2026 16:38:10 GMT Grype v0.109.0 adds Fedora OS support, APK version normalization, and ports the grype-db library directly into Grype. • Enables Fedora OS transformer so Fedora-based images are correctly matched against vulnerability data. • Strips the `v` prefix from APK versions for accurate version comparison during vulnerability matching. • Ports the grype-db library directly into Grype, consolidating database handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.108.0 https://github.com/anchore/grype/releases/tag/v0.108.0 Tue, 10 Feb 2026 18:49:12 GMT Grype v0.108.0 adds EOL warning suppression, improved VEX matching, and more accurate PostmarketOS scanning. • Adds option to disable end-of-life (EOL) warnings in scan output. • Improves VEX product and subcomponent matching for more precise vulnerability exception handling. • Supports more accurate vulnerability scanning for PostmarketOS distributions. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.107.0 https://github.com/anchore/grype/releases/tag/v0.107.0 Thu, 29 Jan 2026 22:24:48 GMT Grype v0.107.0 adds SecureOS distro support and Erlang/Elixir (Hex) vulnerability matching. • Adds SecureOS distro recognition for vulnerability scanning. • Adds Hex ecosystem matcher to detect vulnerabilities in Erlang and Elixir packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.106.0 https://github.com/anchore/grype/releases/tag/v0.106.0 Tue, 27 Jan 2026 14:08:53 GMT Grype v0.106.0 warns on EOL distro packages, adds configurable epoch handling, and supports Scientific Linux. • Adds warnings when scanned packages belong to end-of-life distributions. • New configurable behavior for how Grype handles missing dpkg/RPM epoch fields on incoming packages. • Adds support for Scientific Linux as a recognized distro. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.105.0 https://github.com/anchore/grype/releases/tag/v0.105.0 Thu, 15 Jan 2026 23:07:39 GMT Grype v0.105.0 adds native vulnerability matching for Arch Linux packages. • Adds an Arch Linux matcher, enabling vulnerability detection for Arch Linux packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.104.0 https://github.com/anchore/grype/releases/tag/v0.104.0 Mon, 17 Nov 2025 22:39:08 GMT Grype v0.104.0 adds a `--from` flag and expiring vulnerability suppressions. • Adds `--from` flag to specify the source for vulnerability scanning input. • Supports expiring suppressions so ignored vulnerabilities are automatically re-surfaced after a set date, preventing stale waivers. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.103.0 https://github.com/anchore/grype/releases/tag/v0.103.0 Mon, 03 Nov 2025 20:00:40 GMT Grype v0.103.0 adds hyphen support in version strings and respects rpmmod PURL qualifiers for more accurate matching. • Supports hyphens in package version strings, enabling accurate matching for versions that include hyphens. • Respects the `rpmmod` PURL qualifier, improving vulnerability matching precision for modular RPM packages. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.102.0 https://github.com/anchore/grype/releases/tag/v0.102.0 Thu, 23 Oct 2025 10:59:26 GMT Grype v0.102.0 adds AlmaLinux-specific advisories and a built-in Markdown report template. • Uses AlmaLinux-specific advisories when scanning AlmaLinux systems for more accurate vulnerability matching. • Adds a built-in Markdown output template for report generation. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.101.0 https://github.com/anchore/grype/releases/tag/v0.101.0 Wed, 15 Oct 2025 17:15:25 GMT Grype v0.101.0 adds fixed-state filtering to `db search`, VEX support for directory/SBOM scans, and CycloneDX RpmMetadata. • Adds fixed-state filtering to `grype db search` so practitioners can narrow vulnerability lookups to only fixed (or only unfixed) entries. • Supports VEX documents when scanning directories and SBOMs, enabling VEX-based vulnerability suppression beyond just container images. • Adds CycloneDX output support for RpmMetadata, enriching CycloneDX SBOMs with RPM package details. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.100.0 https://github.com/anchore/grype/releases/tag/v0.100.0 Mon, 15 Sep 2025 22:06:37 GMT Grype v0.100.0 adds unaffected package/CPE stores to suppress false-positive vulnerability matches • Adds unaffected package and CPE stores to the vulnerability database, enabling Grype to track which packages are explicitly marked as not affected. • Uses the unaffected match table to automatically remove vulnerability matches for packages confirmed unaffected, reducing false positives. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.99.0 https://github.com/anchore/grype/releases/tag/v0.99.0 Wed, 27 Aug 2025 00:47:35 GMT Grype v0.99.0 adds Raspbian vulnerability matching, VEX CSAF support, and fix availability data in DB schema. • Adds fix availability information to the DB schema, surfacing whether a fix exists for matched vulnerabilities. • Supports vulnerability matching for Raspbian packages. • Adds VEX CSAF support for applying CSAF-format VEX documents to filter or contextualize scan results. Breaking changes: • CSAF support introduces a breaking change — existing setups using VEX or related configuration may require updates when upgrading. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.98.0 https://github.com/anchore/grype/releases/tag/v0.98.0 Wed, 13 Aug 2025 17:38:04 GMT Grype v0.98.0 updates Debian distro tracking: Trixie (13) marked released, Forky (14) added as testing/sid/unstable. • Classifies Debian 13 (Trixie) as a released distribution and adds Debian 14 (Forky) as testing/sid/unstable for vulnerability matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.97.2 https://github.com/anchore/grype/releases/tag/v0.97.2 Fri, 08 Aug 2025 19:45:03 GMT Grype v0.97.2 adds binary classifier for HashiCorp Vault via updated Syft. • Adds binary classifier for HashiCorp Vault, enabling detection of Vault installations from binary artifacts. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.97.0 https://github.com/anchore/grype/releases/tag/v0.97.0 Wed, 30 Jul 2025 19:29:46 GMT Grype v0.97.0 adds RHEL Extended Update Support (EUS) matching and distro channel tracking. • Adds vulnerability matching support for RHEL Extended Update Support (EUS) streams. • Adds channel information to OS/distro detection for more precise distribution identification. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.96.0 https://github.com/anchore/grype/releases/tag/v0.96.0 Tue, 15 Jul 2025 13:13:59 GMT Grype v0.96.0 adds EPSS scores and KEV indicators to CycloneDX vulnerability ratings output. • Adds EPSS score and KEV (Known Exploited Vulnerability) indications as `vulnerabilities.ratings` entries in CycloneDX report output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.95.0 https://github.com/anchore/grype/releases/tag/v0.95.0 Wed, 02 Jul 2025 17:26:05 GMT Grype v0.95.0 adds string severity to DB search JSON output and package specifier overrides for kb, dpkg, and apkg. • Adds human-readable string severity field to `db search` JSON results for easier parsing and filtering. • Adds package specifier overrides for `kb`, `dpkg`, and `apkg` package types, giving finer control over vulnerability matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.94.0 https://github.com/anchore/grype/releases/tag/v0.94.0 Thu, 12 Jun 2025 14:59:10 GMT Grype v0.94.0 adds Echo OS vulnerability detection support. • Adds support for scanning Echo OS, enabling vulnerability detection for that operating system. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.93.0 https://github.com/anchore/grype/releases/tag/v0.93.0 Tue, 10 Jun 2025 12:51:14 GMT Grype v0.93.0 adds MinimOS scanning, Bitnami vuln DB matching, and RubyGems-native version comparison. • Adds scanning support for MinimOS container images. • Integrates upstream Bitnami vulnerability database data for package matching. • Supports RubyGems-specific version comparison logic for more accurate Ruby vulnerability matching. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.92.0 https://github.com/anchore/grype/releases/tag/v0.92.0 Wed, 14 May 2025 17:16:23 GMT Grype v0.92.0 adds EPSS scores and CISA Known Exploited Vulnerability flags to scan results, plus an improved HTML report template. • Adds EPSS (Exploit Prediction Scoring System) metrics to vulnerability scan results. • Adds indication of CISA Known Exploited Vulnerabilities (KEV) in scan output. • Improves the built-in HTML report template for richer vulnerability output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.91.1 https://github.com/anchore/grype/releases/tag/v0.91.1 Thu, 24 Apr 2025 21:30:47 GMT Grype v0.91.1 adds timing info to log output • Adds timing info to log output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.91.0 https://github.com/anchore/grype/releases/tag/v0.91.0 Tue, 01 Apr 2025 16:11:54 GMT Grype v0.91.0 adds CVSS metrics in `db search` JSON output, v5 namespace emulation, and a new exit code for failed scans. • Adds CVSS metrics to `db search` JSON output for richer vulnerability data in automated pipelines. • Adds v5 namespace emulation to `db search` output, improving compatibility when querying the vulnerability database. • Exits with a distinct return code when a scan fails (as opposed to a scan that completes but finds vulnerabilities), enabling more precise CI/CD error handling. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.90.0 https://github.com/anchore/grype/releases/tag/v0.90.0 Mon, 17 Mar 2025 20:58:34 GMT Grype v0.90.0 adds URL-based DB import, distro-name vulnerability matching, and DB URL in JSON output. • Matches vulnerabilities by distro name even when no distro version is specified. • Supports importing the vulnerability database directly from a URL via `grype db import`. • Adds the database URL to the JSON descriptor block in scan output. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.88.0 https://github.com/anchore/grype/releases/tag/v0.88.0 Wed, 05 Mar 2025 20:36:08 GMT Grype v0.88.0 adds KEV/EPSS data to v6 DB, a pretty output format, literal CPE input, and configurable Maven rate limiting. • Adds CISA Known Exploited Vulnerabilities (KEV) information to the v6 vulnerability database. • Adds KEV and EPSS fields to `grype db search` schema for richer vulnerability querying. • New `pretty` output format option for human-friendly scan results. • Allows specifying literal CPEs directly on the CLI as scan targets. • Adds configuration for Maven Central rate limit handling. • Replaces `grype db diff` with `grype db search --modified-after` and `--published-after` flags for filtering vulnerability changes. • Migrates database listing URL from `https://toolbox-data.anchore.io/grype/databases/listing.json` to `https://grype.anchore.io/databases/v6/latest.json`. • Updates vulnerability matchers to use the v6 DB schema. Breaking changes: • `grype db diff` has been removed; use `grype db search --modified-after` and `--published-after` flags instead. • DB schema v3 and v4 code has been removed; databases using those schemas are no longer supported. • The database listing URL has migrated from `https://toolbox-data.anchore.io/grype/databases/listing.json` to `https://grype.anchore.io/databases/v6/latest.json`; any tooling or config hardcoding the old URL must be updated. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.87.0 https://github.com/anchore/grype/releases/tag/v0.87.0 Wed, 22 Jan 2025 21:01:32 GMT Grype v0.87.0 adds CSAF custom vulnerability sources and richer VEX product identifiers with package names. • Supports CSAF as a custom vulnerability source, enabling teams to feed their own CSAF advisories into Grype scans. • Adds package name to VEX product identifiers, improving accuracy when applying VEX statements to matched vulnerabilities. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.86.0 https://github.com/anchore/grype/releases/tag/v0.86.0 Mon, 09 Dec 2024 22:06:46 GMT Grype v0.86.0 adds missing package info to SARIF reports and drops legacy DB schemas v1 & v2. • Adds missing package information fields to SARIF report output. Breaking changes: • DB v1 and v2 schemas are removed; any setup relying on these legacy database schema versions will break on upgrade. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.85.0 https://github.com/anchore/grype/releases/tag/v0.85.0 Thu, 21 Nov 2024 15:29:44 GMT Grype v0.85.0 adds Gradle support for Java scanning and smarter direct-match prioritization. • Adds support for scanning Gradle projects in Java dependency analysis. • Prefers direct vulnerability match information over indirect matches, improving match accuracy. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.84.0 https://github.com/anchore/grype/releases/tag/v0.84.0 Tue, 05 Nov 2024 15:03:57 GMT Grype v0.84.0 adds CLI support for scanning a single package by PURL. • Supports scanning a single PURL directly from the CLI, enabling targeted vulnerability lookups without a full image or SBOM. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.83.0 https://github.com/anchore/grype/releases/tag/v0.83.0 Mon, 28 Oct 2024 22:03:36 GMT Grype v0.83.0 adds hierarchical config file merging with profile support and a new `db providers` command. • Supports hierarchical merging of config files and named config profiles, letting teams layer shared and per-profile settings. • Adds `db providers` subcommand to list the vulnerability database providers Grype knows about. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.82.0 https://github.com/anchore/grype/releases/tag/v0.82.0 Mon, 07 Oct 2024 21:45:12 GMT Grype v0.82.0 adds WordPress plugin vulnerability scanning and configurable DB update throttling. • Adds WordPress plugin vulnerability detection support. • Limits DB update checks to once every 2 hours by default (configurable), reducing overhead on repeated scans. Breaking changes: • v1–v5 DB distribution logic is split into a new `legacy` package, which may break integrations that import or depend on the previous package structure. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.81.0 https://github.com/anchore/grype/releases/tag/v0.81.0 Wed, 25 Sep 2024 17:06:44 GMT Grype v0.81.0 adds vulnerability scanning support for Azure Linux 3.0. • Adds distro mapping and vulnerability scanning support for Azure Linux 3.0. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.80.0 https://github.com/anchore/grype/releases/tag/v0.80.0 Tue, 20 Aug 2024 18:05:33 GMT Grype v0.80.0 adds a new `db info` subcommand to query vulnerability database details directly from the CLI. • Adds `grype db info` subcommand to query Grype's vulnerability database for detailed vulnerability information. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.79.0 https://github.com/anchore/grype/releases/tag/v0.79.0 Fri, 14 Jun 2024 21:10:49 GMT Grype v0.79.0 adds checksum signature verification to the installation script • Adds signature verification for the Grype installation script checksums Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.78.0 https://github.com/anchore/grype/releases/tag/v0.78.0 Tue, 28 May 2024 18:01:12 GMT Grype v0.78.0 adds `grype config` command to manage configuration • Adds `grype config` subcommand to inspect and manage Grype's configuration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.77.0 https://github.com/anchore/grype/releases/tag/v0.77.0 Thu, 18 Apr 2024 19:22:34 GMT Adds `golang.main_module_comparison` config option to control Go module versioning in Grype v0.77.0 • Adds `golang.main_module_comparison` configuration key to enable using the Go main module version for dependency resolution Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.75.0 https://github.com/anchore/grype/releases/tag/v0.75.0 Thu, 04 Apr 2024 16:10:46 GMT Grype v0.75.0 adds HTTP timeout configuration for source providers • Enable `--http-timeout` flag to control the duration for HTTP requests during SBOM generation Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype https://github.com/anchore/grype/releases/tag/v0.73.0 https://github.com/anchore/grype/releases/tag/v0.73.0 Tue, 07 Nov 2023 21:04:54 GMT Grype v0.73.0 adds a reason field to ignore config and colorizes severity in table output • Colorize severity in table output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/grype