v0.71.0

Added Features

• use ghsa to improve matching for cpes [#811 #1412 @westonsteimel]

(Full Changelog)

v0.70.0

Added Features

• Update Syft to v0.93.0 + enable golang stdlib matching [#1550 @spiffcs ]

Bug Fixes

• JSON output: descriptor name is missing "grype" value [#1538 #1542 @kzantow]

(Full Changelog)

v0.69.1

Bug Fixes

• Incorrect python version comparisons for rc releases [#986 #1510 @willmurphyscode]
• False Positive: CVE-2023-37920 reported for certifi library in python [#1417 #1510 @willmurphyscode]
• Grype is not recognizing python-certifi is patched for GHSA-43fp-rhv2-5gv8 [#1172 #1510 @willmurphyscode]
• False positive on certifi 2022.12.07 [#1034 #1510 @willmurphyscode]
• Leading zeros seen as difference in version numbers [#1430 #1510 @willmurphyscode]

Additional Changes

• add OpenSSF Best Practices badge [#1523 @spiffcs]
• Bump vulnerability match labels [#1525 @wagoodman]
• bump stereoscope to fix data race in UI [#1517 @willmurphyscode]

(Full Changelog)

v0.69.0

Added Features

• Upgrade syft to v0.91.0 (and CycloneDX to v1.5) [#1508 @wagoodman]

Bug Fixes

• Grype doesn't exit cleanly on error [#1492 #1505 @kzantow]

Additional Changes

• Fix typo in flag on Readme [#1501 @robszumski]
• pin cache versions [#1495 @spiffcs]

(Full Changelog)

v0.68.1

v0.68.1 (2023-09-15)

Full Changelog

Bug Fixes

• Version output was not including supported db schema [PR #1494] [kzantow]

v0.68.0

v0.68.0 (2023-09-14)

Full Changelog

Added Features

• Ignore/add match results based on OpenVEX documents [PR #1397] [puerco]
• Introduce exit code failure option for db update check [PR #1463] [devfbe]

Bug Fixes

• Fix race conditions around stager, enable detector [PR #1489] [willmurphyscode]
• Grype hangs forever if gets interrupted during work (in rare cases) [Issue #1427] [PR #1437] [kzantow]

v0.67.0

v0.67.0 (2023-09-11)

Full Changelog

Additional Changes

• chore: bump quality gate to use syft v0.89.0 [PR #1479] [westonsteimel]
• chore: update grype to use Go v1.21 [PR #1480] [spiffcs]

v0.66.0

v0.66.0 (2023-08-31)

Full Changelog

Added Features

• Allow for access to private CAs securely [Issue #1226] [PR #1232] [5p2O5pe25ouT]
• Filter out packages that are owned by OS packages (ownership overlap) [Issue #1373] [PR #1387] [willmurphyscode]

Bug Fixes

• fix: Only remove packages by binary overlap [PR #1444] [willmurphyscode]
• New version notice only showing the version and no text [PR #1445] [wagoodman]
• fix: set correct default to exclude overlapping binaries [PR #1452] [kzantow]
• Portage version comparison is not working [Issue #1459] [PR #1468] [barnuri]

Additional Changes

• Update Syft to 0.89.0

v0.65.2

v0.65.2 (2023-08-17)

Full Changelog

Additional Changes

• Update Syft to v0.87.1
• Add a simple JUnit XML template [PR #1422] [YevheniiPokhvalii]
• Update semver regular expression constraint to allow for 1.20rc1 cases no '-' [PR #1434] [spiffcs]

v0.65.1

v0.65.1 (2023-08-04)

Full Changelog

Bug Fixes

• Grype cannot read SPDX documents generated by SPDX-maven-plugin [Issue #1306]