Bug Fixes

• Ensure channel parsing is consistent [PR #3603 @wagoodman]
• Scope Go GHSA twins by shared CVE [PR #3592 @wagoodman]
• do not cache a comparator that failed to build [PR #3567 @arpitjain099]
• Add fix date to rhel minor records created from rhsa [PR #3585 @wagoodman]
• grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #3591]
• panic: index out of range in distro.parseVersion for VERSION_ID=v [Issue #3588] [PR #3589 @matiasinsaurralde]
• False Positive: GO-2026-5932 [Issue #3573]

Dependencies

30 dependency changes (30 updated). 1 vulnerability remediated.

🟢 Remediated (1)

• GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc

(Full Changelog)

Added Features

• duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode]
• add chainguard osv transformer [PR #3474 @crosleyzack]
• populate package architecture for matching [PR #3504 @willmurphyscode]
• lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs]
• Deduplicate Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA) [Issue #3511] [PR #3509 @spiffcs]
• Support Ubuntu ESM [Issue #3544] [PR #3546 @wagoodman]

Bug Fixes

• regenerate v6.1.8 blob and sql schemas [PR #3574 @spiffcs]
• rhel version streams [PR #3572 @kzantow]
• Grype doesn't match u-boot in SBOM if type is set to firmware [Issue #2537]
• Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go [Issue #1782]
• Zarf scans emit warnings for consistently unreadable files (i.e., included non-SBOMs) [Issue #3516] [PR #3545 @brandtkeller]
• Fail parsing github actions [Issue #3220]
• Go vulnerability returned when installed version is greater than fixed version [Issue #3520]

Dependencies

14 dependency changes (11 updated, 3 added).

(Full Changelog)

Added Features

• emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode]
• Merge Go vuln matches with GHSA matches [Issue #3515]

Bug Fixes

• only emit records for stdlib [PR #3527 @willmurphyscode]
• mark hummingbird distro as rolling [PR #3521 @willmurphyscode]
• disable go stdlib CPE matching by default [PR #3517 @willmurphyscode]
• merge in custom ranges when applicable [PR #3514 @willmurphyscode]
• exclude linux-kbuild deb indirect matches by default [PR #3506 @westonsteimel]
• avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
• Support reading CycloneDX 1.7 SBOMs [Issue #3373]
• Grype cannot read mariadb version correctly [Issue #3452]
• grype hangs when downloading certain images using registry client [Issue #3492]
• Can we get a fix for these Critical findings reported for grype [Issue #3484]

Additional Changes

• Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #3493]
• Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #3494]

Dependencies

35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.

🟢 Remediated (5)

• GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
• GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
• GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
• GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
• GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2

(Full Changelog)

Added Features

• Add ability to scan zarf packages [#3329 #3366 @brandtkeller]

Additional Changes

• respect withdrawn status of Go Vuln DB OSV records [#3495 @willmurphyscode]
• Govulndb OSV transformer [#3485 @willmurphyscode]

(Full Changelog)

Added Features

• Include Ubuntu 26.04 "resolute" in distro codenames [#3397 @anchore-oss-update-bot]
• source RPM filtering on Hummingbird [#3410 @willmurphyscode]

Bug Fixes

• use relatedVulnerabilities description as fallback in SARIF output [#3271 @axidex]
• improve platform CPE determination logic [#3470 @westonsteimel]
• normalize uppercase V in semantic version comparison [#3461 @immanuwell]
• purl handling in cgr maven libs [#3420 @willmurphyscode]
• Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#3037 #3089 @wasup-yash]
• Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#3101 #3396 @Dashtid]
• Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#3442 #3475 @msnandhis]
• zsh completion fails [#2933 #3433 @brandtkeller]

(Full Changelog)

Added Features

• Expand ignore rules to owned sub packages of distro packages [#3368 #3326 @kzantow]

Additional Changes

• update anchore dependencies [#3391 @anchore-oss-update-bot]

(Full Changelog)

Bug Fixes

• apply overlap by ownership removal to dynamically created relationships [#3363 @kzantow]
• compare mismatched package / db versions [#3372 @kzantow]
• Grype doesn't recognize debian component when "group" : "debian" is specified [#2967]
• HelpURI missing information in SARIF output [#2874 #3351 @will-bates11]

(Full Changelog)

Added Features

• db diff for v6 [#3277 @kzantow]
• add ProvideFromReader for in-memory SBOM processing [#3344 @jspilman]
• match on hummingbird [#3331 @willmurphyscode]
• CSAF vex transformer [#3349 @willmurphyscode]
• curated mapping of known CPE to grype package specifiers [#3332 @westonsteimel]
• templates/html.tmpl - Add Grype version and vulnerability DB version [#2877 #3345 @kenvez]

Bug Fixes

• normalise version constraint types in v6 db [#3328 @westonsteimel]
• set alpm ecosystem for Arch Linux packages [#3324 @westonsteimel]
• spec-compliant CPE string formatting for db search commands [#3308 @westonsteimel]
• Update APK NAK handling to be based on ownership-by-file-overlap relationship [#3267 #3286 @kzantow]
• Wrong version output [#3306]

Additional Changes

• update anchore dependencies [#3321 @anchore-oss-update-bot]
• update tool versions [#3319 @anchore-oss-update-bot]

(Full Changelog)

Added Features

• suppress GHSA matches on language packages in fixed APKs [#3282 @willmurphyscode]

Bug Fixes

• use Syft for decoding CPEs [#3058 @chovanecadam]

Additional Changes

• bump github.com/buger/jsonparser to v1.1.2 [#3297 @willmurphyscode]
• update quality gate labels [#3293 @westonsteimel]

(Full Changelog)

Bug Fixes

• CVE-2025-12183 is not detected even if vulnerable jar is present [#3205]

Additional Changes

• migrate fixtures to testdata [#3263 @wagoodman]

(Full Changelog)