github.com/anchore/grype
v0.117.0
anchore/grype
What this package is like to depend on
Last release 2 days ago
21 Aug 2026
Ships on a steady schedule
a new release about every 1 weeks
Rarely documented
notes for 10 of 200 stable releases
Nothing withdrawn
no release was ever pulled
6 years old
894 releases · first in 2020
208 releases in the last 12 months
see the full history below
Release timeline
894 releases · Jul 2020 to Aug 2026Releases
latest 60 of 894-
v0.117.1-0.20260821160051-ab6707d1d57521 Aug 2026 pre-releaseNothing published for this version
-
v0.117.1-0.20260814155136-ffbca561d57614 Aug 2026 pre-releaseNothing published for this version
-
v0.117.010 Aug 2026Release notes
Open source →Added Features
Bug Fixes
Dependencies
11 dependency changes (11 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
- GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5
- github.com/anchore/syft
v1.50.0→v1.51.0 - github.com/diskfs/go-diskfs
v1.9.3→v1.9.4 - github.com/gabriel-vasile/mimetype
v1.4.13→v1.4.15 - github.com/go-git/go-billy/v5
v5.9.0→v5.9.1 - github.com/go-git/go-git/v5
v5.19.1→v5.19.2(🟢 remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j) - github.com/klauspost/compress
v1.19.0→v1.19.1 - github.com/magiconair/properties
v1.8.10→v1.18.11 - github.com/santhosh-tekuri/jsonschema/v6
v6.0.2→v6.0.3 - github.com/ulikunitz/xz
v0.5.15→v0.5.16 - go.yaml.in/yaml/v3
v3.0.4→v3.0.5 - modernc.org/sqlite
v1.54.0→v1.55.0
Release notes
Open source →b5fa92b
This commit was created on GitHub.com and signed with GitHub’s verified signature .
GPG key ID: B5690EEEBB952194
Verified Learn about vigilant mode .
Added Features
- Include vulnerable ranges in CycloneDX output format [Issue #3512 ] [PR #3519 @somaz94 ]
Bug Fixes
- honor match.rust.using-cpes configuration [PR #3611 @Dashtid ]
Dependencies
11 dependency changes (11 updated). 2 vulnerabilities remediated.
🟢 Remediated (2)
-
GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5
-
GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5 Updated (11 packages)
-
github.com/anchore/syft v1.50.0 → v1.51.0
-
github.com/diskfs/go-diskfs v1.9.3 → v1.9.4
-
github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15
-
github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1
-
github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 (🟢 remediated GHSA-hc8v-wwc9-vgxm , GHSA-qgq7-7hm3-q39j )
-
github.com/klauspost/compress v1.19.0 → v1.19.1
-
github.com/magiconair/properties v1.8.10 → v1.18.11
-
github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3
-
github.com/ulikunitz/xz v0.5.15 → v0.5.16
-
go.yaml.in/yaml/v3 v3.0.4 → v3.0.5
-
modernc.org/sqlite v1.54.0 → v1.55.0
(Full Changelog)
Contributors
Dashtid and somaz94
-
v0.116.2-0.20260809050734-31c8fa181ada09 Aug 2026 pre-releaseNothing published for this version
-
v0.116.2-0.20260807155835-709e090289cd07 Aug 2026 pre-releaseNothing published for this version
-
v0.116.2-0.20260803144731-970b4d10288603 Aug 2026 pre-releaseNothing published for this version
-
v0.116.2-0.20260731155716-f8e0d226de8131 Jul 2026 pre-releaseNothing published for this version
-
v0.116.2-0.20260730165742-36970a7a8d0730 Jul 2026 pre-releaseNothing published for this version
-
v0.116.128 Jul 2026Release notes
Open source →Bug Fixes
- Ensure channel parsing is consistent [PR #3603 @wagoodman]
- Scope Go GHSA twins by shared CVE [PR #3592 @wagoodman]
- do not cache a comparator that failed to build [PR #3567 @arpitjain099]
- Add fix date to rhel minor records created from rhsa [PR #3585 @wagoodman]
- grype reporting CVE-64091 as critical - redhat says it is not affected [Issue #3591]
- panic: index out of range in distro.parseVersion for VERSION_ID=v [Issue #3588] [PR #3589 @matiasinsaurralde]
- False Positive: GO-2026-5932 [Issue #3573]
Dependencies
30 dependency changes (30 updated). 1 vulnerability remediated.
🟢 Remediated (1)
- GHSA-hrxh-6v49-42gf (High) — google.golang.org/grpc
- github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
v1.31.0→v1.32.0 - github.com/anchore/stereoscope
v0.2.2→v0.3.0 - github.com/anchore/syft
v1.48.0→v1.50.0 - github.com/cncf/xds/go
v0.0.0-ee656c7→v0.0.0-dba9d58 - github.com/containerd/containerd/v2
v2.3.2→v2.3.3 - github.com/docker/cli
v29.5.3+incompatible→v29.6.1+incompatible - github.com/envoyproxy/go-control-plane/envoy
v1.36.0→v1.37.0 - github.com/envoyproxy/protoc-gen-validate
v1.3.0→v1.3.3 - github.com/gkampitakis/go-snaps
v0.5.22→v0.5.23 - github.com/gpustack/gguf-parser-go
v0.24.1→v0.25.0 - github.com/moby/moby/api
v1.54.2→v1.55.0 - github.com/moby/moby/client
v0.4.1→v0.5.0 - github.com/pelletier/go-toml/v2
v2.3.1→v2.4.3 - go.opentelemetry.io/contrib/detectors/gcp
v1.39.0→v1.43.0 - golang.org/x/crypto
v0.53.0→v0.54.0 - golang.org/x/mod
v0.37.0→v0.38.0 - golang.org/x/net
v0.56.0→v0.57.0 - golang.org/x/sync
v0.21.0→v0.22.0 - golang.org/x/sys
v0.46.0→v0.47.0 - golang.org/x/term
v0.44.0→v0.45.0 - golang.org/x/text
v0.39.0→v0.40.0 - golang.org/x/tools
v0.47.0→v0.48.0 - google.golang.org/genproto/googleapis/api
v0.0.0-9d38bb4→v0.0.0-afd174a - google.golang.org/genproto/googleapis/rpc
v0.0.0-6f92a3b→v0.0.0-afd174a - google.golang.org/grpc
v1.80.0→v1.82.1(🟢 remediated GHSA-hrxh-6v49-42gf) - modernc.org/cc/v4
v4.28.4→v4.29.0 - modernc.org/ccgo/v4
v4.34.4→v4.34.6 - modernc.org/gc/v3
v3.1.3→v3.1.4 - modernc.org/libc
v1.73.4→v1.74.1 - modernc.org/sqlite
v1.53.0→v1.54.0
-
v0.116.1-0.20260727150833-545d91432e4027 Jul 2026 pre-releaseNothing published for this version
-
v0.116.1-0.20260724155557-072fe5938e2b24 Jul 2026 pre-releaseNothing published for this version
-
v0.116.1-0.20260722144620-4562c55cebba22 Jul 2026 pre-releaseNothing published for this version
-
v0.116.1-0.20260721135229-44ad33fa063021 Jul 2026 pre-releaseNothing published for this version
-
v0.116.1-0.20260720153233-ea5e99ae658120 Jul 2026 pre-releaseNothing published for this version
-
v0.116.1-0.20260717162047-5917fe58825017 Jul 2026 pre-releaseNothing published for this version
-
v0.116.1-0.20260716220826-1c7b51400bfc16 Jul 2026 pre-releaseNothing published for this version
-
v0.116.016 Jul 2026Release notes
Open source →Added Features
- duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode]
- add chainguard osv transformer [PR #3474 @crosleyzack]
- populate package architecture for matching [PR #3504 @willmurphyscode]
- lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs]
- Deduplicate Go matches that are aliases of each other (same CVE reported under both a
govulndbGO-* ID and its GHSA) [Issue #3511] [PR #3509 @spiffcs] - Support Ubuntu ESM [Issue #3544] [PR #3546 @wagoodman]
Bug Fixes
- regenerate v6.1.8 blob and sql schemas [PR #3574 @spiffcs]
- rhel version streams [PR #3572 @kzantow]
- Grype doesn't match u-boot in SBOM if type is set to firmware [Issue #2537]
- Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go [Issue #1782]
- Zarf scans emit warnings for consistently unreadable files (i.e., included non-SBOMs) [Issue #3516] [PR #3545 @brandtkeller]
- Fail parsing github actions [Issue #3220]
- Go vulnerability returned when installed version is greater than fixed version [Issue #3520]
Dependencies
14 dependency changes (11 updated, 3 added).
Updated (11 packages)- github.com/anchore/go-rpmdb
v0.1.0→v0.2.0 - github.com/anchore/syft
v1.46.0→v1.48.0 - github.com/klauspost/compress
v1.18.6→v1.19.0 - golang.org/x/text
v0.38.0→v0.39.0 - golang.org/x/tools
v0.46.0→v0.47.0 - gorm.io/gorm
v1.31.1→v1.31.2 - modernc.org/cc/v4
v4.28.2→v4.28.4 - modernc.org/ccgo/v4
v4.34.0→v4.34.4 - modernc.org/gc/v3
v3.1.2→v3.1.3 - modernc.org/libc
v1.72.3→v1.73.4 - modernc.org/sqlite
v1.51.0→v1.53.0
- github.com/mattn/go-sqlite3
v1.14.23 - gorm.io/driver/sqlite
v1.6.0 - howett.net/plist
v1.0.1
-
v0.115.1-0.20260715192723-159bf2d7c2d315 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260715144227-fcf08ae0a41815 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260713131914-bcfc0e7a083313 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260710155941-b31a42222f9e10 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260709200408-ea623611ad3609 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260709194242-1c601b26494909 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260709151745-7d9e2ec5e2a209 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260708183617-fc88fade29f008 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260703162201-67ba7a178df403 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260702190413-d4b3a5f6a36102 Jul 2026 pre-releaseNothing published for this version
-
v0.115.1-0.20260626155356-c41e34d136d926 Jun 2026 pre-releaseNothing published for this version
-
v0.115.026 Jun 2026Release notes
Open source →Added Features
- emit golang.org/x/net vulns from govlundb [PR #3534 @willmurphyscode]
- Merge Go vuln matches with GHSA matches [Issue #3515]
Bug Fixes
- only emit records for stdlib [PR #3527 @willmurphyscode]
- mark hummingbird distro as rolling [PR #3521 @willmurphyscode]
- disable go stdlib CPE matching by default [PR #3517 @willmurphyscode]
- merge in custom ranges when applicable [PR #3514 @willmurphyscode]
- exclude linux-kbuild deb indirect matches by default [PR #3506 @westonsteimel]
- avoid panic on invalid RHEL version IDs [PR #3490 @jspilman]
- Support reading CycloneDX 1.7 SBOMs [Issue #3373]
- Grype cannot read mariadb version correctly [Issue #3452]
- grype hangs when downloading certain images using registry client [Issue #3492]
- Can we get a fix for these Critical findings reported for grype [Issue #3484]
Additional Changes
- Security: bump golang.org/x/crypto to v0.52.0 to resolve multiple CVEs [Issue #3493]
- Security: bump golang.org/x/net to v0.55.0 to resolve CVEs [Issue #3494]
Dependencies
35 dependency changes (31 updated, 3 added, 1 removed). 5 vulnerabilities remediated.
🟢 Remediated (5)
- GHSA-33vj-92qq-66hc (High) — github.com/containerd/containerd/v2
- GHSA-cvxm-645q-p574 (Medium) — github.com/containerd/containerd/v2
- GHSA-jpcc-p29g-p8mq (Medium) — github.com/containerd/containerd/v2
- GHSA-rgh6-rfwx-v388 (High) — github.com/containerd/containerd/v2
- GHSA-xhf5-7wjv-pqxp (High) — github.com/containerd/containerd/v2
- github.com/ProtonMail/go-crypto
v1.4.0→v1.4.1 - github.com/anchore/bubbly
v0.2.0→v0.2.1 - github.com/anchore/clio
v0.1.0→v0.1.1 - github.com/anchore/fangs
v0.1.0→v0.1.1 - github.com/anchore/go-collections
v0.1.0→v0.1.1 - github.com/anchore/go-homedir
v0.1.0→v0.1.1 - github.com/anchore/go-logger
v0.1.0→v0.1.1 - github.com/anchore/go-lzo
v0.1.0→v0.1.1 - github.com/anchore/go-macholibre
v0.1.0→v0.1.1 - github.com/anchore/go-make
v0.5.0→v0.8.0 - github.com/anchore/go-struct-converter
v0.1.0→v0.2.0-rc2 - github.com/anchore/go-sync
v0.1.0→v0.1.1 - github.com/anchore/stereoscope
v0.2.1→v0.2.2 - github.com/anchore/syft
v1.45.1→v1.46.0 - github.com/charmbracelet/colorprofile
v0.4.1→v0.4.3 - github.com/clipperhouse/displaywidth
v0.10.0→v0.11.0 - github.com/clipperhouse/uax29/v2
v2.6.0→v2.7.0 - github.com/containerd/containerd/v2
v2.3.1→v2.3.2(🟢 remediated GHSA-33vj-92qq-66hc, GHSA-cvxm-645q-p574, GHSA-jpcc-p29g-p8mq, GHSA-rgh6-rfwx-v388, GHSA-xhf5-7wjv-pqxp) - github.com/docker/cli
v29.4.3+incompatible→v29.5.3+incompatible - github.com/google/go-containerregistry
v0.21.6→v0.21.7 - github.com/mattn/go-runewidth
v0.0.19→v0.0.21 - github.com/spdx/tools-golang
v0.5.7→v0.6.0-rc4 - github.com/sylabs/sif/v2
v2.24.0→v2.24.1 - golang.org/x/crypto
v0.52.0→v0.53.0 - golang.org/x/mod
v0.36.0→v0.37.0 - golang.org/x/net
v0.55.0→v0.56.0 - golang.org/x/sync
v0.20.0→v0.21.0 - golang.org/x/sys
v0.45.0→v0.46.0 - golang.org/x/term
v0.43.0→v0.44.0 - golang.org/x/text
v0.37.0→v0.38.0 - golang.org/x/tools
v0.45.0→v0.46.0
- github.com/piprate/json-gold
v0.7.0 - github.com/pquerna/cachecontrol
v0.0.0-1555304 - github.com/tailscale/hujson
v0.0.0-ecc657c
- github.com/google/osv-scanner
v1.9.2
-
v0.114.1-0.20260626101627-fa8b7e2a528c26 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260625161010-095cea96784a25 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260624032646-219a3b808f0324 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260623163040-fa5977bd05eb23 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260622204551-80c4dcbf25e322 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260619155509-7e7b75f4a98519 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260618215842-d6dae9d36dcf18 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260618194122-70d0100826b018 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260616131428-55b3304bcd0e16 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260615131603-3888f9b7139e15 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260612155630-f54a905415fb12 Jun 2026 pre-releaseNothing published for this version
-
v0.114.1-0.20260609173954-77bf6acbbbe409 Jun 2026 pre-releaseNothing published for this version
-
v0.114.005 Jun 2026Release notes
Open source →Added Features
- Add ability to scan zarf packages [#3329 #3366 @brandtkeller]
Additional Changes
- respect withdrawn status of Go Vuln DB OSV records [#3495 @willmurphyscode]
- Govulndb OSV transformer [#3485 @willmurphyscode]
-
v0.113.1-0.20260604203350-024e26b9c93c04 Jun 2026 pre-releaseNothing published for this version
-
v0.113.1-0.20260603160810-7e47096960cb03 Jun 2026 pre-releaseNothing published for this version
-
v0.113.003 Jun 2026Release notes
Open source →Added Features
- Include Ubuntu 26.04 "resolute" in distro codenames [#3397 @anchore-oss-update-bot]
- source RPM filtering on Hummingbird [#3410 @willmurphyscode]
Bug Fixes
- use relatedVulnerabilities description as fallback in SARIF output [#3271 @axidex]
- improve platform CPE determination logic [#3470 @westonsteimel]
- normalize uppercase V in semantic version comparison [#3461 @immanuwell]
- purl handling in cgr maven libs [#3420 @willmurphyscode]
- Treat uppercase V prefixes the same as lowercase v prefixes in fuzzy version comparison [#3037 #3089 @wasup-yash]
- Add Runtime Warnings When TLS Verification Is Disabled or HTTP Is Enabled [#3101 #3396 @Dashtid]
- Add support for the aarch64 architecture when parsing the version of Ruby gems in lockfiles [#3442 #3475 @msnandhis]
- zsh completion fails [#2933 #3433 @brandtkeller]
-
v0.112.1-0.20260602210504-577c4cd6e4f802 Jun 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260602152937-1a5ef89bbf5202 Jun 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260602013846-a1ee6b42e18302 Jun 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260529190443-075eed9f245729 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260526013349-4f57d03014f626 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260522155837-82044d54c18d22 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260521222519-c306be24b0a221 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260520150108-a345ece29f3720 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260519163405-e760f4a5fbfc19 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260518192050-95573073808c18 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260515155804-82d4c7a95f6215 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260513180549-03cbb5f8457c13 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260512173804-3d0e03b4864e12 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260511202244-14dc722c828511 May 2026 pre-releaseNothing published for this version
-
v0.112.1-0.20260509161657-7b26aa2aa40609 May 2026 pre-releaseNothing published for this version