v0.86.1

Security Fixes

• archiver has been archived - replace with archives fork [#2304 #2313 @spiffcs]

Bug Fixes

• archiver has been archived - replace with archives fork [#2304 #2313 @spiffcs]
• Grype panics on certain output formats for PURL inputs [#2324 #2328 @willmurphyscode]
• FP of upstream linux [#2326]

Additional Changes

• move v5-specific interfaces and implementations to the v5 package [#2322 @kzantow]
• Fix broken link to cosign documentation [#2321 @uaqben]

(Full Changelog)

v0.86.0

Added Features

• Add missing package information for Sarif report [#2267 #2254 @GeorgeLS]

Bug Fixes

• ignore linux-aws-headers-.* as well like linux-headers-.* [#2295 @barnuri]

Breaking Changes

• Remove DB v1 & v2 schemas [#2278 @wagoodman]

Additional Changes

• refactor v5-specific code out of core packages [#2299 @kzantow]

(Full Changelog)

v0.85.0

Added Features

• Add support for gradle in Java [#2236]
• Prefer direct match information over indirect matches [#1931 #2241 @wagoodman]

Bug Fixes

• Restore log on UI teardown [#2248 @wagoodman]
• Display warnings even when -v is not passed and no tty is present [#2180 #2268 @willmurphyscode]

Additional Changes

• core dependencies: latest syft v1.17.0 and latest stereoscope v0.0.9 [#2275 @willmurphyscode]

(Full Changelog)

v0.84.0

Added Features

• Add support for scanning single purl from the CLI [#2225 #2223 @wagoodman]

Bug Fixes

• Flaky checks on STDIN for purl provider [#2192 #2223 @wagoodman]
• Missing alpine patch version yields inaccurate results [#2222 #2226 @wagoodman]

Additional Changes

• update Syft to v1.16.0 [#2237 @anchore-actions-token-generator]

(Full Changelog)

v0.83.0

Added Features

• Merge config files hierarchically and add support for config profiles [#2009 #2194 @kzantow]
• Add DB providers command [#2131 #2174 @ADorigi]

(Full Changelog)

v0.82.2

Bug Fixes

• azurelinux considered as comprehensive distro [#2197 @westonsteimel]
• Java archive cataloger performance in 0.82.x much slower than 0.81.0 [#2200]

Additional Changes

• Update to Syft v1.14.2 [#2203 @wagoodman]

(Full Changelog)

v0.82.1

Bug Fixes

• Skip matching on packages with missing version info [#2182 @wagoodman]
• correctly identify version of traefik binaries [#2178 #2179 @westonsteimel]
• RPM version comparison oddity with release field [#398 #2188 @wagoodman]
• purl with epoch should be used even if version is missing epoch [#2170 #2186 @wagoodman]

Additional Changes

• bump syft in quality gate to v1.14.0 [#2187 @westonsteimel]

(Full Changelog)

v0.82.0

Added Features

• performance: only check for a new DB once every 2 hours (configurable) [#2148 @wagoodman]
• wordpress-plugin support [#1553 @disc]

Bug Fixes

• use fix info from secDB in APK matcher even if NVD fix info present [#2162 @willmurphyscode]

Breaking Changes

• Split v1-5 DB distribution concerns to a new legacy package [#2124 #2144 @wagoodman]

Additional Changes

• Add a space following the "Name:" label in html.tmpl [#2155 @deftdawg]

(Full Changelog)

v0.81.0

Added Features

• add distro mapping for azure linux 3 [#1848 @willmurphyscode]
• Support for Azure Linux 3.0 [#1829]

(Full Changelog)

v0.80.2

Bug Fixes

• find secdb entries for origin packages [#1602 @luhring]
• Matching java binary packages with NVD records is problematic [#1718 #2114 @wagoodman]
• LoadVulnerabilityDB could be faster with ValidateByHashOnGet [#1502 #2054 @lucasrod16]

Additional Changes

• update Syft to v1.13.0 [#2140 @anchore-actions-token-generator]
• include file specifier in help [#2121 @willmurphyscode]

(Full Changelog)