LoginSign Up
← Back to all sparks
G

Grype

INFRA · APIS
Velocity6.3

Vulnerability scanner for container images and filesystems

anchore.com/opensource ↗

Grype has stopped competing on coverage and started competing on how few false positives it prints.

vulnerability-scanningfalse-positivesgolangreachabilitysbomdistro-data
◆Current state
Nearly every release in this window is about match precision rather than new scanning surface. The Go ecosystem gets the most attention — deduplicating the same CVE reported under both a govulndb GO-* ID and its GHSA alias, disabling stdlib CPE matching by default, emitting only stdlib records where appropriate, and respecting withdrawn OSV records. The RHEL side gets parallel work on version streams, RHSA-to-minor-version mapping, and fix dates, with Ubuntu ESM and Chainguard added as data sources.
◆Where it's heading
The product is being tuned for teams that already run it in CI and are drowning in output — the unit of progress is a suppressed bad match, not a newly detected one. Reachability analysis is the sharpest expression of that: it moves the question from 'is this version vulnerable' to 'does this code path exist in your binary.' Expect vulnerability data quality and distro-specific correctness to keep consuming most of the release notes.
◆Prediction
Reachability analysis should widen beyond Go if the false-positive reduction holds, and the pattern of onboarding one new ecosystem or distro data source per minor release looks set to continue.

◆Recent moves

  1. 6d ago

    Go GHSA twins scoped by shared CVE; RHEL severity false positives fixed

    A patch that is almost entirely false-positive cleanup: scoping Go GHSA twins by shared CVE, correcting a RHEL record Red Hat says is not affected, and fixing a parser panic on malformed VERSION_ID values. Continues the deduplication work from 0.116.0 rather than adding surface.

    View source ↗
  2. 18d ago

    Reachability analysis lands to cut Go false positives

    ⚡ SPARK

    The release where the precision arc becomes an architectural claim: lightweight reachability analysis for Go, alias deduplication between govulndb and GHSA identifiers, and package architecture used in matching. Ubuntu ESM and a Chainguard OSV transformer broaden the data behind those matches.

    View source ↗
  3. 1mo ago

    Go and GHSA matches merged; stdlib CPE matching off by default

    The groundwork for the reachability release: Go and GHSA matches get merged, stdlib CPE matching is disabled by default, and indirect Linux kernel build matches are excluded. Also picks up CycloneDX 1.7 SBOM reading, keeping input format support current.

    View source ↗
  4. 1mo ago

    Zarf package scanning and a govulndb OSV transformer

    Adds Zarf packages as a scan target — an airgapped-Kubernetes packaging format, a narrow but underserved niche. The govulndb OSV transformer and respect for withdrawn OSV records are the plumbing that later releases build the Go deduplication on.

    View source ↗
  5. 2mo ago

    Ubuntu 26.04 and Hummingbird distro support, SARIF and version-compare fixes

    Routine distro currency — Ubuntu 26.04 codenames, source RPM filtering on Hummingbird — plus a batch of version-comparison normalisations that each remove a class of bad match. The runtime warning when TLS verification is disabled is a small but useful safety signal for CI operators.

    View source ↗
  6. 3mo ago

    Ignore rules extended to owned sub-packages of distro packages

    Extends ignore rules to sub-packages owned by a distro package, so suppressing one finding no longer leaves its dependents reporting the same issue. A small change that fits the same theme: giving operators control over what the scanner is allowed to say.

    View source ↗