LoginSign Up
← Back to all sparks
G

Grype

INFRA · APIS
Velocity5.0

Vulnerability scanner for container images and filesystems

anchore.com/opensource ↗

Grype widens distro accuracy while each release clears its own dependency advisories.

vulnerability-scanningfalse-positivessupply-chainmatching-accuracyssvc
◆Current state
Grype's autumn releases stay on matching accuracy. v0.121.0 carries AlmaLinux fix dates onto replaced RHEL matches and finds GitHub Swift advisories it previously missed, v0.120.0 marks SLES as a comprehensive distro and stores NVD SSVC decision points, and v0.119.0 exposes distro-fixed dropped matches through --show-suppressed. Each minor also carries a large dependency sweep, with v0.121.0 remediating five golang.org/x/net advisories.
◆Where it's heading
Accuracy remains the roadmap, and the work is increasingly about distro-specific truth: fix dates, extended support and comprehensive coverage. SSVC data in the database is the one new kind of signal, since it adds decision guidance beyond severity. Reachability has still not moved past Go in these notes.
◆Prediction
SSVC decision points are stored but not yet described as a user-facing output, so surfacing them in results is the natural next step. These notes give no signal on a second reachability ecosystem.

◆Recent moves

  1. 14d ago

    v0.121.0: AlmaLinux fix dates and Swift advisory matching

    Continues the distro accuracy work with AlmaLinux fix dates, extended support fix availability and end-of-life warnings that respect distro data. Swift packages now match GitHub advisories by identity.

    View source ↗
  2. 27d ago

    v0.120.1: Windows handle leaks and table output fix

    A patch release fixing Windows handle leaks and a spurious suffix in the FIX column of table output.

    View source ↗
  3. 1mo ago

    v0.120.0: NVD SSVC data, SLES coverage, HTML locations

    Adds SSVC decision points to the database and marks SLES as a comprehensive distro, alongside a Locations column for the HTML report. SSVC is a new class of signal rather than another matcher repair.

    View source ↗
  4. 1mo ago

    v0.119.0: --show-suppressed exposes distro-fixed matches

    Distro-fixed matches that were dropped silently can now be shown with --show-suppressed, which makes the scanner's reasoning easier to audit. Six dependency advisories are remediated too.

    View source ↗
  5. 2mo ago

    apk alias-aware matching; CVSSv4 and JVM comparison fixes

    One matcher feature — alias-aware aggregation for Alpine apk — alongside fixes to CVSSv4 severity calculation, old JVM version comparison, VEX matching against OCI purls, and a portage panic. A 72-package dependency sweep remediates three advisories in Grype's own tree. Routine accuracy work on the trajectory reachability set, with no movement on extending it.

    View source ↗
  6. 2mo ago

    CycloneDX output now includes vulnerable version ranges

    CycloneDX output now carries vulnerable version ranges rather than bare matches, which makes downstream triage possible without re-querying the database.

    View source ↗