anchore/grype v0.116.0

on GitHub

Added Features

• duplicate RHSAs to all applicable RHEL minor versions [PR #3542 @willmurphyscode]
• add chainguard osv transformer [PR #3474 @crosleyzack]
• populate package architecture for matching [PR #3504 @willmurphyscode]
• lightweight reachability analysis to reduce Golang false positives [Issue #2960] [PR #3509 @spiffcs]
• Deduplicate Go matches that are aliases of each other (same CVE reported under both a govulndb GO-* ID and its GHSA) [Issue #3511] [PR #3509 @spiffcs]
• Support Ubuntu ESM [Issue #3544] [PR #3546 @wagoodman]

Bug Fixes

• regenerate v6.1.8 blob and sql schemas [PR #3574 @spiffcs]
• rhel version streams [PR #3572 @kzantow]
• Grype doesn't match u-boot in SBOM if type is set to firmware [Issue #2537]
• Ignore Go compiler affecting CVE when Docker image only contains a binary compiled with Go [Issue #1782]
• Zarf scans emit warnings for consistently unreadable files (i.e., included non-SBOMs) [Issue #3516] [PR #3545 @brandtkeller]
• Fail parsing github actions [Issue #3220]
• Go vulnerability returned when installed version is greater than fixed version [Issue #3520]

Dependencies

14 dependency changes (11 updated, 3 added).

(Full Changelog)