Added Features
- apk matcher does alias aware aggregation [PR #3634 @crosleyzack]
Bug Fixes
- prevent panic on portage versions without digits [PR #3655 @ashvinctrl]
- grype vex does not match oci purl with repository_url [Issue #3657] [PR #3659 @spiffcs]
- Old JVM version comparisons sometimes incorrect [Issue #2701] [PR #3583 @Eljees]
- CVSSv4 calculation can produce incorrect vulnerability severity [Issue #3656]
- Grype 0.90.0 DB update failed [Issue #3629]
Dependencies
72 dependency changes (70 updated, 1 added, 1 removed). 3 vulnerabilities remediated.
🟢 Remediated (3)
- GO-2026-5158 (Medium) — go.opentelemetry.io/otel
- GO-2026-6179 (High) — golang.org/x/mod
- GO-2026-6180 (High) — golang.org/x/mod
Updated (70 packages)
- cel.dev/expr
v0.25.1→v0.25.2 - cloud.google.com/go/auth
v0.18.2→v0.22.0 - cloud.google.com/go/iam
v1.5.3→v1.11.0 - cloud.google.com/go/logging
v1.13.1→v1.18.0 - cloud.google.com/go/longrunning
v0.8.0→v1.2.0 - cloud.google.com/go/monitoring
v1.24.3→v1.29.0 - cloud.google.com/go/storage
v1.61.3→v1.64.0 - cloud.google.com/go/trace
v1.11.7→v1.16.0 - github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp
v1.32.0→v1.33.0 - github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric
v0.55.0→v0.57.0 - github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/cloudmock
v0.55.0→v0.57.0 - github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping
v0.55.0→v0.57.0 - github.com/anchore/stereoscope
v0.3.0→v0.3.1 - github.com/anchore/syft
v1.51.0→v1.51.1 - github.com/aws/aws-sdk-go-v2
v1.41.5→v1.43.4 - github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream
v1.7.8→v1.7.16 - github.com/aws/aws-sdk-go-v2/config
v1.32.12→v1.32.35 - github.com/aws/aws-sdk-go-v2/credentials
v1.19.12→v1.19.34 - github.com/aws/aws-sdk-go-v2/feature/ec2/imds
v1.18.20→v1.18.35 - github.com/aws/aws-sdk-go-v2/internal/configsources
v1.4.21→v1.4.35 - github.com/aws/aws-sdk-go-v2/internal/endpoints/v2
v2.7.21→v2.7.35 - github.com/aws/aws-sdk-go-v2/internal/v4a
v1.4.22→v1.4.36 - github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding
v1.13.7→v1.13.15 - github.com/aws/aws-sdk-go-v2/service/internal/checksum
v1.9.13→v1.9.28 - github.com/aws/aws-sdk-go-v2/service/internal/presigned-url
v1.13.21→v1.13.35 - github.com/aws/aws-sdk-go-v2/service/internal/s3shared
v1.19.21→v1.19.36 - github.com/aws/aws-sdk-go-v2/service/s3
v1.97.3→v1.106.5 - github.com/aws/aws-sdk-go-v2/service/signin
v1.0.8→v1.5.4 - github.com/aws/aws-sdk-go-v2/service/sso
v1.30.13→v1.33.4 - github.com/aws/aws-sdk-go-v2/service/ssooidc
v1.35.17→v1.38.4 - github.com/aws/aws-sdk-go-v2/service/sts
v1.41.9→v1.45.4 - github.com/aws/smithy-go
v1.24.2→v1.27.6 - github.com/containerd/containerd/v2
v2.3.3→v2.3.4 - github.com/containerd/platforms
v1.0.0-rc.4→v1.0.0-rc.5 - github.com/docker/cli
v29.6.1+incompatible→v29.7.2+incompatible - github.com/docker/go-connections
v0.7.0→v0.8.1 - github.com/fatih/color
v1.18.0→v1.19.0 - github.com/google/go-containerregistry
v0.21.7→v0.21.9 - github.com/google/pprof
v0.0.0-6e76a2b→v0.0.0-ef3492d - github.com/googleapis/enterprise-certificate-proxy
v0.3.14→v0.3.19 - github.com/googleapis/gax-go/v2
v2.17.0→v2.23.0 - github.com/hashicorp/aws-sdk-go-base/v2
v2.0.0-beta.72→v2.0.0-beta.74 - github.com/hashicorp/go-getter
v1.8.6→v1.8.8 - github.com/hashicorp/go-version
v1.8.0→v1.9.0 - github.com/klauspost/compress
v1.19.1→v1.19.2 - github.com/mattn/go-isatty
v0.0.20→v0.0.24 - github.com/moby/moby/client
v0.5.0→v0.5.1 - github.com/spiffe/go-spiffe/v2
v2.6.0→v2.7.0 - github.com/stretchr/objx
v0.5.2→v0.5.3 - github.com/stretchr/testify
v1.11.1→v1.12.1 - go.opentelemetry.io/contrib/detectors/gcp
v1.43.0→v1.44.0 - go.opentelemetry.io/otel
v1.43.0→v1.44.0(🟢 remediated GO-2026-5158) - go.opentelemetry.io/otel/exporters/stdout/stdoutmetric
v1.40.0→v1.44.0 - go.opentelemetry.io/otel/metric
v1.43.0→v1.44.0 - go.opentelemetry.io/otel/sdk
v1.43.0→v1.44.0 - go.opentelemetry.io/otel/sdk/metric
v1.43.0→v1.44.0 - go.opentelemetry.io/otel/trace
v1.43.0→v1.44.0 - golang.org/x/crypto
v0.54.0→v0.55.0 - golang.org/x/mod
v0.38.0→v0.40.0(🟢 remediated GO-2026-6179, GO-2026-6180) - golang.org/x/net
v0.57.0→v0.58.0 - golang.org/x/text
v0.40.0→v0.41.0 - golang.org/x/tools
v0.48.0→v0.49.0 - google.golang.org/api
v0.271.0→v0.292.0 - google.golang.org/genproto
v0.0.0-8636f87→v0.0.0-aa98bba - google.golang.org/genproto/googleapis/api
v0.0.0-afd174a→v0.0.0-925bb5d - google.golang.org/genproto/googleapis/rpc
v0.0.0-afd174a→v0.0.0-6ac0973 - google.golang.org/grpc
v1.82.1→v1.83.0 - modernc.org/cc/v4
v4.29.0→v4.29.1 - modernc.org/libc
v1.74.1→v1.74.4 - modernc.org/sqlite
v1.55.0→v1.56.0
Added (1 package)
- go.opentelemetry.io/otel/metric/x
v0.66.0
Removed (1 package)
- github.com/aws/aws-sdk-go-v2/internal/ini
v1.8.6