Added Features
- Mark SLES as a comprehensive distro [PR #3732 @willmurphyscode]
- Store NVD SSVC decision points in a new v6 decorator table [PR #3725 @wagoodman]
- Adding Locations column to html template which help with triaging [PR #3092 @santrancisco]
Bug Fixes
- sign release checksums with a sigstore bundle [PR #3759 @wagoodman]
- chainguard osv package ecosystem should be package type [PR #3758 @kzantow]
- include qualifiers for unaffected packages [PR #3734 @kzantow]
- render TUI log lines on their own rows, with colors and a small header [PR #3735 @wagoodman]
match.dpkg.using-cpes(andmatch.rpm.using-cpes) is accepted but has no effect [Issue #3746] [PR #3747 @amitschendel]- embedded spaces in bin location breaks install.sh [Issue #2809] [PR #3738 @bIackr0se]
- False positives: --add-cpes-if-none maps tomcat-embed-el to apache:tomcat CPE [Issue #3730]
match.rpm.using-cpeshas no effect [Issue #3752] [PR #3753 @amitschendel]- Import metadata digest is not in the expected format [Issue #3388]
- Issue Pulling DB update [Issue #3586]
Dependencies
88 dependency changes (59 updated, 27 added, 2 removed). 2 vulnerabilities remediated.
🟢 Remediated (2)
- GHSA-8wmf-6v46-5gfg (Low) — go.opentelemetry.io/otel/exporters/otlp/otlptrace, go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp, go.opentelemetry.io/otel/sdk
- GHSA-pg57-6jwg-q645 (Medium) — github.com/containerd/containerd/v2
Toolchains (1)
- Go minimum version:
1.26.3→1.26.8
Updated (59 packages)
- github.com/Microsoft/hcsshim
v0.15.0-rc.1→v0.15.0-rc.4 - github.com/anchore/bubbly
v0.2.1→v0.2.2 - github.com/anchore/go-logger
v0.1.1→v0.2.0 - github.com/anchore/go-rpmdb
v0.2.0→v0.2.1 - github.com/anchore/stereoscope
v0.3.2→v0.3.3 - github.com/anchore/syft
v1.52.0→v1.54.0 - github.com/bmatcuk/doublestar/v4
v4.10.0→v4.10.2 - github.com/containerd/containerd/api
v1.11.1→v1.12.0 - github.com/containerd/containerd/v2
v2.3.5→v2.4.1(🟢 remediated GHSA-pg57-6jwg-q645) - github.com/containerd/log
v0.1.0→v0.2.0 - github.com/containerd/ttrpc
v1.2.8→v1.2.9 - github.com/containerd/typeurl/v2
v2.2.3→v2.3.0 - github.com/cyphar/filepath-securejoin
v0.6.1→v0.7.0 - github.com/docker/cli
v29.8.0+incompatible→v29.8.1+incompatible - github.com/docker/docker-credential-helpers
v0.9.5→v0.9.8 - github.com/dustin/go-humanize
v1.0.1→v1.1.0 - github.com/erofs/go-erofs
v0.3.0→v0.3.1 - github.com/felixge/httpsnoop
v1.0.4→v1.1.0 - github.com/fsnotify/fsnotify
v1.9.0→v1.10.1 - github.com/glebarez/go-sqlite
v1.22.0→v1.23.0 - github.com/go-jose/go-jose/v4
v4.1.4→v4.1.5 - github.com/go-logr/logr
v1.4.3→v1.4.4 - github.com/grpc-ecosystem/grpc-gateway/v2
v2.28.0→v2.30.0 - github.com/hashicorp/hcl/v2
v2.24.0→v2.25.0 - github.com/magiconair/properties
v1.18.11→v1.18.12 - github.com/mattn/go-runewidth
v0.0.21→v0.0.27 - github.com/mattn/go-sqlite3
v1.14.23→v1.14.48 - github.com/moby/sys/user
v0.4.0→v0.4.1 - github.com/moby/sys/userns
v0.1.0→v0.2.1 - github.com/nwaples/rardecode/v2
v2.2.0→v2.4.1 - github.com/olekukonko/tablewriter
v1.1.4→v1.1.5 - github.com/openvex/go-vex
v0.2.8→v0.2.9 - github.com/package-url/packageurl-go
v0.1.5→v0.1.7 - github.com/sirupsen/logrus
v1.9.4→v1.10.2 - github.com/ulikunitz/xz
v0.5.16→v0.5.17 - github.com/zclconf/go-cty
v1.16.3→v1.19.0 - go.etcd.io/bbolt
v1.4.3→v1.5.0 - go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc
v0.68.0→v0.71.0 - go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
v0.68.0→v0.71.0 - go.opentelemetry.io/otel
v1.44.0→v1.46.0 - go.opentelemetry.io/otel/exporters/otlp/otlptrace
v1.43.0→v1.46.0(🟢 remediated GHSA-8wmf-6v46-5gfg) - go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
v1.43.0→v1.46.0(🟢 remediated GHSA-8wmf-6v46-5gfg) - go.opentelemetry.io/otel/metric
v1.44.0→v1.46.0 - go.opentelemetry.io/otel/metric/x
v0.66.0→v0.68.0 - go.opentelemetry.io/otel/sdk
v1.44.0→v1.46.0(🟢 remediated GHSA-8wmf-6v46-5gfg) - go.opentelemetry.io/otel/sdk/metric
v1.44.0→v1.46.0 - go.opentelemetry.io/otel/trace
v1.44.0→v1.46.0 - go.opentelemetry.io/proto/otlp
v1.10.0→v1.11.0 - golang.org/x/crypto
v0.56.0→v0.57.0 - golang.org/x/net
v0.58.0→v0.59.0 - golang.org/x/sync
v0.22.0→v0.23.0 - golang.org/x/sys
v0.47.0→v0.48.0 - golang.org/x/term
v0.45.0→v0.46.0 - golang.org/x/text
v0.41.0→v0.42.0 - golang.org/x/tools
v0.49.0→v0.50.0 - google.golang.org/genproto/googleapis/api
v0.0.0-e75dac1→v0.0.0-da73d73 - google.golang.org/genproto/googleapis/rpc
v0.0.0-08b0e42→v0.0.0-da73d73 - modernc.org/libc
v1.75.6→v1.75.7 - modernc.org/sqlite
v1.58.0→v1.59.0
Added (27 packages)
- cyphar.com/go-pathrs
v0.2.5 - github.com/VividCortex/ewma
v1.2.0 - github.com/apparentlymart/go-textseg/v17
v17.0.1 - github.com/containerd/log/otel
v0.1.0 - github.com/containerd/stargz-snapshotter/estargz
v0.18.2 - github.com/containers/libtrust
v0.0.0-c1716e8 - github.com/containers/ocicrypt
v1.3.2 - github.com/cyberphone/json-canonicalization
v0.0.0-19d51d7 - github.com/google/go-intervals
v0.0.2 - github.com/miekg/pkcs11
v1.1.2 - github.com/mistifyio/go-zfs/v4
v4.0.0 - github.com/moby/sys/capability
v0.4.0 - github.com/opencontainers/selinux
v1.15.1 - github.com/proglottis/gpgme
v0.1.6 - github.com/secure-systems-lab/go-securesystemslib
v0.11.0 - github.com/sigstore/fulcio
v1.8.7 - github.com/sigstore/protobuf-specs
v0.5.1 - github.com/sigstore/sigstore
v1.10.8 - github.com/smallstep/pkcs7
v0.2.1 - github.com/stefanberger/go-pkcs11uri
v0.0.0-7828495 - github.com/tchap/go-patricia/v2
v2.3.3 - github.com/vbatts/tar-split
v0.12.3 - github.com/vbauerster/cupwriter
v0.0.4 - github.com/vbauerster/mpb/v8
v8.14.0 - github.com/youmark/pkcs8
v0.0.0-a2c0da2 - go.podman.io/image/v5
v5.41.2 - go.podman.io/storage
v1.64.1
Removed (2 packages)
- github.com/gogo/protobuf
v1.3.2 - go.opencensus.io
v0.24.0