Added Features
- ROX-35508: Scanner V4 now suppresses duplicate OSV.dev vulnerability records when Red Hat VEX data covers the same CVE for a Red Hat product image, showing Red Hat's own severity/CVSS/remediation data instead of a conflicting OSV.dev one. Enabled by default; disable via
ROX_SCANNER_V4_SUPPRESS_OSV_WITH_RED_HAT_VEX=falseif needed.
Technical Changes
- ROX-37315: Image exclusions no longer turn off deploy-time checks. Previously, an image exclusion on a policy with Build and Deploy stages stopped that policy from raising deploy-time violations or blocking any deployment. Image exclusions now apply only at Build, so after upgrading, affected policies raise deploy-time violations again and block deployments if enforcement is on. To skip apps at deploy time, use deployment exclusions.
- ROX-37265: To get additional filtering coverage for Red Hat layers in newer Konflux-built images, the
ROX_SCANNER_V4_RED_HAT_LAYERS_RED_HAT_VULNS_ONLYflag must now be set on Central. The existing Scanner V4 Matcher setting remains for backward compatibility, but its filtering has coverage gaps for these images.
Full Changelog: 4.11.5...4.11.6
For a description of the changes, review the Release Notes on the Red Hat Documentation portal.