LoginSign Up
← Back to all sparks
G

Grype

INFRA · APIS
Velocity5.0

Vulnerability scanner for container images and filesystems

anchore.com/opensource ↗

Grype keeps tightening match accuracy while making its database diff tool usable at scale

vulnerability-scanningfalse-positivessupply-chainmatching-accuracyvulnerability-database
◆Current state
Grype's autumn releases stay on matching accuracy: AlmaLinux fix dates and Swift advisories in v0.121.0, SLES coverage and NVD SSVC data in v0.120.0, and --show-suppressed for distro-fixed matches in v0.119.0. The v0.121.x patches since then fix OpenVEX handling, make db search ordering deterministic, refine CPE-to-package mappings and drop the docker/docker dependency.
◆Where it's heading
Accuracy work is spreading from the matcher into the tooling around the vulnerability database, with db diff now reporting fix-date, version-range and added/removed changes precisely. That suggests Anchore wants users to audit what changes between database builds, not just trust the scan result.
◆Prediction
The next minor likely brings more distro-specific fix data and further db diff output options; the entries do not show a new matcher feature in progress.

◆Recent moves

  1. 4d ago

    v0.121.3: finer CPE mappings and eight dependency vulns fixed

    Refines more CPE-to-package-identifier mappings and clears eight vulnerabilities in Grype's own dependencies, mostly by dropping docker/docker. Housekeeping that keeps the scanner's own report clean.

    View source ↗
  2. 8d ago

    v0.121.2: deterministic db search ordering, Syft 1.57

    A patch that makes db search results come back in a fixed order and bumps Syft to 1.57.0. Useful for scripted comparisons, but no matching change.

    View source ↗
  3. 11d ago

    v0.121.1: faster db diff, OpenVEX purl and AlmaLinux fix corrections

    A patch that fixes OpenVEX constraints for versionless purls and picks the lowest overlapping AlmaLinux fix, extending the distro accuracy theme of v0.121.0. Most of the work goes into db diff, which is now faster, leaner and reports a package change only when its affected records actually change.

    View source ↗
  4. 25d ago

    v0.121.0: AlmaLinux fix dates and Swift advisory matching

    Continues the distro accuracy work with AlmaLinux fix dates, extended support fix availability and end-of-life warnings that respect distro data. Swift packages now match GitHub advisories by identity.

    View source ↗
  5. 1mo ago

    v0.120.1: Windows handle leaks and table output fix

    A patch release fixing Windows handle leaks and a spurious suffix in the FIX column of table output.

    View source ↗
  6. 1mo ago

    v0.120.0: NVD SSVC data, SLES coverage, HTML locations

    Adds SSVC decision points to the database and marks SLES as a comprehensive distro, alongside a Locations column for the HTML report. SSVC is a new class of signal rather than another matcher repair.

    View source ↗