LoginSign Up
← Back to all sparks
G

Grype

INFRA · APIS
Velocity5.0

Vulnerability scanner for container images and filesystems

anchore.com/opensource ↗

Grype keeps grinding on false positives, now in Alpine and CVSSv4 scoring

vulnerability-scanningfalse-positivessbomsupply-chainmatching-accuracy
◆Current state
Grype is Anchore's vulnerability scanner, and its releases sort into two streams: matching accuracy and ecosystem coverage. Since reachability analysis landed for Go in v0.116.0, the work has stayed on correctness — CycloneDX gaining vulnerable version ranges, then a run of false-positive and parsing fixes. v0.118.0 continues that, adding alias-aware aggregation to the Alpine apk matcher and correcting CVSSv4 severity calculation and old-JVM version comparisons.
◆Where it's heading
Accuracy remains the roadmap. This release's single feature is a matcher refinement rather than a new capability, and the rest is wrong-answer repair plus a 72-package dependency sweep that remediates three of its own advisories. Reachability has still not extended past Go, so the code-aware ambition set out in v0.116.0 remains a Go-only capability several releases later.
◆Prediction
Extending reachability to a second ecosystem is still the outstanding move, and the CVSSv4 correction suggests scoring accuracy will get further attention as v4 data spreads. These notes give no signal on which ecosystem comes next.

◆Recent moves

  1. 19d ago

    apk alias-aware matching; CVSSv4 and JVM comparison fixes

    One matcher feature — alias-aware aggregation for Alpine apk — alongside fixes to CVSSv4 severity calculation, old JVM version comparison, VEX matching against OCI purls, and a portage panic. A 72-package dependency sweep remediates three advisories in Grype's own tree. Routine accuracy work on the trajectory reachability set, with no movement on extending it.

    View source ↗
  2. 1mo ago

    CycloneDX output now includes vulnerable version ranges

    CycloneDX output now carries vulnerable version ranges rather than bare matches, which makes downstream triage possible without re-querying the database.

    View source ↗
  3. 1mo ago

    False-positive and distro parsing fixes across Go and RHEL

    A cleanup release almost entirely about wrong answers: a Red Hat severity mismatch, a distro version parse panic, a Go false positive, and consistent channel parsing. Squarely on the accuracy trajectory.

    View source ↗
  4. 2mo ago

    Reachability analysis lands to cut Go false positives

    ⚡ SPARK

    The release where the accuracy work stops being incremental. Reachability analysis moves grype from asking whether a vulnerable package is present to asking whether it is used — still the origin of the arc that later releases refine.

    View source ↗
  5. 2mo ago

    Go matching merges govulndb and GHSA records

    Groundwork for the reachability release that follows: merging Go vulnerability matches with their GHSA counterparts and disabling Go stdlib CPE matching.

    View source ↗
  6. 3mo ago

    Grype can now scan Zarf packages

    Adds Zarf package scanning and respects withdrawn status on Go Vuln DB OSV records. A coverage addition alongside another small correctness fix — the two streams that define this product's releases.

    View source ↗