v0.74.4

Security Fixes

• Upgrade syft to v0.103.1 [#1688 @wagoodman]

(Full Changelog)

v0.74.3

Bug Fixes

• Fix matching when RPM modularity is a factor [#1679 @wagoodman]
• VEX documents not taken into account when --fail-on is set [#1639 #1657 @ferozsalam]

Additional Changes

• break assumption that syft cpe.CPE is wfn.Attributes [#1675 @willmurphyscode]

(Full Changelog)

v0.74.2

Additional Changes

• update Syft to v0.101.1 [#1669 @anchore-actions-token-generator]

(Full Changelog)

v0.74.1

Security Fixes

• bump github.com/cloudflare/circl from 1.3.3 to 1.3.7 [#1651 @dependabot]

Additional Changes

• fix logging configuration in tests [#1655 @plavy]
• Update Syft to 0.101.0 [#1663]

(Full Changelog)

v0.74.0

Added Features

• Vulnerabilities marked as fixed in distro packages should be reported as fixed for all contained packages too [#1236 #1603 @luhring]

Bug Fixes

• Parameter quiet is ignored in configuration file [#1645 #1646 @plavy]
• 401 unauthorized pulling from public registry [#1637]

Additional Changes

• Update Syft to 0.100.0 [#1649]

(Full Changelog)

v0.73.5

Additional Changes

• Update Syft to v0.99.0 [#1633 @dependabot]

(Full Changelog)

v0.73.4

Additional Changes

• bump to syft v0.98.0 in quality gate tests [#1623 @westonsteimel]
• update syft to v0.98.0; go mod tidy [#1621 @spiffcs]

(Full Changelog)

v0.73.3

Additional Changes

• update Syft to v0.97.1 [#1610 @anchore-actions-token-generator]

(Full Changelog)

v0.73.2

Bug Fixes

• Vulnerabilities in go packages without go modules are not detected [#1581 #1599 @willmurphyscode]

(Full Changelog)

v0.73.1

Bug Fixes

• CycloneDX based analysis failing [#1594 #1596 @anchore-actions-token-generator]
• False negatives when scanning debian trixie/sid images from Dockerhub [#1446 #1593 @willmurphyscode]

Additional Changes

• avoid allocations with (*regexp.Regexp).MatchString [#1592 @Juneezee]

(Full Changelog)