grype releases - releaseport

No immediate action

v0.116.0 Mixed 10d

RHEL dupes, Chainguard, Arch pop, Reachability, Dedup, ESM

Open

Upgrade now

v0.115.0 Breaking risk 1mo

Dependencies Breaking upgrade

Go vulns, GHSA merge, bug fixes, dependency bumps

Open

No immediate action

v0.114.0 New feature 1mo

zarf package scanning

Open

Monitor

v0.113.0 New feature 1mo

Crypto / TLS

Ubuntu 26.04 + Hummingbird filter + TLS/HTTP warnings

Open

v0.112.0 New feature 2mo

Notable features

Ignore rules expanded to owned sub packages of distro packages

Full changelog

Added Features

Expand ignore rules to owned sub packages of distro packages [#3368 #3326 @kzantow]

Additional Changes

update anchore dependencies [#3391 @anchore-oss-update-bot]

(Full Changelog)

View release on GitHub

v0.111.1 Bug fix 3mo

Fixed vulnerability relationship matching, SARIF output helpURI, and Debian component recognition.

Full changelog

Bug Fixes

apply overlap by ownership removal to dynamically created relationships [#3363 @kzantow]
compare mismatched package / db versions [#3372 @kzantow]
Grype doesn't recognize debian component when "group" : "debian" is specified [#2967]
HelpURI missing information in SARIF output [#2874 #3351 @will-bates11]

(Full Changelog)

View release on GitHub

v0.111.0 New feature 3mo

Notable features

db diff for v6
add ProvideFromReader for in-memory SBOM processing
CSAF vex transformer

View release on GitHub

v0.110.0 New feature 4mo

Notable features

suppress GHSA matches on language packages in fixed APKs
use Syft for decoding CPEs

View release on GitHub

v0.109.1 Security relevant 4mo

Security fixes

CVE-2025-12183 not detected in vulnerable jars

View release on GitHub

v0.109.0 New feature 5mo

Notable features

Strip v prefix from apk versions
Port grype-db library to grype

View release on GitHub

v0.108.0 New feature 5mo

Notable features

Enable disabling EOL warnings
VEX Documents support with syft sbom
Improved VEX product and subcomponent matching

View release on GitHub

v0.107.1 Bug fix 5mo

Minor fixes and improvements.

Full changelog

Additional Changes

support context cancellation while finding vuln matches [#3200 @luhring]

(Full Changelog)

View release on GitHub

v0.107.0 New feature 5mo

Notable features

Hex matcher for Erlang/Elixir ecosystem
Improved VEX document registry matching

Full changelog

Added Features

Add secureos distro [#3086 @divolgin]
add hex matcher for Erlang/Elixir ecosystem [#3194 @willmurphyscode]

Bug Fixes

disable version fallback in EOL query [#3195 @willmurphyscode]
VEX documents with docker.io registry reference not matching, require index.docker.io instead [#2818 #3172 @jainlakshya]

(Full Changelog)

View release on GitHub

v0.106.0 New feature 6mo

Notable features