Added Features
- Expose distro-fixed dropped matches via ignoredMatches so --show-suppressed can surface them [Issue #3450] [PR #3705 @philroche]
- Licensing: copyright owner missing, needed for Debian packaging [Issue #3501]
Bug Fixes
- fixes typo in cpe example input for cpe-direct scan [PR #3679 @zhill]
- --by-cve: which advisory record survives the merge varies between runs [Issue #3630]
Additional Changes
- OpenVEX transformer drops the namespace from Go module PURLs [Issue #3680] [PR #3683 @arpitjain099]
- Docs missing for include-aliases [Issue #3663] [PR #3671 @dev-rehaann]
Dependencies
54 dependency changes (54 updated). 6 vulnerabilities remediated.
🟢 Remediated (6)
- GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc
- GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2
- GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc
- GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc
- GO-2026-6354 (High) — golang.org/x/crypto
- GO-2026-6355 (High) — golang.org/x/crypto
Updated (54 packages)
- cloud.google.com/go/auth v0.22.0 → v0.23.2
- cloud.google.com/go/iam v1.11.0 → v1.12.0
- cloud.google.com/go/logging v1.18.0 → v1.19.0
- cloud.google.com/go/monitoring v1.29.0 → v1.30.0
- cloud.google.com/go/storage v1.64.0 → v1.65.1
- github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0
- github.com/anchore/go-sync v0.1.1 → v0.1.2
- github.com/anchore/stereoscope v0.3.1 → v0.3.2
- github.com/anchore/syft v1.51.1 → v1.52.0
- github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0
- github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20
- github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40
- github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39
- github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40
- github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40
- github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40
- github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41
- github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19
- github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0
- github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40
- github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41
- github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0
- github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0
- github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0
- github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0
- github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0
- github.com/aws/smithy-go v1.27.6 → v1.28.1
- github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv)
- github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible
- github.com/google/go-containerregistry v0.21.9 → v0.22.1
- github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20
- github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0
- github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3
- github.com/hashicorp/go-getter v1.8.8 → v1.8.9
- github.com/klauspost/compress v1.19.2 → v1.20.0
- github.com/moby/moby/api v1.55.0 → v1.56.0
- github.com/moby/moby/client v0.5.1 → v0.6.0
- github.com/pandatix/go-cvss v0.6.2 → v0.6.4
- github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8
- golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355)
- golang.org/x/mod v0.40.0 → v0.41.0
- golang.org/x/time v0.15.0 → v0.16.0
- google.golang.org/api v0.292.0 → v0.294.0
- google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1
- google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1
- google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42
- google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc)
- google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12
- modernc.org/cc/v4 v4.29.1 → v4.29.2
- modernc.org/ccgo/v4 v4.34.6 → v4.35.0
- modernc.org/gc/v3 v3.1.4 → v3.1.5
- modernc.org/libc v1.74.4 → v1.75.6
- modernc.org/memory v1.11.0 → v1.12.1
- modernc.org/sqlite v1.56.0 → v1.58.0
(Full Changelog)
