Skipper
Skipper trims a 4x memory regression out of routesrv, days after shipping h2c
Comparison · Infra & APIs
Grype vs Jackett
A side-by-side editorial comparison of Grype and Jackett — release velocity, themes, recent moves, and the top alternatives to consider.
Grype vs Jackett: at a glance
What is Grype?
Grype's entire roadmap is false positives — and it just went code-aware to cut them.
Almost every release in this window targets match accuracy rather than coverage. Go has taken the brunt of it: merging govulndb GO-* records with their GHSA aliases, scoping GHSA twins by shared CVE, disabling stdlib CPE matching by default, and ignoring compiler CVEs when an image contains only a compiled binary. Coverage still widens at the edges — Zarf packages, Ubuntu ESM, Chainguard OSV data, CycloneDX 1.7 input — but it is not where the effort sits.
What is Jackett?
Daily tags chasing tracker domain moves, login changes and freeleech detection
Jackett continues to ship a tag most mornings, each one a short auto-generated commit list of indexer definition edits. The newest adds a cookie login variant for HD-Space and captcha-aware login for funfile; the day before was a sweep of domain bumps and download-volume-factor detection corrections across torrenttip, magnetcat, 52bt, torrenteros, tocashare and seedcore. No release in this window touches the application itself.
Grype vs Jackett: editorial side-by-side
Grype
6.3INFRA · APIS
Grype's entire roadmap is false positives — and it just went code-aware to cut them.
◆ Current state
Almost every release in this window targets match accuracy rather than coverage. Go has taken the brunt of it: merging govulndb GO-* records with their GHSA aliases, scoping GHSA twins by shared CVE, disabling stdlib CPE matching by default, and ignoring compiler CVEs when an image contains only a compiled binary. Coverage still widens at the edges — Zarf packages, Ubuntu ESM, Chainguard OSV data, CycloneDX 1.7 input — but it is not where the effort sits.
◆ Where it's heading
The arc runs from naive SBOM-to-CVE matching toward evidence-based matching. Reachability analysis is the clearest marker: grype is beginning to reason about whether vulnerable code is actually reachable rather than merely present. The parallel stream of ecosystem-specific correctness work — RHEL minor version streams, RHSA duplication, distro version parsing — suggests the same per-ecosystem treatment is being worked through one package manager at a time.
◆ Prediction
Reachability shipped for Go only. Extending it to a second ecosystem is the obvious next step, and Java or JavaScript are the likeliest targets given where SBOM false positives concentrate.
Jackett
5.0INFRA · APIS
Daily tags chasing tracker domain moves, login changes and freeleech detection
◆ Current state
Jackett continues to ship a tag most mornings, each one a short auto-generated commit list of indexer definition edits. The newest adds a cookie login variant for HD-Space and captcha-aware login for funfile; the day before was a sweep of domain bumps and download-volume-factor detection corrections across torrenttip, magnetcat, 52bt, torrenteros, tocashare and seedcore. No release in this window touches the application itself.
◆ Where it's heading
This is maintenance as a product, and the cadence is the feature. Trackers rotate domains, add captchas, switch to cookie auth or vary their freeleech percentages, and Jackett absorbs each change within a day — Scenetime was added and dropped within days, 720pier removed and then restored by revert. The recurring shift from form login to cookie and captcha handling across sites is the one visible pattern: the definitions are steadily taking on more anti-bot handling.
◆ Prediction
Expect the same daily cadence of definition edits, with more cookie and captcha login variants as trackers tighten access. The entries show no application-level work planned or in progress.
Alternatives to Grype and Jackett
Other Infra & APIs products tracked by Sparkpulse, ranked by recent ship velocity. Each card links to a full editorial trajectory and lets you pivot into a head-to-head comparison with either Grype or Jackett.
Apache CloudStack
CloudStack ships two LTS branches in lockstep and publishes nothing but pointers
Kinsta
Kinsta is moving MyKinsta's controls into its API, one surface per month
Verdaccio
Verdaccio's 7.0 line is subtraction — forks dropped, toolchain swapped, tags mostly empty
ToolJet
Observability lands on OpenTelemetry semconv in the LTS train
Honeycomb
Canvas agents gain memory, and onboarding moves into the editor
See all Grype alternatives → · See all Jackett alternatives →
Recent activity from Grype and Jackett
Latest ship moves from both products, interleaved chronologically. ⚡ = editorial spark.
- 3h agoJackettHD-Space cookie login variant; funfile captcha handling
- 1d agoJackettDomain bumps and freeleech detection fixes across six trackers
- 2d agoJackettIP filtering note for newstudio; anisource goes IPv6-only
- 3d agoJackett720pier tracker restored by revert
- 4d agoJackettScenetime dropped days after being added; new magnetcat domains
- 6d agoJackettdocspedia cookie auth, nyaa season search, duplicate GET fix
- 9d agoGrypeCycloneDX output now includes vulnerable version ranges
- 22d agoGrypeFalse-positive and distro parsing fixes across Go and RHEL
- 1mo agoGrypeReachability analysis lands to cut Go false positives ⚡
- 1mo agoGrypeGo matching merges govulndb and GHSA records
- 2mo agoGrypeGrype can now scan Zarf packages
- 2mo agoGrypeVersion comparison and platform CPE matching corrections
Frequently asked questions
What is the difference between Grype and Jackett?
They serve adjacent needs but don't currently overlap on shipped themes. Grype is currently shipping more aggressively (velocity 6.3 vs 5.0), with 0 editorial sparks in the last 30 days against 0. See the at-a-glance table above for a side-by-side breakdown of velocity, recent sparks, and editorial themes.
Is Grype better than Jackett?
Sparkpulse doesn't pick a winner — we score release velocity, not feature parity. Grype is currently shipping more aggressively (velocity 6.3 vs 5.0), with 0 editorial sparks in the last 30 days against 0. For your specific use case, the alternatives sections above list other Infra & APIs products to evaluate alongside.
What are the best alternatives to Grype?
Top Grype alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Grype alternatives" section above for the current picks, or visit /alternatives/grype for the full list with editorial commentary on each.
What are the best alternatives to Jackett?
Top Jackett alternatives in Infra & APIs are ranked by recent ship velocity. Browse the "Jackett alternatives" section above for the current picks, or visit /alternatives/jackett for the full list with editorial commentary on each.