LoginSign Up
← Back to all sparks
G

Grype

INFRA · APIS
Velocity6.3

Vulnerability scanner for container images and filesystems

anchore.com/opensource ↗

Grype's entire roadmap is false positives — and it just went code-aware to cut them.

vulnerability-scanningfalse-positivesreachabilitysbomgolang
◆Current state
Almost every release in this window targets match accuracy rather than coverage. Go has taken the brunt of it: merging govulndb GO-* records with their GHSA aliases, scoping GHSA twins by shared CVE, disabling stdlib CPE matching by default, and ignoring compiler CVEs when an image contains only a compiled binary. Coverage still widens at the edges — Zarf packages, Ubuntu ESM, Chainguard OSV data, CycloneDX 1.7 input — but it is not where the effort sits.
◆Where it's heading
The arc runs from naive SBOM-to-CVE matching toward evidence-based matching. Reachability analysis is the clearest marker: grype is beginning to reason about whether vulnerable code is actually reachable rather than merely present. The parallel stream of ecosystem-specific correctness work — RHEL minor version streams, RHSA duplication, distro version parsing — suggests the same per-ecosystem treatment is being worked through one package manager at a time.
◆Prediction
Reachability shipped for Go only. Extending it to a second ecosystem is the obvious next step, and Java or JavaScript are the likeliest targets given where SBOM false positives concentrate.

◆Recent moves

  1. 9d ago

    CycloneDX output now includes vulnerable version ranges

    CycloneDX output now carries vulnerable version ranges rather than bare matches, which makes downstream triage possible without re-querying the database. Also honors the rust CPE matching configuration that was previously ignored.

    View source ↗
  2. 22d ago

    False-positive and distro parsing fixes across Go and RHEL

    A cleanup release almost entirely about wrong answers: a Red Hat severity mismatch, a distro version parse panic, a Go false positive, and consistent channel parsing. Squarely on the accuracy trajectory, just without a headline feature.

    View source ↗
  3. 1mo ago

    Reachability analysis lands to cut Go false positives

    ⚡ SPARK

    The release where the accuracy work stops being incremental. Reachability analysis moves grype from asking whether a vulnerable package is present to asking whether it is used — a different class of question, and the one that determines whether output is a triage queue or a work list.

    View source ↗
  4. 1mo ago

    Go matching merges govulndb and GHSA records

    Groundwork for the reachability release that follows: merging Go vulnerability matches with their GHSA counterparts, emitting records only for stdlib where appropriate, and disabling Go stdlib CPE matching by default. Each change removes a known source of duplicate or spurious findings.

    View source ↗
  5. 2mo ago

    Grype can now scan Zarf packages

    Adds Zarf package scanning and respects withdrawn status on Go Vuln DB OSV records. A coverage addition alongside another small correctness fix — the two streams that define this product's releases.

    View source ↗
  6. 2mo ago

    Version comparison and platform CPE matching corrections

    Mostly matching corrections — version comparison normalization for uppercase V prefixes, platform CPE determination, aarch64 Ruby gem parsing — plus Ubuntu 26.04 codename support and runtime warnings when TLS verification is disabled. Incremental, and consistent with the accuracy focus.

    View source ↗