Attributed metadata history

v0.119.0

Added Features Expose distro-fixed dropped matches via ignoredMatches so --show-suppressed can surface them [Issue #3450] [PR #3705 @philroche] Licensing: copyright owner missing, needed for Debian packaging [Issue #3501] Bug Fixes fixes typo in cpe example input for cpe-direct scan [PR #3679 @zhill] --by-cve: which advisory record survives the merge varies between runs [Issue #3630] Additional Changes OpenVEX transformer drops the namespace from Go module PURLs [Issue #3680] [PR #3683 @arpitjain099] Docs missing for include-aliases [Issue #3663] [PR #3671 @dev-rehaann] Dependencies 54 dependency changes (54 updated). 6 vulnerabilities remediated. 🟢 Remediated (6) GHSA-2v4p-qf9q-27wj (High) — google.golang.org/grpc GHSA-7jxh-36q5-gcqv (Medium) — github.com/containerd/containerd/v2 GHSA-qc2q-p7wx-3px3 (Medium) — google.golang.org/grpc GHSA-vp52-pcj8-j9qc (High) — google.golang.org/grpc GO-2026-6354 (High) — golang.org/x/crypto GO-2026-6355 (High) — golang.org/x/crypto Updated (54 packages) cloud.google.com/go/auth v0.22.0 → v0.23.2 cloud.google.com/go/iam v1.11.0 → v1.12.0 cloud.google.com/go/logging v1.18.0 → v1.19.0 cloud.google.com/go/monitoring v1.29.0 → v1.30.0 cloud.google.com/go/storage v1.64.0 → v1.65.1 github.com/CycloneDX/cyclonedx-go v0.11.0 → v0.12.0 github.com/anchore/go-sync v0.1.1 → v0.1.2 github.com/anchore/stereoscope v0.3.1 → v0.3.2 github.com/anchore/syft v1.51.1 → v1.52.0 github.com/aws/aws-sdk-go-v2 v1.43.4 → v1.44.0 github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream v1.7.16 → v1.7.20 github.com/aws/aws-sdk-go-v2/config v1.32.35 → v1.32.40 github.com/aws/aws-sdk-go-v2/credentials v1.19.34 → v1.19.39 github.com/aws/aws-sdk-go-v2/feature/ec2/imds v1.18.35 → v1.18.40 github.com/aws/aws-sdk-go-v2/internal/configsources v1.4.35 → v1.4.40 github.com/aws/aws-sdk-go-v2/internal/endpoints/v2 v2.7.35 → v2.7.40 github.com/aws/aws-sdk-go-v2/internal/v4a v1.4.36 → v1.4.41 github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding v1.13.15 → v1.13.19 github.com/aws/aws-sdk-go-v2/service/internal/checksum v1.9.28 → v1.10.0 github.com/aws/aws-sdk-go-v2/service/internal/presigned-url v1.13.35 → v1.13.40 github.com/aws/aws-sdk-go-v2/service/internal/s3shared v1.19.36 → v1.19.41 github.com/aws/aws-sdk-go-v2/service/s3 v1.106.5 → v1.108.0 github.com/aws/aws-sdk-go-v2/service/signin v1.5.4 → v1.6.0 github.com/aws/aws-sdk-go-v2/service/sso v1.33.4 → v1.34.0 github.com/aws/aws-sdk-go-v2/service/ssooidc v1.38.4 → v1.39.0 github.com/aws/aws-sdk-go-v2/service/sts v1.45.4 → v1.46.0 github.com/aws/smithy-go v1.27.6 → v1.28.1 github.com/containerd/containerd/v2 v2.3.4 → v2.3.5 (🟢 remediated GHSA-7jxh-36q5-gcqv) github.com/docker/cli v29.7.2+incompatible → v29.8.0+incompatible github.com/google/go-containerregistry v0.21.9 → v0.22.1 github.com/googleapis/enterprise-certificate-proxy v0.3.19 → v0.3.20 github.com/googleapis/gax-go/v2 v2.23.0 → v2.24.0 github.com/gpustack/gguf-parser-go v0.25.0 → v0.26.3 github.com/hashicorp/go-getter v1.8.8 → v1.8.9 github.com/klauspost/compress v1.19.2 → v1.20.0 github.com/moby/moby/api v1.55.0 → v1.56.0 github.com/moby/moby/client v0.5.1 → v0.6.0 github.com/pandatix/go-cvss v0.6.2 → v0.6.4 github.com/terminalstatic/go-xsd-validate v0.1.6 → v0.1.8 golang.org/x/crypto v0.55.0 → v0.56.0 (🟢 remediated GO-2026-6354, GO-2026-6355) golang.org/x/mod v0.40.0 → v0.41.0 golang.org/x/time v0.15.0 → v0.16.0 google.golang.org/api v0.292.0 → v0.294.0 google.golang.org/genproto v0.0.0-aa98bba → v0.0.0-e75dac1 google.golang.org/genproto/googleapis/api v0.0.0-925bb5d → v0.0.0-e75dac1 google.golang.org/genproto/googleapis/rpc v0.0.0-6ac0973 → v0.0.0-08b0e42 google.golang.org/grpc v1.83.0 → v1.83.2 (🟢 remediated GHSA-2v4p-qf9q-27wj, GHSA-qc2q-p7wx-3px3, GHSA-vp52-pcj8-j9qc) google.golang.org/protobuf v1.36.12-0.f2248ac → v1.36.12 modernc.org/cc/v4 v4.29.1 → v4.29.2 modernc.org/ccgo/v4 v4

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.