v0.29.0

Added Features

• Add KEV transformer + processor [#507 @wagoodman]
• Enable EPSS and KEV vunnel providers [#515 @wagoodman]
• Add EPSS v6 transforms [#511 @wagoodman]

Bug Fixes

• Fix jenkins plugin matching for v6 DBs [#505 @wagoodman]
• Tag advisory URLs for v6 references [#491 @wagoodman]
• Remove CVSS base score being explicitly tracked in v6 blobs [#490 @wagoodman]
• Explicitly use syft pkg types for v6 github transformer [#499 @wagoodman]
• Fix RPM modularity [#506 @wagoodman]
• Explicitly consider NVD type (primary/secondary) when sorting CVSS [#516 @wagoodman]
• Account for v prefix on schema versions [#512 @wagoodman]

Additional Changes

• Switch manager package management from poetry to UV [#497 @wagoodman]
• update to go 1.24.x [#495 @westonsteimel]

(Full Changelog)

v0.28.0

Added Features

• Change DB publish workflow to account for V6 [#387]

Bug Fixes

• Fix listing.json validations threshold [#478 @wagoodman]
• Loosen vunnel schema version check [#463 @wagoodman]
• Installation Instructions Do Not Work as Written [#398 #468 @smythp]

Additional Changes

• Fix vulnerability gate threshold [#480 @wagoodman]
• Add DB v6 support to grype-db / grype-db-manager [#446 @wagoodman]
• fix composite GitHub action path in dependabot config [#473 @westonsteimel]
• add crane to binny [#470 @westonsteimel]
• bootstrap oras for use in ci [#469 @westonsteimel]
• Pin vunnel providers [#458 @wagoodman]

(Full Changelog)

v0.27.4

(Full Changelog)

v0.27.3

Bug Fixes

• Add request retry count for NVD [#444 @wagoodman]
• use timestamp from only provider if only one provider [#445 @willmurphyscode]

(Full Changelog)

v0.27.2

Additional Changes

• Consider all providers and edge cases when determining earliest data timestamp [#441 @wagoodman]
• Ignore NVD data age when crafting DB timestamp [#440 @wagoodman]

(Full Changelog)

v0.27.1

Additional Changes

• Add OS codename dataset [#433 @wagoodman]
• Migrate common processor code to internal [#432 @wagoodman]

(Full Changelog)

v0.27.0

Added Features

• Bump github.com/anchore/grype from 0.82.2 to 0.83.0 [#420 @dependabot]

(Full Changelog)

v0.26.0

Added Features

• Add symlink support for cache backup and restore [#415 @wagoodman]

(Full Changelog)

v0.25.1

(Full Changelog)

v0.25.0

Added Features

• Add config for inferring fixes from NVD [#411 @westonsteimel]
• Add config for CPE part filtering [#410 @wagoodman]

(Full Changelog)