Skip to content

v1.4.0

Choose a tag to compare

View all tags
@github-actions github-actions released this 27 Feb 23:26
· 205 commits to main since this release
v1.4.0
0dfaa1e

ScanRook v1.4.0

New Features

  • EPSS enrichment — Every finding now includes EPSS exploit probability scores from FIRST.org
  • CISA KEV tagging — Findings matching the Known Exploited Vulnerabilities catalog are automatically flagged
  • SBOM policy gates — New sbom policy check subcommand for CI/CD enforcement of vulnerability thresholds
  • License detection — Detect 15 license types (MIT, Apache-2.0, GPL, BSD, ISC, MPL, etc.) in source trees
  • 5 new distro ecosystems — Amazon Linux, Oracle Linux, AlmaLinux, Chainguard, Wolfi

Security

  • Fixed path traversal (Zip Slip) vulnerability in tar extraction
  • Hardened ISO extraction against symlink escape
  • Cache directories now created with 0o700 permissions
  • Decompression bomb protection (2GB per-entry limit)

Improvements

  • Expanded benchmark matrix: ubuntu:22.04, debian:12, alpine:3.20, rockylinux:9, node:22-slim
  • Updated README with full benchmark comparison table (ScanRook vs Trivy vs Grype)

Install

curl -fsSL https://scanrook.sh/install | bash

Or download the binary for your platform below.

Assets 7
Loading