Skip to content

v1.29.0

Latest
Latest

Choose a tag to compare

View all tags
@docker-scout-ci docker-scout-ci released this 28 Oct 21:02
v1.29.0
871b9c1
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

What's Changed

  • Fixes duplicate or inconsistent Debian, Alpine, and Docker Hardened Images package identities when installed package records and embedded SBOMs describe the same package, while preserving package and file evidence. @brianru
  • Fixes local policy evaluation ignoring Docker Desktop and HTTP_PROXY/HTTPS_PROXY settings for registry requests, which could cause policies to report "No data" on networks that require a proxy. @flyingmachine
  • Preserves provenance and SBOM attestations for local images when an older cached SBOM lacks those attestations, including entries created by Docker Desktop's background image indexer. @flyingmachine
  • Fixes a crash when exporting OpenVEX with docker scout vex get or docker scout attest get for an image referenced by digest without a tag. @andrestylianos
  • Fixes SBOM generation failures caused by Maven Central rate limits when scanning images or directories containing pom.xml files. Scout no longer resolves those files against remote Maven repositories during indexing. @astokes-docker
  • Updates the compression dependency to version 1.18.7 to address CVE-2026-63209. @brianru

SBOM compatibility

Generated Debian and Alpine binary package URLs now retain architecture and source-package qualifiers, including when no embedded SBOM is present. Existing generated SBOM caches are refreshed automatically. No new flag is required. Imported SBOMs and SBOM attestations retain their producer's identities.

Assets 9
Loading