Skip to content

v0.75.1

Choose a tag to compare

@github-actions github-actions released this 09 Aug 21:15
· 662 commits to main since this release
3f1d18f

Changed

  • A secrets finding says why it outranks its component. The note read ↑ ranked as internet-facing: a credential is valid wherever it is valid — the mechanism, printed against a
    component you had classified as internal, so it read as a claim about the component that you
    could see was untrue. It now states the conclusion: ↑ a leaked credential is high priority wherever it is found.

Fixed

  • A scanner that tried several ways reports why each failed. A tool looking for an image ends
    its first line with 4 errors occurred: and puts them on the lines after — so the report said
    the image could not be found in any of four places, and dropped the line saying the registry
    answered 401 Unauthorized. That is the difference between checking the image name and logging
    in. A message ending by promising a list now carries it.
  • A failing scanner leads with what went wrong. A tool's error is a chain running from general
    to specific, and Draugr has already said which scanner, control and component — so the tool's own
    account of what it was doing spent the whole message restating that, and pushed the words naming
    the failure off the end. An image that cannot be pulled reported FATAL Fatal error run error …
    and is now … unable to find the specified image "…" in ["docker" "containerd" …]. The log
    timestamp and level are dropped too.