v1.17.1

Merge 0ed26ff2995b5161e1f022ce0d4c8784f734e8ac into 316180a8169b3d690…

v1.17.0

Merge 06950db6f2ad31441a4c4de8d9a8f77e49939278 into 7c7e97734176f1bb6…

v1.16.3

Merge 9d83a0e466620fe314516a67fd5c25a555a0f0eb into 127b463cf08f9854d…

v1.16.2

Merge b2b49dd0f4f5ab8072365d3891136ff93dc4ea12 into d86161fc267f472f1…

v1.16.1

What's Changed

• Fix in-toto subject digest for the docker scout attestation add command by @cdupuis

v1.16.0

What's Changed

• Add secret scanning to sbom command by @cdupuis
• Keep original pattern to find nested matches too by @cdupuis
• Make licenses unqiue by @cdupuis
• Print platform in markdown output by @cdupuis
• Normalize licenses using spdx license list by @cdupuis
• Updates to make spdx output spec compliant by @cdupuis
• Check dir exists before creating temp file by @chrispatrick
• Update Go, crypto module and alpine by @cdupuis
• Add support for attestations for images from Tanzu Application Catalog by @cdupuis
• Fix behaviour with multi images in attest cmd by @cdupuis

v1.15.1

What's Changed

• Bug fixes by @cdupuis

New Contributors

• @neilprosser made their first contribution

v1.15.0

Highlights

• Add CycloneDX as output format for the sbom cmd

  $ docker scout sbom --format cyclonedx REF
  

Bug Fixes / Improvements

• Support to enable/disable repositories that were enabled via docker scout push or docker scout watch.
• Use high-to-low sort order for cves summary
  • Before:
    
  • After:
    
• Improve messaging when analysing oci directories without attentions. Only single arch image and multi arch image with attestations are supported. Multi arch image without attestation is not supported.
• Improve classifiers and sbom scanner:
  • Add classifier for liquibase lpm
  • Add support for buildkit extra sbom scanner args.
  • Add Rakudo Star/MoarVM binary classifier
  • Add binary classifiers for silverpeas utilities
• Improve reading and caching of attestations with containerd image store.

---

Contributors

v1.14.0

Highlights

• Add suppression information at the CVE level in the cves command.
  Accepted risk
  
  False positive
  
  Read more on how to manage vulnerability exceptions

Bug Fixes / Improvements

• Fix listing CVEs for dangling images (i.e local://sha256:...)
• Fix panic when analysing a file system input, for instance with docker scout cves fs://.

---

Contributors

v1.13.0

Highlights

• Add --only-policy filter option to quickview, policy and compare commands.
• Add --ignore-suppressed filter option to cves and quickview commands to filter out CVEs affected by Scout suppressions.

Bug Fixes / Improvements

• Use conditional policy name in checks.
• Enable detection golang main module via ldflags.

---

Contributors