Grype0.121.2

Grype scans container images, filesystems, and software bills of materials (SBOMs) to identify known vulnerabilities. You use its command-line interface to scan an image or directory directly, or provide an SBOM for faster vulnerability detection. It supports Docker, OCI, and Singularity image formats, along with major operating-system package ecosystems such as Alpine, Debian, Ubuntu, RHEL, Oracle Linux, and Amazon Linux.

Results can be prioritized using risk scoring, EPSS exploit-probability data, and the KEV catalog, helping teams focus on findings with greater practical risk. OpenVEX support lets you filter findings and augment scan results with vulnerability-exception context. Grype also works with Syft, allowing SBOMs produced by that tool to serve as scan input. These capabilities suit developers, security engineers, and release teams checking images or build artifacts in local workflows and automated security pipelines.

Grype is an open-source program from Anchore Inc. for x64 systems running Windows 10 or later, or Windows Server 2016 or later. Version 0.121.2 exposes distro-fixed dropped matches through ignoredMatches, so the --show-suppressed option can reveal them, and it makes --by-cve advisory merging deterministic between runs. The release also corrects the CPE example used by cpe-direct scans, preserves the namespace handling expected for Go module PURLs in OpenVEX transformations, and adds missing copyright-owner information needed for Debian packaging. It updates 54 dependencies and remediates six reported vulnerabilities in those dependencies.