{{ message }}
Repository navigation
Releases: docker/scout-cli
Releases · docker/scout-cli
Release list
v1.27.0
What's Changed
- Updates the Go toolchain to 1.26.10 to incorporate security fixes. @thaJeztah
v1.26.0
What's Changed
- Fixes
docker scout watchfailing with401 Unauthorizedabout 15 minutes after it starts. The Docker token is now refreshed before it expires, and an image that fails to process no longer stops the watcher; it is retried on the next check. @aubm - Fixes
docker scout attest listanddocker scout attest getso they find attestations attached as OCI referrers on Docker Hub and other registries. Previously only attestations served by the Scout registry were listed. @benja-M-1 - Fixes
docker scout quickviewshowing VEX-suppressed CVEs in the Target row when VEX suppresses every CVE in the image. @whostolebenfrog - Fixes DHI base-image VEX statements not being applied to multistage builds that use a mirrored DHI base image (
<org>/dhi-<name>naming). @flyingmachine - Fixes CycloneDX SBOM output to keep the original creation timestamp and generator tool names and versions. @brianru
- Updates the embedded Trivy (0.72.0) and Syft (1.46.0) scanning engines. @brianru
v1.25.0
What's Changed
- Adds discovery of software inside Debian and Alpine package archives, preserving package containment and separate package occurrences in SPDX SBOMs. Archive scanning is enabled by default and can be disabled with
SCOUT_SBOM_EXPAND_ARCHIVES=false. @brianru - Fixes manual vulnerability exception handling so image scans correctly mark suppressed vulnerabilities and filter them with
--ignore-suppressed, while reducing network requests. @whostolebenfrog - Moves exception details in
--format sbomoutput from the top-level inventory to each vulnerability’sexceptionsarray. Consumers counting manual suppressions must filter forMANUAL_EXCEPTION. @whostolebenfrog - Adds warnings when manual exceptions cannot be applied in local mode or when loading older native SBOMs with legacy exception inventories. Older SBOMs require rescanning to restore manual-exception suppression. @whostolebenfrog
- Updates the native Scout SBOM format to version 12 to support the expanded package inventory and SPDX relationships. @brianru
v1.24.0
What's Changed
- Adds local Scout Health Scores to
docker scout policy,quickview, andcompare. @cdupuis - Fixes
docker scout cves --only-baseand--ignore-baseto correctly classify packages from provenance-identified base images. @andrestylianos - Updates dependencies, including ORAS, Sigstore, OpenTelemetry, go-git, and pgx.
v1.23.1
What's Changed
- Fixes policy evaluation when using custom Rego policies without details metadata @whostolebenfrog
v1.23.0
What's Changed
- Prevents empty VEX documents from breaking scanning @flyingmachine
- Rego policy sources can be served via http(s) through --policy-file @cdupuis
- Performance improvements on SBOM fetching and policies evaluation @cdupuis
v1.22.0
What's Changed
- Proxies Trivy's Java DB download through Docker Desktop's HTTP proxy transport @AndreSilva1993
v1.21.0
What's Changed
- Fix local DHI-derived image handling, including inherited VEX and quickview base-image display
- Improve SBOM package qualifier handling, including DHI distro qualifiers
- Update dependencies and Go toolchain
v1.20.4
What's Changed
- Add JSON output format for docker scout compare @benja-M-1
- Add image config field changes to docker scout compare output @benja-M-1
- Fix Docker Desktop proxy detection in WSL2 environments @benja-M-1
- Update dependencies @benja-M-1
Contributors
benja-M-1
Assets 9
v1.20.3
What's Changed
- Improve retries of temporary and network errors @chrispatrick
- Fix handling of dockerfiles included in provenance attestations @chrispatrick
- Fix handling of cosign sig tags @chrispatrick
- Use Docker Desktop HTTP proxy transport when available @benja-M-1
Contributors
benja-M-1 and chrispatrick