v1.16.1

What's Changed

• Fix in-toto subject digest for the docker scout attestation add command by @cdupuis

v1.16.0

What's Changed

• Add secret scanning to sbom command by @cdupuis
• Keep original pattern to find nested matches too by @cdupuis
• Make licenses unqiue by @cdupuis
• Print platform in markdown output by @cdupuis
• Normalize licenses using spdx license list by @cdupuis
• Updates to make spdx output spec compliant by @cdupuis
• Check dir exists before creating temp file by @chrispatrick
• Update Go, crypto module and alpine by @cdupuis
• Add support for attestations for images from Tanzu Application Catalog by @cdupuis
• Fix behaviour with multi images in attest cmd by @cdupuis

v1.15.1

What's Changed

• Bug fixes by @cdupuis

New Contributors

• @neilprosser made their first contribution

v1.15.0

Highlights

• Add CycloneDX as output format for the sbom cmd

  - name: Docker Scout
    id: docker-scout-environment
    uses: docker/scout-action@v1
    with:
      command: sbom
      image: REF
      format: cyclonedx

Bug Fixes / Improvements

• Improve reading and caching of attestations with containerd image store.

---

Contributors

v1.14.0

Bug Fixes / Improvements

• Fix filtering by package in cves command
• Fix panic when analysing a file system input (with fs:// prefix)

---

Contributors

v1.13.0

Highlights

• Add --only-policy filter option to quickview, policy and compare commands.
• Add --ignore-suppressed filter option to cves and quickview commands to filter out CVEs affected by Scout suppressions.

Bug Fixes / Improvements

• Use conditional policy name in checks.
• Enable detection golang main module via ldflags.

---

Contributors

v1.12.0

Highlights

• Only display vulnerabilities from the base image:

  uses: docker/scout-action@v1
  with:
    command: cves
    image: [IMAGE]
    only-base: true

• Account for VEX in quickview command.

  uses: docker/scout-action@v1
  with:
    command: quickview
    image: [IMAGE]
    only-vex-affected: true
    vex-location: ./path/to/my.vex.json

• Account for VEX in cves command (GitHub Actions).

  uses: docker/scout-action@v1
  with:
    command: cves
    image: [IMAGE]
    only-vex-affected: true
    vex-location: ./path/to/my.vex.json

Bug Fixes / Improvements

• Update github.com/docker/docker to v26.1.5+incompatible to fix CVE-2024-41110.
• Update syft to 1.10.0.

---

Contributors

v1.11.0

Highlights

• Filter CVEs listed in the CISA Known Exploited Vulnerabilities catalog.

  uses: docker/scout-action@v1
  with:
    command: cves
    image: [IMAGE]
    only-cisa-kev: true

Bug Fixes / Improvements

• Allow VEX matching when no subcomponents.
• Fix panic when attaching an invalid VEX document.
• Fix SPDX document root.
• Fix base image detection when image uses SCRATCH as the base image.

---

Contributors

v1.10.0

Bug Fixes / Improvements

• Fix parsing image references in SPDX statement for images with a digest
• Support sbom:// prefix for image comparison (fixes #43)

  uses: docker/scout-action@v1
  with:
    command: compare
    image: sbom://image1.json
    to: sbom://image2.json

---

Contributors

v1.9.3

Bug Fixes

• Fix a panic while retrieving cached SBOM

---

Contributor