Clair

Static analysis tool for vulnerabilities in container images (used by Quay.io).

Overview

Features

Feature reference: Official Documentation

Release History

Source: https://github.com/quay/clair/releases

v4.9.0 — 2025-12-10 security

v4.9.0 Release

Unreleased

v4.9.0 - 2025-12-10

Claircore

• enrichment: don't consider vulnerability.Description for enrichments
  

  Descriptions can often refer to different CVEs or multiple CVEs to the actual CVE that is associated to the vulnerability leading to erroneous scores. We should only consider the Name and Links fields.

• postgres: better GetEnrichments query
  

  The new query is in "normal" `JOIN`-and-`WHERE` form and does not use the `latest_update_operations` view. In testing, this was much quicker to execute.

• rpm: fix use of unique.Handle pinning fs.FS
  

  Previous code wouldn't allow memory resources to be reclaimed and could lead to excessive memory consumption by the indexer in v1.5.40.

• vex: account for new VEX RPM module logic
  

  The Red Hat security data team are updating how modules are represented in VEX files, this change accounts for that update. Specifically, module relationships are no longer formally expressed through VEX relationships but rather as PURL qualifiers.

• cvss: switch to NVD 2.0 JSON feeds
  

  NVD deprecated their 1.1 JSON feed which claircore relied on for CVSS enrichment data. This change updates the CVSS enricher updater to use the 2.0 feeds.

• chore: upgrade from pgx v4 to v5
  

  In July 2025 v4 will reach end of life. This change updates claircore to use v5.

• vex: allow timeout to pull down VEX archive to be configurable
  

  As part of the RHEL VEX update process claircore will initially pull down an archive of all CVEs, this archive includes all CVEs not just the ones that affect Red Hat products. This means the file (while compressed) will be quite large. The code previously allowed a timeout of 2 minutes to pull down this file. This value remains the default but users have the option to configure it to a different value using updaters.config.rhel-vex.compressed_file_timeout.

• rpm: add function to determine if packages are installed from RPMs
  

  This change allows language detectors to be able to discard packages that have been determined to have come from an RPM package. This ensures that only the RPM package is matched to advisories and reduces false-positives where language packages are patched but their metadata is not updated (or cannot be updated).

• sbom: add encoder to encode index reports as SPDX documents
  

  This change adds the ability in claircore to convert an index report into an SPDX-2.3 document.

• rhel: deprecate updater in favor of VEX updater
  

  We can extract vulnerability information about containers from the VEX data. This negates the need to look for it in the cvemap.xml file. This change modifies the VEX updater to allow for ingesting vulnerabilities in a way that can be matched my the RHCC matcher.

• suse: dynamic distribution discovery
  

  Previously Suse distributions were static/predefined in the code, the lack of updates to those definitions had allowed the Suse support lapse. This change adds dynamic support for two Suse distro flavors: suse.linux.enterprise.server and opensuse.leap.

All

• 1aca06b8: fix formatted print calls

Amqp

• 1a9f8769: add deprecation notice

Build(Deps)

• e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
• f54011b5: bump golang.org/x/sync from 0.8.0 to 0.9.0
• ee5524b8: bump go.opentelemetry.io/otel/sdk from 1.31.0 to 1.32.0
• 757b649c: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 20c0040f: bump github.com/go-stomp/stomp/v3 from 3.1.2 to 3.1.3
• 1607766c: bump github.com/prometheus/client_golang
• 0a3a4611: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 12ea7bf9: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 146d4a67: bump github.com/urfave/cli/v2 from 2.27.3 to 2.27.5
• 50003694: bump github.com/klauspost/compress from 1.17.10 to 1.17.11
• 6069bb24: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace

Chore

• f6a412cc: v4.9.0 changelog bump
• cbfd97b6: fix typos in config.yaml.sample
• 7c9c079b: update claircore to v1.5.48
• 8e9a6d46: update claircore to v1.5.47
• 804ef6a4: update claircore to v1.5.46
• a50727a3: add DVO ignore annotations
• 8d991938: update claircore to v1.5.45
• ff2059cf: update claircore to v1.5.44
• db51ed82: update claircore to v1.5.42
• c2dc1766: update claircore to v1.5.41
• 8aa9e1e2: update claircore to v1.5.40
• eca299b7: update go references to go1.24
• 1660b66b: upgrade from pgx v4 to v5
• 68d03bae: remove reviews from dependabot config
• 0c5292e7: upgrade config module to v1.4.2
• e5d4c19c: update minimum go version to 1.23
• e45fbf0e: update claircore to v1.5.35
• 708bf2f5: update local-dev tracing configs to fix errors
• 216ca2f1: update claircore to v1.5.34
• dde57fc1: update openAPI spec to remove SourcePackage
• e5149fd3: group some dependencies to avoid excessive PRs
• 60ebea73: update claircore to v1.5.33

Chore(Deps)

• f598d3ec: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• a952e3c6: bump the otel group with 11 updates
• 878fbceb: bump github.com/google/go-containerregistry
• 468e409c: bump actions/upload-artifact from 4 to 5
• c87bc8f0: bump github.com/klauspost/compress from 1.18.1 to 1.18.2
• 2a5c11fd: bump actions/checkout from 5 to 6
• b12439f4: bump golang.org/x/crypto from 0.44.0 to 0.45.0
• e169a50a: bump google.golang.org/grpc from 1.76.0 to 1.77.0
• 3e778f2c: bump golang.org/x/net in the golang-x group
• 4563ccbd: bump github.com/go-stomp/stomp/v3 from 3.1.3 to 3.1.5
• 195cdb06: bump golang.org/x/sync in the golang-x group
• b50044f4: bump actions/download-artifact from 5 to 6
• 1b429595: bump github.com/klauspost/compress from 1.18.0 to 1.18.1
• e439e4df: bump the golang-x group with 2 updates
• fe37c68b: bump google.golang.org/grpc from 1.75.1 to 1.76.0
• ee6ea1c8: bump github.com/quay/claircore from 1.5.42 to 1.5.43
• afcfd7f0: bump google.golang.org/grpc from 1.75.0 to 1.75.1
• 6a4937e4: bump the golang-x group across 1 directory with 3 updates
• 53cf68e9: bump github.com/jackc/pgx/v5 from 5.7.5 to 5.7.6
• e9850949: bump github.com/prometheus/client_golang
• 290969cd: bump actions/stale from 9 to 10
• 5b5519b5: bump actions/github-script from 7 to 8
• b78c76b1: bump actions/setup-go from 5 to 6
• b1f4716b: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 93174450: bump github.com/grafana/pyroscope-go/godeltaprof
• 0f1fde39: bump the otel group with 11 updates
• 8dbb0f48: bump golang.org/x/net in the golang-x group
• a35a1281: bump github.com/ulikunitz/xz from 0.5.11 to 0.5.14
• 1fa9a753: bump actions/checkout from 4 to 5
• f0b0949c: bump actions/download-artifact from 4 to 5
• 890f4a1b: bump github.com/prometheus/client_golang
• 80add42b: bump google.golang.org/grpc from 1.73.0 to 1.75.0
• e4746794: bump github.com/jackc/pgx/v5 from 5.7.4 to 5.7.5
• ba6fe31c: bump go.opentelemetry.io/otel/exporters/prometheus
• 40b0402e: bump the golang-x group with 2 updates
• f9635886: bump github.com/quay/zlog from 1.1.8 to 1.1.9
• 4415106e: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• b7325ada: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 78b92595: bump the otel group with 11 updates
• 62956271: bump github.com/urfave/cli/v2 from 2.27.6 to 2.27.7
• 440eee8e: bump github.com/google/go-containerregistry
• e75e2e2b: bump the golang-x group with 3 updates
• cf20adbd: bump google.golang.org/grpc from 1.72.2 to 1.73.0
• d9c211b4: bump github.com/quay/claircore from 1.5.37 to 1.5.38
• 6338de8b: bump github.com/ugorji/go/codec from 1.2.12 to 1.2.14
• 566271a1: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 3e3a2d33: bump github.com/google/go-containerregistry
• 81b725ba: bump google.golang.org/grpc from 1.72.1 to 1.72.2
• faad36e2: bump the otel group with 11 updates
• 7979e036: bump google.golang.org/grpc from 1.72.0 to 1.72.1
• 99ab2c1a: bump the golang-x group with 2 updates
• a166f610: bump github.com/quay/claircore from 1.5.36 to 1.5.37
• d8e9dcf4: bump google.golang.org/grpc from 1.71.1 to 1.72.0
• bfa8f11d: bump github.com/quay/claircore from 1.5.35 to 1.5.36
• f8a41628: bump github.com/prometheus/client_golang
• 7ce22abe: bump google.golang.org/grpc from 1.71.0 to 1.71.1
• c53cf2ba: bump the golang-x group with 2 updates
• a5833a44: bump golang.org/x/net in the golang-x group
• cc6fb14a: bump github.com/rs/zerolog from 1.33.0 to 1.34.0
• 851e4a36: bump github.com/urfave/cli/v2 from 2.27.5 to 2.27.6
• e9997624: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• a73e832b: bump github.com/prometheus/client_golang
• 35110e9e: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 0a9866e3: bump the golang-x group with 3 updates
• 1ce14606: bump the otel group with 11 updates
• 919d5287: bump github.com/google/go-cmp in /config
• 2673e4f4: bump github.com/rogpeppe/go-internal from 1.13.1 to 1.14.1
• cf7af98a: bump github.com/go-jose/go-jose/v3 from 3.0.3 to 3.0.4
• 6c9fae1e: bump github.com/google/go-cmp from 0.6.0 to 0.7.0
• 707d8049: bump github.com/prometheus/client_golang
• 136a618f: bump github.com/klauspost/compress from 1.17.11 to 1.18.0
• 3e7c6e74: bump the golang-x group with 3 updates
• 73db520d: bump github.com/evanphx/json-patch/v5 from 5.9.10 to 5.9.11
• a3a60f10: bump google.golang.org/grpc from 1.69.4 to 1.70.0
• cc29705c: bump github.com/evanphx/json-patch/v5 from 5.9.0 to 5.9.10
• d05b4049: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 8b99d320: bump the otel group with 11 updates
• b2c66991: bump google.golang.org/grpc from 1.69.2 to 1.69.4
• ef4a1f11: bump the golang-x group with 2 updates
• 38b77499: bump golang.org/x/net in the golang-x group
• 80c0381a: bump the otel group across 1 directory with 2 updates
• 3eff1ef1: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 5bf85313: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 9ebb61d9: bump golang.org/x/crypto from 0.30.0 to 0.31.0
• 0881e079: bump the golang-x group with 2 updates
• f556ef16: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• bf8737a1: bump golang.org/x/net in the golang-x group
• f1d9aae4: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace

Chore(Manifests)

• 48b75fe4: add anti-affinity rules

Ci

• a0a35fd7: Allow go test to access un-vendored dependencies

Cicd

• ab791a2e: run multiarch tests without a full container
• 935a61f3: vendor modules into nightly source

Clairctl

• 4c93f8ea: Print a friendly error on panic
• #2221### Config
• 0db9beaf: add ability to disable enrichment
• 7ab81b38: clean environment in example

Dev

• 503215f5: rename dashboard.json file to clair.json
• 65cd4244: add a grafana dashboard for postgres stats

Docker

• 10485679: remove version line from docker-compose.yaml

Docker-Compose

• 8c71b46e: update containers

Enrichments

• 6527a9ec: disable enrichers if config option is set

Fix

• 0a8c3864: typo in variable name

Go.Mod

• 6db583f7: Update Go version to 1.24.9 for CVE-2025-47907

Health

• b57b9fa6: using atomic.Uint32

Introspection

• 797c2f45: implement OTLP support for metrics and traces

Misc

• 5891f64b: remove API doc make target, CI check

Notifier

• a9a68e18: increase default durations to be more reasonable

Openapi

• 8c540b96: rebuild OpenAPI spec

Signer

• 1c6d0496: initialize before checking for PSK
• Fixes #2214 - #2221### Stomp
• b2501ba3: ignore Unsubscribe error in test
• 0b8e3507: add deprecation notice
• 684be8d0: catch test-specific error

Types/V1

• 50d0164b: add JSON API v1 types and schemas

Reverts

• cicd: exclude darwin/arm64

v4.8.0 — 2024-10-09 security

v4.8.0 Release

Unreleased

v4.8.0 - 2024-10-09

NOTE

This release deprecates the updaters that rely on the Red Hat OVAL v2 security data in favor of the Red Hat VEX data. This change includes a database migration to delete all the vulnerabilities that originated from the OVAL v2 feeds, meaning there could be a time in production environments before the VEX updater completes for the first time when no Red Hat vulnerabilities exist. This release also contains a clairctl admin command to clean up the deprecated vulnerabilities outside of the migration workflow which allows an operator to pre-run the migration:

clairctl -D admin pre v4.8.0

Claircore

• rhel: move IgnoreUnpatched config key from updater to matcher
  

  Previously the IgnoreUnpatched config key was a part of the RHEL updater and would dictate whether or not the updater would ingest unpatched vulnerabilities. This change moves that key to the RHEL matcher and dictates whether the matcher should check for a fixed_in_version when querying potential vulnerabilities. This makes the config option more usable at the expense of DB size.

• rhel: add csaf/vex updater
  

  Replace the RHEL OVAL updater with a CSAF/VEX updater for Red Hat security data. Update the matching logic to deal with CPE patterns coming from the VEX files. Remove RHEL updater and add a migration to delete Red Hat OVAL data from the database.

• datastore: add vuln and enrich stream updates
  

  In an effort to reduce memory consumption during updating the vulnerability database, add support for iterators. Extend Updater interface with `UpdateVulnerabilitiesIter` method that performs the same operation as `UpdateVulnerabilities` but accepts an iterator function instead of a slice. Also, extend the `EnrichmentUpdater` interface with `UpdateEnrichmentsIter` in the same way.

• cpe: add match expression support
  

  This adds support for NIST IR 7696, aka CPE2.3 Name Matching. It's anticipated to be used in upcoming CSAF/VEX support. See https://doi.org/10.6028/NIST.IR.7696 for the specification.

'Chore

• ab3a754e: update claircore to v1.5.19
• f783b356: update claircore to v1.5.18
• 9286ab86: update claircore to v1.5.17

Admin

• d3467bad: add pre v4.8.0 admin command to delete OVAL vulns
• d53780b6: add a check for compatible migration version
• 87c24a9c: add command to update go packages with norm_version
• 02e6c925: add pre v4.7.3 admin command to create index

All

• 55294aaf: fix incorrect API paths
• daa78ec2: fix some typos

Amqp

• 8fcd294c: migrate to maintained package
• #1793### Auto
• 07b0ea7b: improve log messages
• #2092### Build(Deps)
• 5092198b: bump golang.org/x/time from 0.6.0 to 0.7.0
• e7b6deac: bump golang.org/x/net from 0.29.0 to 0.30.0
• 55fb7735: bump github.com/klauspost/compress from 1.17.9 to 1.17.10
• 7a2e7186: bump github.com/prometheus/client_golang
• 698d9170: bump github.com/rogpeppe/go-internal from 1.12.0 to 1.13.1
• 7ec7e04f: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 96ee336f: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 5fb41ed8: bump golang.org/x/net from 0.28.0 to 0.29.0
• 2a13e7b7: bump peter-evans/create-pull-request from 6 to 7
• 061b1e09: bump github.com/prometheus/client_golang
• a2c920f4: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• bbaece4e: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 24aff4e4: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• b203913a: bump github.com/prometheus/client_golang
• 96937294: bump github.com/grafana/pyroscope-go/godeltaprof
• 01b57db6: bump github.com/google/go-containerregistry
• 7ceeaaa2: bump github.com/go-stomp/stomp/v3 from 3.1.1 to 3.1.2
• c3ce1982: bump github.com/urfave/cli/v2 from 2.27.2 to 2.27.3
• 95f5a5f2: bump github.com/google/go-containerregistry
• 1a5f342c: bump github.com/go-stomp/stomp/v3 from 3.1.0 to 3.1.1
• 5821a5bf: bump golang.org/x/net from 0.26.0 to 0.27.0
• 08587861: bump github.com/google/go-containerregistry
• 74914938: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 67bdbbbe: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• dd9d6760: bump go.opentelemetry.io/otel from 1.27.0 to 1.28.0
• fcee4364: bump github.com/klauspost/compress from 1.17.8 to 1.17.9
• 3f229e99: bump github.com/google/go-containerregistry
• c5ae5021: bump docker/build-push-action from 5 to 6
• 7400db24: bump golang.org/x/net from 0.25.0 to 0.26.0
• 74b377b8: bump github.com/rs/zerolog from 1.32.0 to 1.33.0
• 1fff0726: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• f2533fbf: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 5376a756: bump github.com/rabbitmq/amqp091-go from 1.9.0 to 1.10.0
• d82ab343: bump golang.org/x/net from 0.24.0 to 0.25.0
• 453d2c60: bump github.com/urfave/cli/v2 from 2.27.1 to 2.27.2
• 5323fa31: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 3e1f5c15: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 71078832: bump go.opentelemetry.io/otel from 1.25.0 to 1.26.0
• 1006287a: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 43f3a3e4: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 343515af: bump github.com/klauspost/compress from 1.17.7 to 1.17.8
• c3db2e4d: bump github.com/quay/claircore from 1.5.25 to 1.5.26
• 4cf0febf: bump golang.org/x/sync from 0.6.0 to 0.7.0
• 36d21edd: bump golang.org/x/net from 0.22.0 to 0.24.0
• 93a70b35: bump go.opentelemetry.io/otel/sdk from 1.24.0 to 1.25.0
• da30be8b: bump github.com/google/go-containerregistry
• 5a5e1776: bump golang.org/x/net from 0.21.0 to 0.22.0
• d4ceeea2: bump github.com/go-jose/go-jose/v3 from 3.0.2 to 3.0.3
• d64064ce: bump github.com/prometheus/client_golang
• 06c9ddab: bump github.com/jackc/pgx/v4 from 4.18.1 to 4.18.3
• e4d79110: bump github.com/go-stomp/stomp/v3 from 3.0.6 to 3.1.0
• d7c5821f: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 523ebf7f: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 0803380f: bump github.com/go-jose/go-jose/v3 from 3.0.1 to 3.0.2
• a3e0786c: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 684c3ac3: bump peter-evans/create-pull-request from 6.0.0 to 6.0.1
• 3fb2c921: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 51981290: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 115cbb22: bump github.com/go-stomp/stomp/v3 from 3.0.5 to 3.0.6
• 43b164e7: bump golang.org/x/net from 0.20.0 to 0.21.0
• acf2cdf6: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• 0c7fe4dd: bump go.opentelemetry.io/otel/sdk from 1.22.0 to 1.23.1
• 16a1504a: bump go.opentelemetry.io/otel from 1.22.0 to 1.23.1
• 1f98abe7: bump peter-evans/create-pull-request from 5.0.2 to 6.0.0
• fb5efb51: bump github.com/klauspost/compress from 1.17.5 to 1.17.6
• 8dbacd3c: bump github.com/rs/zerolog from 1.31.0 to 1.32.0
• 96d34f64: bump github.com/google/go-containerregistry
• 3bcf9aac: bump github.com/klauspost/compress from 1.17.4 to 1.17.5
• 19afbbbe: bump github.com/evanphx/json-patch/v5 from 5.8.0 to 5.9.0
• 50eb4b52: bump github.com/google/uuid from 1.5.0 to 1.6.0
• 4ed100ec: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 1d338051: bump actions/cache from 3 to 4
• a0e1ba8b: bump github.com/grafana/pyroscope-go/godeltaprof
• 1ab0557b: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• fcf0ccdd: bump go.opentelemetry.io/otel/sdk from 1.21.0 to 1.22.0
• 6fe56438: bump github.com/evanphx/json-patch/v5 from 5.7.0 to 5.8.0
• 6ef2554e: bump golang.org/x/net from 0.19.0 to 0.20.0
• 7b48e897: bump golang.org/x/sync from 0.5.0 to 0.6.0
• c25d841a: bump github.com/quay/zlog from 1.1.7 to 1.1.8
• 94b57fa0: bump github.com/prometheus/client_golang
• ad2c872c: bump github.com/urfave/cli/v2 from 2.26.0 to 2.27.1
• 2159bfb5: bump github.com/google/uuid from 1.4.0 to 1.5.0
• aaa335b3: bump golang.org/x/crypto from 0.16.0 to 0.17.0
• 9c588cf5: bump github.com/google/go-containerregistry
• cbc166d6: bump actions/upload-artifact from 3 to 4
• 355cab98: bump actions/download-artifact from 3 to 4
• 7b7ff298: bump github.com/ugorji/go/codec from 1.2.11 to 1.2.12
• 45625c51: bump github.com/urfave/cli/v2 from 2.25.7 to 2.26.0
• b6b39706: bump actions/setup-go from 4 to 5
• 913a5114: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 71c66638: bump github.com/klauspost/compress from 1.17.2 to 1.17.4
• 825dddc1: bump golang.org/x/net from 0.17.0 to 0.19.0
• e7314325: bump actions/stale from 8 to 9
• 99291347: bump github.com/quay/zlog from 1.1.5 to 1.1.7
• d75c2c40: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 83a935dd: bump go.opentelemetry.io/otel/sdk from 1.20.0 to 1.21.0
• 4db3b77e: bump github.com/go-jose/go-jose/v3
• 1b2248b9: update opentelemetry modules
• #1909 - #1911 - #1912 - #1913- 4a84b949: bump github.com/google/uuid from 1.3.1 to 1.4.0
• efc1ab07: bump golang.org/x/time from 0.3.0 to 0.4.0
• 61aa3ebd: bump golang.org/x/sync from 0.4.0 to 0.5.0
• 54eb2e85: bump github.com/google/go-cmp from 0.5.9 to 0.6.0
• b0497e58: bump github.com/klauspost/compress from 1.17.0 to 1.17.2
• a90ecc45: bump go.opentelemetry.io/otel/sdk from 1.17.0 to 1.19.0
• 55dc551f: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• 5a8c21a0: bump github.com/google/go-cmp in /config
• f3072d19: bump go.opentelemetry.io/otel from 1.18.0 to 1.19.0
• 8468d861: bump golang.org/x/net from 0.16.0 to 0.17.0
• afafe835: bump golang.org/x/net from 0.15.0 to 0.16.0
• f162e1ce: bump github.com/rs/zerolog from 1.30.0 to 1.31.0
• e6f72bc4: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• c0eef84b: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 7129bacf: bump github.com/evanphx/json-patch/v5 from 5.6.0 to 5.7.0
• 6969e003: bump docker/setup-buildx-action from 2 to 3
• 606c5c9b: bump docker/login-action from 2 to 3
• 24eb3f71: bump docker/build-push-action from 4 to 5
• dbaebb58: bump docker/setup-qemu-action from 2 to 3
• a31be2e2: bump actions/checkout from 3 to 4
• 480996b1: bump go.opentelemetry.io/otel/exporters/jaeger
• bc21afa0: bump github.com/google/uuid from 1.3.0 to 1.3.1
• 5ae4f0fa: bump github.com/google/go-containerregistry
• 56cd1851: bump github.com/rs/zerolog from 1.29.1 to 1.30.0
• 67b92e71: bump golang.org/x/net from 0.12.0 to 0.15.0
• a478ce91: bump github.com/pyroscope-io/godeltaprof

Chore

• 05680a2b: v4.8.0 changelog bump
• 94113d95: update claircore to v1.5.32
• e77deb98: update config module to v1.4.1
• e5fca953: update references to rhel updater to rhel-vex updater
• 64b66ff9: update go version to specific patch
• 89ebd521: update go version to 1.22
• 9333770e: update claircore to v1.5.31
• 93fa883d: update claircore to v1.5.30
• 1209772d: update claircore to v1.5.29
• 3c623553: run the go formatting over the repo
• 7703b4a2: fix some comments
• 7d3f12e3: use the merge-multiple directive when downloading binaries
• b5a0d8a6: update claircore to v1.5.28
• ac255112: Add merge step when creating release binaries
• 5dc73b16: update go version for release
• ea990567: update claircore to v1.5.27
• 0bf9286e: update production manifest with new tmp dir
• 6a3ce17f: update go version
• 3e5740e0: remove repetitive word
• 222f2273: update claircore to v1.5.25
• 7ac4609b: update claircore to v1.5.24
• bad8abe5: update claircore to v1.5.23
• c81b3b9a: update claircore to v1.5.22
• a9b5e91d: update claircore to v1.5.21
• 6de0d807: Add Go 1.22 support via moved godeltaprof dependancy bump
• b65445ce: clean up sample config
• a359eb01: migrate go-jose to maintained version
• 5cf5fb8d: update claircore to v1.5.20
• 180fa4f4: bump claircore to v1.5.16
• 696b266e: bump claircore to v1.5.15
• 2829eacf: bump claircore to v1.5.14

Cicd

• dbcfe30d: tweak login behavior
• 6861b804: remove second go-caching action
• c42bee62: improve nightly script output
• 08581d82: tweaks to the set-image-expiration action
• 3b650c56: fix nightly build
• 6884969b: add /var/tmp mount to make sure it's on a real filesystem
• 139aed21: reorganize the docker test so that it's less error-prone
• b48682a4: remove comment that the linter complained about
• bf7005f0: add /fast-forward command
• d11a2602: add container version skew check
• fd153765: update testing workflow
• 23a8c33d: don't upload workspace on failure
• 6f3b1347: update actions/cache version
• 0604f1e6: change version specifiers to be major-version only
• 718ef948: make nightly script shellcheck-clean

Clair

• ba6fc371: add platform-specific signals
• 76a5d50b: break cancellation chain for request contexts
• b0086d80: redo shutdown structure
• #1946### Clairctl
• 13acc582: warn when range requests are not honored

Cmd

• 7de8cea7: add exported source date
• 7121ceaa: annotate fake key for gitleaks

Compress

• c90a55fd: update compression middleware

Config

• 33a77438: update minimum TLS version for server
• e0a1f235: Update comment to describe currently supported updaters
• 36210370: add Sentry config
• 33cc3e5c: add OTLP configuration types
• f503d670: fix typo

Contrib

• 74974320: correct position of startupProbe spec
• 5ad0d6be: update build_and_deploy.sh script
• accee22f: account for different container engine clients
• 1160febe: update build script to use podman
• f19b59bd: remove rms that were needed for previous fetcher
• b60d8266: update dashboard regex
• 4405fdad: simplify openshift/pr_check.sh
• 16bd3666: add grafana dashboards for deletion metrics

Contrib/Openshfit

• 89af3db1: only start buildkitd container if needed

Contrib/Openshift

• ab6e9e07: login shenanigans
• 002df72b: avoid patching when using upstream images

Doc

• 244183ee: fix typo

Dockerfile

• f7abfe50: update with new syntax and features
• e2fbf199: add GOTOOLCHAIN
• e871998f: tweak ignores
• d78d3beb: remove sh loop

Docs

• 038966e2: add building and Makefile usage sections
• 137b6c50: add mention of disk space path and usage
• 1e78f45a: add OTLP configuration to prose documentation
• eb54b889: add dropins to prose documentation
• #1783### Documentation
• 80482345: add more information on how to test and get started

Documentation

• 38b72352: correct stale configuration options

Httptransport

• 20582315: fix test flake
• df348dc9: GET vuln report returns 404 when indexing in-progress
• e84883f7: change api error handling to panic internally
• c7920962: add metrics test
• 15732398: add unauthenticated "/robots.txt" endpoint
• 201ed2be: add "robots.txt" endpoint
• 5262f773: add client-close detection
• e97f6b3c: use compression middleware
• 0d2bf7e6: lints
• d4b9d30f: rework constructor
• 067bf861: update DiscoveryHandler to new style
• 7a1186e3: re-instrument handlers with new primitives
• bddbc57b: exit goroutine in error helper

Httputil

• 1fd77f0d: add test for non-OK statuses
• 0cde61bf: add response recorder

Initialize

• 4686fb46: use defaults for NewRemoteFetcher

Introspection

• c31e40e3: lints
• 8e1a7bd8: allow trace shutdown hook full timeout

Makefile

• 95a765f4: fix direct go command
• a9a8ec98: make buildctl usage more convenient
• 2c093d9c: force line endings for git archive
• f7bfacf1: rebuild the make setup
• 7cc2107b: updates

Openshift

• 6bb55a21: add backstop cron manifest
• 3615748d: handle multiple Dockerfiles in build script
• 5f36fc12: have the pr_check script "dry run" a build
• 3d3c03ce: add "dry run" flag
• 135af0e0: make build_and_deploy script shellcheck-clean

Quaybackstop

• e5e7ba5a: add backstop GC command

README

• abd13784: format nit

Stomp

• 3de24d71: guard against race in test

Webhook

• 41cda1fb: move+update debug server

v4.7.4 — 2024-05-01 feature

v4.7.4 Release

Unreleased

v4.7.4 - 2024-05-01

NOTE

The default layer download location has changed

Claircore

• tarfs: follow hardlinks in ReadFile
  

  This makes `fs.ReadFile` work as expected when opening hardlinks.

• debian: update how "source" packages are handled
  

  Previously, the Updater parsed metadata from the repository to try to record only "binary" packages. This was inaccurate and, with the new dpkg handling, now unneeded. The new approach should be more accurate.

• dpkg: improve Source handling
  

  The dpkg handling machinery now correctly records source packages and versions. Previously, version differences between a source package and the resulting binary package(s) were incorrect if the versions were not identical.

• libindex: add O_TMPFILE fallback logic
  

  After discovering that some common deployment methods are incompatible with using the `O_TMPFILE` `open(2)` flag, a fallback path has been added. The changes also move the default location of where temporary files are downloaded to, to better align with the layout recommended by systemd. Please see [the documentation] for specifics. [the documentation]: https://pkg.go.dev/github.com/quay/claircore/libindex@v1.5. 26-0.20240325212310-fedb9d327aa7#NewRemoteFetchArena

• osv: parse database_specific severity when no CVSS severity is defined
  

  Occasionally there are OSV advisories that don't include any severity information in the `.severity` object but they do contain a severity in the `.database_specific` object. This change attempts to parse that severity if we don't get a severity from the native `.severity` object.

Build(Deps)

• 3ebd889c: bump peter-evans/create-pull-request from 6.0.0 to 6.0.1
• b7566a0f: bump peter-evans/create-pull-request from 5.0.2 to 6.0.0
• 4db2f09b: bump actions/cache from 3 to 4
• 6cef8311: bump actions/upload-artifact from 3 to 4
• 5ed80215: bump actions/download-artifact from 3 to 4
• c9e1f56b: bump actions/setup-go from 4 to 5
• 3ab3de55: bump actions/stale from 8 to 9
• 591188f0: bump docker/setup-buildx-action from 2 to 3
• 7ef6ef6b: bump docker/login-action from 2 to 3
• 5597e7cc: bump docker/build-push-action from 4 to 5
• 14d7f2b4: bump docker/setup-qemu-action from 2 to 3
• 1204db98: bump actions/checkout from 3 to 4

Chore

• 4170798b: 4.7.4 changelog bump
• 96dc6074: Add merge step when creating release binaries
• a1c7eb7c: update go version for release
• 6eeb9393: update claircore to v1.5.27
• 809dd5ab: update go version

Cicd

• e6378d03: add container version skew check
• 2ba3ecc0: update testing workflow
• ae135c49: don't upload workspace on failure
• 7222dc88: change version specifiers to be major-version only

Clairctl

• 2a2ba37f: warn when range requests are not honored

Dockerfile

• 5547b96a: remove sh loop

Docs

• 3753415b: add mention of disk space path and usage

Httptransport

• c6df986f: GET vuln report returns 404 when indexing in-progress

Initialize

• 9828576a: use defaults for NewRemoteFetcher

v4.7.3 — 2024-02-26 feature

v4.7.3 Release

Highlights:

• The minimum TLS version is now 1.2. Previously, servers also allowed 1.1 connections.
• Claircore is updated to v1.5.25:
  
  - rhcc, rhel: support compression of sideband data

  If a Clair instance is using local files for the data needed for the `rhel` and `rhcc` indexers, this data may now be compressed. This should allow for the files to fit within a Kubernetes ConfigMap, making some deployments easier to wrangle.

  - datastore: add "delta" update interface

  This change should allow for updaters to use fewer resources and consume API-based data sources in the future. As of this change, no in-tree updaters have been converted to this interface.

  - java: size buffers correctly before use

  This should reduce memory consumption for indexing layers that have deeply nested Java archives.

  - postgres: remove internal timeouts

  Database queries now take as long as needed to execute. This shouldn't negatively affect any working uses, and should make some slower or less-optimized queries possible on larger instances.

  - integration: make `PGVERSION` a pattern

  The behavior of the setup of an embedded PostgreSQL in integration tests has changed. The relevant environment variable (`PGVERSION`) is now a pattern instead of a literal version string. Note that a version string would be a patten that matches itself, so that format continues to work. Additionally, the version used is now read from the distributed manifest, rather than hard-coded versions. Other than occasional network calls to fetch this manifest, users shouldn't notice any difference.

  - alpine: add edge support

  Alpine's `edge` version should now be supported for reporting.

  - rpm: support PGP V4 signatures

  Rpm has apparently started using "current"/V4 PGP signatures, which claircore was not handling. This adds support for these signatures.

  - jsonblob: add a disk buffering step

  This improves "offline" operation by eagerly buffering output to disk instead of creating a large in-memory data structure first. This makes the API trickier but given that there's a single (known and intended) user, this should be fine.

  - tarfs: check a potential interger overflow

  This change fixes a potential integer overflow in tar handling code. The possibility of exploiting this is effectively 0, as it would require more bytes to represent a sufficiently large integer than is available in the tar header. See also: https://github.com/quay/claircore/security/code-scanning/5

  - gobin: take into account package replacements

  Previously, there was a bug where package replacements were not considered for go binaries.

  - all: purge `http.DefaultClient` usage

  Some packages with less churn (`photon`, `oracle`, `aws`) were using older ways of getting an `*http.Client` or using `http.DefaultClient`. This change breaks some API in exchange for unifying the `*http.Client` handling. The practical upshot is that it's much easier to control the network contact surface.

  - all: share single FS implementation

  Claircore components that deal with `Layer` objects now share a single backing File and a single `fs.FS` implementation when using the `FS` method. There should be no noticeable changes for users, but out-of-tree implementations may want to move over to using the new FS method. This change should improve memory usage.

  - libindex: move to O_TMPFILE fetcher

  This release uses a new fetcher (the component responsible for pulling layers locally) that makes use of the O_TMPFILE flag to open(2). This ensures that layer files will be cleaned up even in the event of an unclean shutdown, including being sent a KILL signal.

v4.7.3 - 2024-02-26

Admin

• 9517c7be: add a check for compatible migration version See Also: #1915

Chore

• e5a896c9: v4.7.3 changelog bump
• d17ee97b: update claircore to v1.5.25 See Also: #1990, #1957, #1942

Config

• 6ba32131: update minimum TLS version for server See Also: #1945

v4.7.2 — 2023-10-09 feature

v4.7.2 Release

Unreleased

v4.7.2 - 2023-10-09

Claircore

• chore: update claircore to v1.5.19

• crda: remove crda support
  

  The CRDA API has been decommissioned and the functionality has been superseded by OSV support.

• chore: update toolkit to latest version v1.1.1
  

  v1.5.17 (toolkit/v1.1.0) introduced a bug where claircore could not handle empty strings when trying to Scan() a value into a cpe.WFN. toolkit/v1.1.1 mitigates this bug.

Clair

• admin: add pre v4.7.3 admin command to create index
  

  In order to facilitate faster deletes we need to add a migration to add an index in v4.7.3. This change adds an admin command to allow users to "manually" create the index CONCURRENTLY before the migration to avoid any down-time. This is something for users with larger indexer DBs to consider.

• contrib: add grafana dashboards for deletion metrics
  

  This has been a part of the API for some time and is starting to be used extensively.

• docs: add dropins to prose documentation
  

  This change explains how to use the dropins and updates the local-dev config to do so.

v4.7.1 — 2023-08-10 feature

v4.7.1 Release

Unreleased

v4.7.1 - 2023-08-10

Build(Deps)

• bd4bdbf6: bump github.com/pyroscope-io/godeltaprof

Chore

• 25ab0f4e: bump claircore to v1.5.15
• 4bf37a11: bump claircore to v1.5.14

v4.7.0 — 2023-07-27 feature

v4.7.0 Release

Unreleased

v4.7.0 - 2023-07-27

Auto

• 1e574c25: enable mutex, blocking profiles by default

Build(Deps)

• adee21df: bump golang.org/x/net from 0.11.0 to 0.12.0
• 32c9ae2e: bump github.com/klauspost/compress from 1.16.6 to 1.16.7

Chore

• 1bfbfa1b: bump claircore to v1.5.13
• 31cf5570: Bump claircore to v1.5.12
• 2d2d16a1: Bump claircore to v1.5.11
• 048ad2f1: Bump claircore to v1.5.10
• 5550b27a: bump Claircore to v1.5.9
• 7df2b863: add pyroscope to compose setup
• c28648e5: Update outdated docs and comment with default update period.
• a02a0f2f: remove refs to deprecated io/ioutil
• 44638edf: Remove dogstatsd variable and references

Clairctl

• bccabff1: Add post 4.7 admin command to delete pyupio vulns
• d2b3d826: Scan the pointer to the pointer of the bool
• 05bd8fa0: Add log line signifying admin is done
• c636e207: Remove DSN logging
• 89cae779: admin subcommand

Cmd

• 8231b438: version for old gits
• #882### Config
• 83ee24af: pick a real versioning scheme

Contrib

• 70d878eb: Add manifest for a Job to run DB jobs

Docs

• 394efe15: Fix up debug tools table
• a4ec17f6: Add description of debugging services available during local-dev

Httptransport

• 86f7a86a: add request ID to profiler labels

Introspection

• caba76e1: add delta pprof endpoints

v4.7.0-rc.1 — 2023-06-26 feature

v4.7.0-rc.1 Release

Unreleased

v4.7.0-rc.1 - 2023-06-26

Airgap

• 94757c7d: Remove libindex Airgap option

All

• 5d30ed66: update to new config module

Build(Deps)

• 00a4279d: bump github.com/prometheus/client_golang
• f4f22e33: bump golang.org/x/net from 0.10.0 to 0.11.0
• 36a7c88c: bump github.com/klauspost/compress from 1.16.5 to 1.16.6
• 17cdc922: bump peter-evans/create-pull-request from 5.0.1 to 5.0.2
• b95be229: bump github.com/streadway/amqp from 1.0.0 to 1.1.0
• 45f808da: bump github.com/urfave/cli/v2 from 2.25.5 to 2.25.7
• b75a00c3: bump github.com/urfave/cli/v2 from 2.25.3 to 2.25.5
• 22a75603: bump github.com/google/go-containerregistry
• 300b1374: bump go.opentelemetry.io/otel/exporters/jaeger
• b2d7a091: bump github.com/urfave/cli/v2 from 2.3.0 to 2.25.3
• a21fb21d: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• b188cba7: bump github.com/quay/claircore from 1.5.2 to 1.5.3
• eb9d1225: bump golang.org/x/sync from 0.1.0 to 0.2.0
• f35c832f: bump golang.org/x/net from 0.9.0 to 0.10.0
• 3dbbaf7b: bump github.com/rs/zerolog from 1.29.0 to 1.29.1
• 1ee7cb8a: bump go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace
• dcb7a05a: bump go.opentelemetry.io/otel/exporters/jaeger
• fca257d7: bump go.opentelemetry.io/otel/exporters/stdout/stdouttrace
• 933cc5c7: bump github.com/ugorji/go/codec from 1.2.9 to 1.2.11
• 4f39b319: bump github.com/klauspost/compress from 1.16.4 to 1.16.5
• 3643f9d2: bump go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp
• c13eaecc: bump go.opentelemetry.io/otel/trace from 1.11.0 to 1.15.1
• 43e3daea: bump github.com/jackc/pgx/v4 from 4.18.0 to 4.18.1
• 2180bc40: bump gopkg.in/square/go-jose.v2 from 2.5.1 to 2.6.0
• f669244a: bump peter-evans/create-pull-request from 5.0.0 to 5.0.1
• 74bc404f: bump peter-evans/create-pull-request from 4.2.4 to 5.0.0
• 912c6e47: bump actions/stale from 7 to 8
• ddec3b43: bump peter-evans/create-pull-request from 4.2.3 to 4.2.4
• f35a3611: bump actions/setup-go from 3 to 4
• d3655eef: bump golang.org/x/net from 0.5.0 to 0.7.0
• 854a2fbf: bump docker/build-push-action from 3 to 4

Chore

• 9d58dba8: v4.7.0-rc.1 changelog bump
• 31823df2: bump Claircore to v1.5.8
• 836c0579: bump Claircore to v1.5.7
• e688e88b: bump Claircore to v1.5.6
• 3d61485d: bump Claircore to v1.5.5
• ddc4cc24: bump Claircore to v1.5.4
• 76686650: Add the osv updater to the local-dev config
• 56e63e8b: Update opentelemetry to v1.16.0
• 5df81b19: bump Claircore to v1.5.2
• cc0d9df4: bump Claircore to v1.5.1
• 35971dc9: produce nightly for ppc64le
• 471da4ee: Only ask dependabot to care about direct dependencies
• 62119209: updated nightly for s390x support
• 57774bd9: added s390x support
• 248a4733: move emulator tests to a nightly run
• bd0488ee: add gomod ecosystems to dependabot
• 8174e950: Remove 1.19
• efe27892: Bump Claircore to v1.4.22
• 1b857d13: Update go version in go.mod
• 5faf0fc9: Bump Claircore to v1.4.21
• a433c93c: Bump Claircore to v1.4.20
• d565775c: Add back GIT_HASH as needed for image name
• 12f38e45: Update go-image version in docker-compose manifest
• 02f311d5: Use our dedicated metric for the go version
• 896b2dfb: Update go version in Dockerfile
• d10c06e0: Bump claircore to v1.4.18

Cicd

• 58c26f4a: don't checkout source on clairctl builds
• 2eb10895: use common workflow in main module CI
• 83d9b2f5: use common workflow in config module CI
• e2f264f4: fix nightly connection strings
• 1ea95d83: rename yamllint config
• 7e2ae8fc: fix nightly-ci error
• 1267335e: use rabbitmq as STOMP broker in nightly CI
• 2edb4915: use rabbitmq as STOMP broker in tests
• 74c34c0c: update nightly job to work
• 30a98697: update go versions

Clair

• 5226d2a3: use new cmd.LoadConfig

Clairctl

• 06f5bc05: use new cmd.LoadConfig

Cmd

• 3ff924ad: implement modular configs
• d3e88775: better version information

Config

• cee776b3: add newtype for Durations
• 1ebbbf24: add some omitempty tags
• 3b6047ca: update module to remove x/sys dependency

Contrib

• bb3a4be5: Better versioning when building the service image
• 8566c525: Add a dashboard panel to surface running versions

Docker-Compose

• bb777399: use rabbitmq instead of activemq

Dockerfile

• 497ab2d2: remove init process

Docs

• 45e6f5c0: update old go get command
• d2d9f385: fix host flag order
• #1754- d726e157: remove reference to "filters"
• #1690### Go.Mod
• 670376a2: update json (de)serializer

Httptransport

• 72417962: debug log calls to apiError
• 378a4b5f: fix request_id logging

Httputil

• b18f989c: fix ParseIP usage
• #1689### Notifier
• 5446e49f: Avoid double reference

Stomp

• 5b876935: override default behavior for "host" header
• 643bd1c9: rework tests
• f84e3491: plumb Context into Dialer
• 7d476ebd: remove apparent ActiveMQ-ism
• aa441b3c: switch to module release for stomp client
• #1739### Updater
• 95970e28: Extend default updater time to 6 hours

v4.6.1 — 2023-04-13 feature

v4.6.1 Release

Unreleased

v4.6.1 - 2023-04-13

Airgap

• e02aba27: Remove libindex Airgap option

Chore

• 36990912: v4.6.1 changelog bump
• e676671c: Bump Claircore to v1.4.21

Go.Mod

• 36de97cc: update json (de)serializer

Httptransport

• 922f33d1: fix request_id logging

Httputil

• 9e8eacf5: fix ParseIP usage
• #1689### Notifier
• ffa4556d: Avoid double reference

v4.6.0 — 2023-01-20 feature

v4.6.0 Release

Unreleased

v4.6.0 - 2023-01-20

All

• 577a55d4: use httputil to construct requests

Auto

• 1f1010fe: add automatic memory limit discovery

Build(Deps)

• ef896eb6: bump actions/stale from 6 to 7
• 5a212ffe: bump peter-evans/create-pull-request from 4.1.4 to 4.2.3
• b883bc2b: bump gsactions/commit-message-checker from 1 to 2

Chore

• 5fd26563: v4.6.0 changelog bump
• 33f4fcbd: Bump claircore to v1.4.17
• 54d44908: Bump Claircore to v1.4.16
• 430e6087: Bump Claircore to v1.4.15
• 652d8ce6: Bump Claircore to v1.4.14
• 9f6828cd: Update to Go 1.18 for local-dev
• 1c002bcd: added ppc64le support
• 4b37dcdf: Bump Claircore to v1.4.13
• 9b273420: Bump claircore to v1.4.12

Cicd

• 1dfb42a0: use extracted git archive
• aff17a4a: update usage of set-output
• a8a97f80: update cache action
• 7de63a9c: add tests for odd architectures
• e923360c: omit Dockerfile build args
• 14b8f690: enable go1.19
• 5a8128c1: inject version into built clairctl binaries
• #1649### Clairctl
• a367a7ae: use a better user-agent
• 3b9ff6de: update with new signer

Client

• ddea858f: Add the passed host to the signer
• adbaa567: use signer
• d8ad1ba4: update for httputil changes

Cmd

• 8b899803: use git-archive for version information

Documentation

• 9d1a7aab: fix typo in link

Httptransport

• 25ac033f: use new signer scheme in test
• a9228d40: add a request_id to logs
• #1547### Httputil
• e746ff05: rework request signing and request restriction

Service

• e08f3972: add signer option

Webhook

• d99f7005: add explicit signer argument

v4.5.1 — 2022-11-22 feature

v4.5.1 Release

Unreleased

v4.5.1 - 2022-11-09

Chore

• 0a0aa1cc: Bump claircore to v1.4.12
• #1646

v4.5.0 — 2022-11-04 feature

v4.5.0 Release

Unreleased

v4.5.0 - 2022-11-03

Build(Deps)

• df77d75a: bump peter-evans/create-pull-request from 4.1.3 to 4.1.4

Chore

• e0aec666: Remove windows 386 as a binary target for releases
• 0772b85f: v4.5.0 changelog bump
• 070a611a: Bump Claircore to v1.4.11
• 5ff4805a: Bump Claircore to v1.4.10
• 08ad0697: Bump Claircore to v1.4.9
• 731c16f7: bump Claircore to v1.4.8

Clairctl

• e431960e: Add delete command
• 66325b12: don't use internal client

Cmd

• 9b0f1a96: unify version information

v4.5.0-rc.0 — 2022-10-10 bugfix

v4.5.0-rc.0 Release

Unreleased

v4.5.0-rc.0 - 2022-10-10

All

• 1a1d5662: remove Quay keyserver support

Build(Deps)

• 224d0698: bump actions/stale from 5 to 6
• 180b887c: bump peter-evans/create-pull-request from 4.1.2 to 4.1.3
• 0537bbc0: bump peter-evans/create-pull-request from 4.1.1 to 4.1.2
• 47a9c1cb: bump peter-evans/create-pull-request from 4.0.4 to 4.1.1
• 3cad3319: bump peter-evans/create-pull-request from 4.0.3 to 4.0.4
• c5975257: bump peter-evans/create-pull-request from 4.0.2 to 4.0.3
• 57dc2378: bump docker/setup-qemu-action from 1 to 2
• c4e2031b: bump docker/login-action from 1 to 2
• a9823a91: bump docker/setup-buildx-action from 1 to 2
• 7c8bafbe: bump docker/build-push-action from 2 to 3
• 4408b1bb: bump actions/download-artifact from 2 to 3
• 4c91a714: bump actions/setup-go from 2 to 3
• 64389db0: bump actions/upload-artifact from 2 to 3
• 1db22a62: bump peter-evans/create-pull-request from 4.0.1 to 4.0.2
• c0953e6f: bump actions/stale from 4 to 5
• 53e944f9: bump peter-evans/create-pull-request from 3.14.0 to 4.0.1
• c76efaee: bump actions/cache from 2 to 3

CRDA

• 4bb2d332: replace API key request form URL

Chore

• 4d4c425b: Bump claircore to v1.4.4

Chore

• aae2d839: v4.5.0-rc.0 changelog bump
• 95073d0b: Bump claircore to v1.4.7
• 415b2a17: Add back Publish Binaries to upload clairctl versions
• c9041efa: bump Claircore to v1.4.6
• 039d2073: bump Claircore to v1.4.5
• 4e44f7ef: bump claircore v1.4.2 -> v1.4.3
• e2b8e101: Bump claircore v1.4.1 -> 1.4.2
• 3273a969: bump claircore to v1.3.2

Ci

• 45443c8e: fix prerelease conditional
• eea6fea1: fix config tidy check
• 4180d787: update workflows and machinery for go1.18

Clair

• b8882f9d: better argument error messages
• #1605### Clairctl
• f0d6a357: fix error reporting for streaming responses

Config

• 677a3137: Don't use flag default combo
• f0e077e0: add "omitempty" tags everywhere
• f1bb53ea: implement TextMarshaler for LogLevel
• 6a99b61a: add top-level docs

Contrib

• 9612ee67: remove rpmscanner files on startup
• a6609638: First wipe anything that might be left before starting clair indexers
• 6a6fd901: fix DB connection charts
• 6b60eef6: Only count index report creation latency for successful requests
• 17862ae3: Add DB connections to Grafana dashboard
• 37ca1ab0: Add dedicated serviceAccount
• 1d89c032: Wipe all the temporary files in the process of being fetched
• 187764a3: Wipe all the contents of /tmp on container start
• ae7675af: Use the readyz endpoint in startup probes
• Fixes #1488### Docker-Compose
• dfd68db8: remove -mod=vendor flag

Dockerfile

• e689241b: strip binaries to reduce size
• 2af2a7f6: fix build with newer ubi8/ubi-minimal image
• f2e209c6: update for 1.18, add trimpath

Docs

• 369319cd: note tested docker-compose version

Documentation

• 9258a313: add config reference cross-checking
• 9a74ac8f: add notes on metrics
• d09b3192: add link checker

Go.Mod

• d583395e: update claircore version
• 12b676d4: patch update dependencies
• e1833161: update claircore version
• 65dcc39c: update minimum go version

Httptransport

• f34148ad: update discovery endpoint
• 88149118: use less-verbose instrumentation construction
• 51119521: update notification endpoints
• #1523- fa49078d: fix test log panic
• 19fa0aa8: Refactor Matcher to align with indexer
• ce462ea4: handle no notifier in "combo" mode

Indexer

• 8e5d76d3: Return 4XX status code when Index() returns tarfs.ErrBadFormat

Introspection

• f4db2610: allow custom health function

Logging

• 5c5a1ab4: log when request is rate-limited

Matcher

• e5cb6a91: Update matcher client to match server definition

Metrics

• e1664659: Spread clair_http_indexerv1_request_duration buckets

Prometheus

• b6ce5043: rework indexer buckets

Services

• 668f443f: update initialization

Webhook

• 472e70b6: clone headers on request

v4.4.4 — 2022-06-09 feature

v4.4.4 Release

Unreleased

v4.4.4 - 2022-06-09

Chore

• 48a3a4ee: v4.4.4 changelog bump
• 6b1f27ed: Bump claircore v1.4.1 -> 1.4.2

v4.4.3 — 2022-06-06 feature

v4.4.3 Release

Unreleased

v4.4.3 - 2022-06-06

Chore

• 3682f31e: v4.4.3 changelog bump

Go.Mod

• 51c63e32: update claircore version
• #1580### Webhook
• edc65d66: clone headers on request
• #1557

v4.4.2 — 2022-05-26 feature

v4.4.2 Release

Unreleased

v4.4.2 - 2022-05-26

Chore

• 2a4694bf: v4.4.2 changelog bump

Go.Mod

• 67f32bff: update claircore version
• #1571

v4.4.1 — 2022-04-04 feature

v4.4.1 Release

Unreleased

v4.4.1 - 2022-04-04

Chore

• 363dca4d: v4.4.1 changelog bump
• cc5a916e: bump claircore to v1.3.2
• #1537### Httptransport
• d314e412: handle no notifier in "combo" mode
• #1531

v4.4.0 — 2022-03-16 feature

v4.4.0 Release

Unreleased

v4.4.0 - 2022-03-16

Chore

• c7075aa4: v4.4.0 changelog bump

v4.4.0-rc.7 — 2022-03-14 feature

v4.4.0-rc.7 Release

Unreleased

v4.4.0-rc.7 - 2022-03-14

Chore

• 94fdf1f8: v4.4.0-rc.7 changelog bump

Ci

• 87a2421f: use runner context object

v4.4.0-rc.6 — 2022-03-14 feature

v4.4.0-rc.6 Release

Unreleased

v4.4.0-rc.6 - 2022-03-14

Build(Deps)

• 323e83ce: bump actions/checkout from 2 to 3

Chore

• 0ea0e9d5: v4.4.0-rc.6 changelog bump

Ci

• d4983fdb: fix extract step

Httptransport

• 5caad7fc: remove unused AffectedManifest handler

v4.4.0-rc.5 — 2022-03-03 feature

v4.4.0-rc.5 Release

Unreleased

v4.4.0-rc.5 - 2022-03-03

Chore

• 8d2d1593: v4.4.0-rc.5 changelog bump

Ci

• 58c761e3: update nightly version description
• bbdd9252: fix tar prefix

v4.3.6 — 2022-01-14 feature

v4.3.6 Release

Unreleased

v4.3.6 - 2022-01-14

Chore

• 84801fa: v4.3.6 changelog bump

Go.Mod

• 8562653: update claircore

Webhook

• ca28de4: clone headers out of Config struct

v4.3.5 — 2021-11-19 feature

v4.3.5 Release

Unreleased

v4.3.5 - 2021-11-19

Chore

• 844bfd2: v4.3.5 changelog bump
• bef331e: Revert "chore: v3.4.5 changelog bump"
• c01d88c: v3.4.5 changelog bump
• 8849c61: update claircore version
• #1437

v4.3.4 — 2021-11-05 feature

v4.3.4 Release

Unreleased

v4.3.4 - 2021-11-05

Chore

• dddb910: v4.3.4 changelog bump
• 41d2593: update changelog to cope with submodule tags
• #1421

v4.3.2 — 2021-10-29 feature

v4.3.2 Release

Unreleased

v4.3.2 - 2021-10-29

Chore

• bfd9718: v4.3.2 changelog bump

Go.Mod

• f8dff8b: update go-containerregistry
• #1407

v4.3.0 — 2021-10-01 feature

v4.3.0 Release

Unreleased

v4.3.0 - 2021-10-01

Chore

• ce63ff2: v4.3.0 changelog bump

Contrib

• 2cee4e1: update secrets path

Dockerfile

• 5493bbc: remove dumb-init, tar

v4.3.0-rc.0 — 2021-09-28 security

v4.3.0-rc.0 Release

Unreleased

v4.3.0-rc.0 - 2021-09-28

Chore

• b5ea27b: v4.3.0-rc.0 changelog bump
• d65432d: update claircore version
• 5ab6c76: automation around v2 issues
• b53aeb7: update claircore version
• f06b041: update go version

Cicd

• 7f19200: create expiring, dated image
• 673ab1e: update go version
• ace31fe: re-vendor after modifying the module
• 411facf: use push flag with build
• 7d29f69: add "nightly" workflow
• e36bc82: add script to edit module for nightly

Clairctl

• 66a3137: update to new API

Config

• b4ec7aa: add CacheAge field

Contrib

• 7308254: stop unneeded vendoring
• 87f8f6c: update saas file

Documentation

• 28b78c5: fix typo

Httptransport

• 22a2548: add Cache-Control header to VulnerabilityReport response
• 1d6ce96: documentation updates
• f7fdc90: fix auth test logging

Matcher

• b3c3e38: default garbage collection on

Notifier

• 0f6d0e4: move to ctxlock

Shutdown

• 6b7029d: introduce the new NotifyContext

v4.2.3 — 2021-09-28 feature

v4.2.3 Release

Unreleased

v4.2.3 - 2021-09-28

Chore

• 8bc69b0: v4.2.3 changelog bump
• 7ee97e5: bump claircore version

v4.1.6 — 2021-09-28 feature

v4.1.6 Release

Unreleased

v4.1.6 - 2021-09-28

Chore

• 018a2db: v4.1.6 changelog bump
• 63b5b3d: bump claircore version

v4.2.2 — 2021-08-17 feature

v4.2.2 Release

Unreleased

v4.2.2 - 2021-08-17

Chore

• 3762d9c: v4.2.2 changelog bump
• 90f2909: bump claircore version

Generated at 2026-07-10 22:23 UTC