Anchore Enterprise Release Notes - Version 6.1.0

Anchore Enterprise v6.1.0

Enterprise Service

Anchore Enterprise v6.1.0 is the first v6 release that supports migrating an existing Anchore Enterprise v5.x deployment. The v6.0.x releases supported new (greenfield) deployments only.

v5.x Upgrade Announcements

Anchore Enterprise v6.0.0 release notes carried the bulk of the v6 deprecations and removals, including the legacy Applications and Source APIs, the legacy webhooks subsystem, the OpenStack Swift object store driver, the experimental Imported SBOM APIs, the default CPE matching configuration, owned-package filtering, and several UI views. If you are migrating from v5.x, review the Announcements, Deprecations, and Removals sections of the v6.0.0 release notes alongside this page — you are crossing every v6 release, not only this one.

User passwords are always stored hashed. Anchore Enterprise v6 stores user passwords as hashes, and this is no longer configurable. Any credential still held as plaintext is hashed in place during the database upgrade. This needs no action from you and changes nothing about how users sign in — existing passwords keep working exactly as they did before, and your credential data is simply stored more securely.

Requirements

• Anchore Enterprise v6.x requires PostgreSQL 17 or greater with the pg_cron extension installed and accessible by Anchore Enterprise. Pre-flight checks verify at startup that the database version and required extensions are working correctly, and the deployment will fail to start if these requirements are not met.
• SBOM ingestion in v6.x drives larger parallel query plans against PostgreSQL, which use dynamic shared memory (/dev/shm on Linux). Docker’s default tmpfs of 64 MiB is insufficient for typical SBOM workloads. Operators running PostgreSQL on Kubernetes or self-managed hosts should size /dev/shm to at least 1 GiB - see Shared Memory for full guidance. Managed databases (Amazon RDS, Aurora) are unaffected.

New Features

At-Rest Encryption for Sensitive DB Columns

Anchore Enterprise now provides the ability to encrypt sensitive data within the database at rest with AES-256-GCM, using a keyring supplied by the operator via the existing config file.

Encryption is off by default and is opt-in. A deployment that configures no key stores these columns as plaintext, just as earlier releases did, and starts with no additional configuration — so upgrading requires no decision about encryption. Enabling it is a matter of supplying a key, at upgrade time or whenever you are ready afterwards. Anchore recommends enabling it.

The keyring is a list of one or two secret keys defined in the config file. Once a deployment has encrypted data, it will no longer start without its keyring: that protects you from a missing key variable silently downgrading the deployment to plaintext and leaving the existing encrypted rows unreadable.

See Encrypting Database Secrets at Rest for the full guide covering key minting, deployment shapes (Docker Compose, Kubernetes, AWS Secrets Manager), the rotation procedure, and the disaster-recovery workflow.

Note that on upgrade from an existing deployment, configuring a keyring does not by itself encrypt data that is already stored — the service encrypts rows as they are written, so any rows that are never updated would otherwise remain in plaintext. To encrypt all existing plaintext in place, run anchore-enterprise-manager db encryption rotate. See Encrypting Existing Plaintext for the full procedure.

New and Updated Policy Packs

Three additional compliance policy packs are now bundled with Anchore Enterprise v6.0+: Australian Signals Directorate (ASD8), PCI-DSS, and CMMC. The existing bundled policy packs have also been refreshed from their latest upstream definitions.

Quick Vulnerability Search

A new quick vulnerability search lets you look up a vulnerability by its ID and see which packages and App Version assets it affects, without first drilling into a specific App Version.

Improvements

• Policy re-evaluation is now automatically fanned out to all affected App Versions when a policy changes, so compliance results stay current without manual intervention.
• Documents produced by asynchronous jobs (such as exports) can now be downloaded directly from the job.
• Support bundles now capture database diagnostics to speed up troubleshooting.
• Per-service resource limits are now configurable.
• Runtime entitlements are now respected and enforced by Anchore Enterprise.
• Policy findings can now be sorted by rule name.
• License corrections now accept a free-text comment field on create, update, and retrieval.
• The license content API (GET /images/{digest}/content/licenses) now returns additional fields.
• The SUID or GUID set files policy gate/trigger now supports uid and gid parameters.
• The vulnerability.vulnerability_data_unavailable policy trigger now recognizes Hummingbird as a supported distribution.
• SBOM Asset import now supports CycloneDX 1.7 documents in addition to the previously supported formats.
• SPDX SBOM scans now handle RPM modularity consistently at the SBOM boundary, avoiding under- or over-reporting of modular RPM packages.
• The configured tmp_dir is now used by all subprocessing and temporary files.
• Garbage collection has been improved for deleted objects, jobs, and the component catalog, and the component catalog no longer refreshes from the database when nothing has changed.
• Legacy imported SBOMs and groups are migrated on upgrade — only the most recent revision of each imported SBOM is migrated, and the legacy Imported-SBOM lifecycle policy rules have been removed.
• anchore-enterprise-manager gains a command to monitor the Legacy Imported SBOM migration to v6.1.
• Anchore Enterprise Cloud Image now has feature parity with Anchore Enterprise.
• The read-only vulnerability API surfaces now expose a CVSS-band severity (v2_severity, v3_severity, v4_severity) on each per-source CVSS assessment, each derived independently from that version’s own CVSS score.

Fixes

• Fixes an issue where imported images could fail smoke-test validation.
• Fixes an issue where a failure inside a stored procedure emitted a multi-line “transaction aborted” error cascade because diagnostics ran inside the already-failed transaction.
• Fixes an issue where concurrent job completions could deadlock the component-catalog job framework while updating worker-pool memory usage.
• Fixes an issue where service workers did not pick up a changed log level without a restart.
• Fixes an issue where vulnerability metadata updates did not trigger policy re-evaluation.
• Fixes an issue where policy vulnerability details omitted the package namespace.
• Fixes an issue where CycloneDX SBOMs imported from Syft exports did not capture additional CPEs.
• Fixes a policy-evaluation concurrency issue by serializing evaluations on the affected resource.
• Fixes an issue where the new APIs returned HTTP 400 instead of 422 for invalid parameters.
• Fixes an issue where a per-service ssl_enable setting did not enable the TLS listener because the setting was read inconsistently across the service and its registration.
• Fixes an issue where a policy change during an asset add could cause the job to fail.
• Fixes an issue where the experimental /v2_exp routes were still exposed through the API service.
• Fixes an issue where account garbage collection raised an exception in the component catalog.
• Fixes an issue where a foreign-key violation during asset add surfaced as an opaque database error instead of a specific, actionable error code.
• Fixes an issue where a policy-evaluation job raised a generic error when its parent App was deleted mid-flight; it now returns a typed job error code.
• Fixes an issue where an imported-image manifest could be overwritten by a concurrent centralized image add that shared the same object-store slot.
• Fixes an issue where an import operation could remain stuck in processing indefinitely when the analyzer failed during analysis setup.
• Fixes an issue where a new-generation import-image-analysis job could hang for an extended period when the analyzer failed quickly.
• Fixes an issue where SPDX tag-value SBOMs with large file counts were extremely slow to analyze.
• Fixes an issue where SSL could not be disabled once it had been enabled.
• Fixes several validation and error-handling issues in the public Assets CRUD API.
• Fixes an issue where the App Version vulnerabilities API did not include the Anchore Score.
• Fixes an issue where indirect matches against Debian linux-kbuild packages produced a large number of false-positive kernel vulnerabilities; these indirect matches are now excluded by default.

Recommended Component Versions

Anchore Helm Chart can be found at https://github.com/anchore/anchore-charts

Syft Release Notes can be found at https://github.com/anchore/syft/releases/tag/v1.46.0

Grype Release Notes can be found at https://github.com/anchore/grype/releases/tag/v0.115.0