Anchore Enterprise Release Notes - Version 6.2.0

Anchore Enterprise v6.2.0

Enterprise Service

Anchore Enterprise v6.2.0 concentrates on the accuracy of what you scan and the speed at which you scan it. Go binaries are now matched against the standard library symbols they actually use, which removes a large class of false-positive Go vulnerabilities. AI models packaged into images are cataloged and reportable. VEX assessments recorded against an Application Version now drive that version’s policy result, and a change in that result raises a notification. The vulnerability scanner itself was rebuilt around a concurrent streaming pipeline and is roughly 2.3x faster on a representative workload.

Requirements

• Anchore Enterprise v6.x requires PostgreSQL 17 or greater with the pg_cron extension installed and accessible by Anchore Enterprise. Pre-flight checks verify at startup that the database version and required extensions are working correctly, and the deployment will fail to start if these requirements are not met.
• SBOM ingestion in v6.x drives larger parallel query plans against PostgreSQL, which use dynamic shared memory (/dev/shm on Linux). Docker’s default tmpfs of 64 MiB is insufficient for typical SBOM workloads. Operators running PostgreSQL on Kubernetes or self-managed hosts should size /dev/shm to at least 1 GiB - see Shared Memory for full guidance. Managed databases (Amazon RDS, Aurora) are unaffected.

Announcements

Behavior Changes

Two things to check, and one to expect:

• Go advisories with no CVE alias, or with several. The alias does not resolve for these, so review your allowlisted and annotated Go findings. An advisory with no alias can only be searched by its GO- ID.
• Severity-threshold policy rules. GoVulnDB advisories carry no severity, so some findings now report severity Unknown, and those rules do not fire on them.
• A renamed finding is a new record. On the first recompute each rename appears as a removal plus an addition, so expect a one-time spike in added and removed counts, max_days_since_creation and max_days_since_fix grace periods to restart, and one unusually large webhook payload. Notification volume itself is unchanged.

This applies to /v2/apps/{app_id}/jobs/export-vulnerabilities, /v2/apps/{app_id}/jobs/export-policy-compliance, and /v2/apps/{app_id}/jobs/export-packages. It is not optional and cannot be turned off.

New Features

Go Vulnerability Matching Now Uses the Go Vulnerability Database

Grype’s vulnerability database now carries Go Vulnerability Database (GoVulnDB) data, which changes Go matching in two ways.

Standard-library matching no longer falls back to CPEs. GHSA does not cover the Go standard library, so Grype previously matched stdlib vulnerabilities against NVD by CPE to avoid missing them - which flagged every standard-library CVE for a binary’s toolchain version whether or not the vulnerable code was in the binary. GoVulnDB covers the stdlib as though it were a regular module, so that fallback is off by default and those false positives go away: roughly 17% of Go standard-library findings in Anchore’s testing.

Matching is also symbol-aware for the standard library and golang.org/x modules. GoVulnDB records which symbols an advisory affects, and Syft now captures the symbols a binary actually references, so an advisory whose affected functions are absent from the binary is not reported. A package with no symbol evidence still matches at module level, so an SBOM analyzed before you upgrade keeps its old results until it is re-analyzed. Findings from GitHub Security Advisories are unaffected.

Findings are renamed as part of this - see Behavior Changes above before you upgrade.

Symbol capture adds some size to SBOMs for Go-heavy images. The new golang.capture-symbols setting controls how much: extended-stdlib (the default, covering exactly the advisories that carry symbol data), stdlib, all, or none. Only all increases SBOM size substantially. Anchore Enterprise v6.2.0 ships Syft v1.51.0 and Grype v0.116.1.

AI Model Artifacts in Image Content

Images are now cataloged for AI models in GGUF format, and each model is stored as a package of the new model content type. GET /images/{image_digest}/content/model returns the models found in an image, and model appears in the content-type list and content summary for that image. Because models are ordinary packages, existing policy gates can warn or fail on their presence, which gives security teams a way to see where AI models have entered their environment and to control it. AnchoreCTL surfaces the same content type through anchorectl image content.

Analysis Failure Reasons in API Responses

When image analysis fails, the response now tells you why. Previously a failure surfaced only as analysis_failed, with the actual cause - a registry authentication error, an unreachable host, a malformed image - buried in the events log, so diagnosing a broken CI job meant a second lookup. The reason is now carried through to the API response and printed by AnchoreCTL at the command line. This covers centralized analysis, distributed analysis where the failure occurs on the backend, image asset adds, and one-time scans.

Application Versions Improvements

The changes below all apply to Application Versions.

Faster Vulnerability Scanning

Vulnerability scanning now processes several artifacts at once instead of working through them one at a time, and it no longer repeats identical work across those scans. A single slow package - a Linux kernel package can take minutes - no longer holds up every other scan waiting behind it.

In testing, a representative mixed workload completed roughly 2.3x faster and a kernel-heavy workload roughly 5.8x faster, with peak memory essentially unchanged.

No configuration is required; the improvement applies at the default setting of eight concurrent scans. Deployments with known kernel-heavy workloads can raise that limit for further gains, at roughly triple the memory.

VEX Annotations Influence Policy Evaluation

A VEX assessment now changes an Application Version’s compliance result. When you mark a vulnerability not_affected, affected, fixed, or under_investigation, policy rules can act on that assessment directly. Saving the annotation immediately triggers a fresh evaluation, so the compliance result reflects it the next time you look rather than at the next scheduled evaluation. Previously an assessment could be recorded but had no bearing on policy.

For finer control, the vulnerabilities gate’s package trigger gains two parameters:

• annotation_status - trigger only for vulnerabilities whose VEX status is one of the selected values (not_affected, affected, fixed, under_investigation). A rule can, for example, raise a violation only for vulnerabilities still marked affected or under_investigation, and pass those already assessed as not_affected.
• missing_annotation - trigger only for vulnerabilities that have no VEX assessment yet, so teams can surface un-triaged vulnerabilities that still need review.

Every vulnerability policy finding also shows the scope-resolved VEX status for its vulnerability and package pair, and findings can be filtered by VEX status.

Policy Comparisons for Anchore Score

The Application vulnerability-packages trigger gains anchore_score and anchore_score_comparison parameters, so a policy rule can act on the Anchore Score directly using any of =, !=, <, <=, >, or >=. This lets a policy gate on Anchore’s composite risk score - which folds in severity, KEV listing, EPSS, and CVSS - rather than on severity alone, so rules can target the vulnerabilities most likely to be exploited instead of everything rated high. The Anchore Score is also available for filtering and sorting on /{app_id}/versions/{version_id}/policy/vulnerability-findings-search.

Events and Notifications for Policy Outcome Changes

Anchore Enterprise now raises an event when a policy evaluation outcome changes for an Application Version that is not marked end-of-life - specifically on a change from pass to warn, pass to fail, or warn to fail. The event carries the Application Version name and ID, the previous and current policy status, and a link to that version’s compliance tab, and can be delivered as a notification so it reaches whoever owns remediation for that application. See Notifications for endpoint configuration.

Filter Packages by Vulnerability

The /apps/{app_id}/versions/{version_id}/packages-search API gains two optional filters:

• has_vulnerabilities - return only packages with at least one vulnerability.
• severity - return only packages with at least one vulnerability at one of the given severities.

Both make it possible to go straight from an Application Version’s contents to the packages that actually need remediation, instead of paging through every package it contains.

Asset Data in Compliance, Contents, and Vulnerability Exports

The vulnerability, package, and compliance CSV exports now identify the assets each finding came from, carrying Asset ID, Asset Name, Asset Class, and Asset Type on every row. This closes the gap that made CI pipeline remediation planning difficult: a finding on an Application Version can now be traced back to the specific SBOM or image that introduced it without a second lookup. See Behavior Changes above for the change in export shape.

Improvements

• Distribution data is now imported from SPDX SBOMs, read from the primaryPackagePurpose field where the producing tool sets it and falling back to the package PURLs where it does not. Previously only Syft SBOMs populated distribution information.
• Image analysis is now dispatched as soon as an image add job is created, rather than waiting for the rest of the job queue to drain. Adding a single image behind a large batch of SBOM asset adds no longer waits for that batch to finish.
• The MSRC Windows product ID mapping has been refreshed against the current Microsoft CVRF product tree, adding newly supported Windows and Windows Server product IDs and removing obsolete ones.
• The cvss_assessments array no longer returns two entries for the same source that differ only by a missing score. Same-source assessments that agree on every field they both populate are merged into one entry carrying the union of those values; genuinely conflicting assessments are still returned separately. This affects GET /vulnerabilities, vulnerabilities-search, vulnerability-lookup, packages-by-vulnerability, and policy findings.
• The vendored copy of the archived Yosai security framework has been substantially reduced, cutting both the code footprint and the dependency count carried by the Enterprise image.
• The API generator no longer post-processes const into enum for empty-string literals; the API models now emit the correct OpenAPI shape natively.
• The weekly end-to-end regression suite has been repaired after upstream Syft and licenses API drift, and its content comparisons now tolerate purely additive scanner output so that a newly registered cataloger that finds nothing no longer fails the suite.

Fixes

Analysis and SBOM Reliability

• Fixes an issue where artifact garbage collection could reap in-flight SBOM workflows during sustained bulk ingest.
• Fixes an issue where a race in the image add path could overwrite a just-completed analysis, leaving the image stranded as not_analyzed with a null analyzed_at and never re-queued.
• Fixes an issue where a null analyzed_at raised a type error that dropped the image from ingest with no retry.
• Fixes a further variant of the same stale-read overwrite that stranded images terminally in analyzing with no re-queue.
• Fixes gaps in analysis error codes, including stale skopeo classifier patterns and error codes that were not threaded through the add-time and asset-job paths.

Upgrade and Migration

• Fixes an issue where images analyzed before v5.25.0 could never be added as Application Version assets after upgrading to v6.x - the asset add reported success while the job failed internally.
• Fixes an issue where imported SBOMs that had been added as images on releases through v5.24.x stopped receiving vulnerability scans after upgrading to v6.x.
• Fixes an issue where an SBOM whose v5.x to v6.x migration failed after its document had been transferred could not be retrieved, returning HTTP 410, and had its stored copy garbage-collected.

Vulnerability Data and Accuracy

• Fixes an issue where CycloneDX SBOM scans over-reported modular RPM vulnerabilities because the modularity property that Grype honors was ignored, producing results inconsistent with Grype.
• Fixes an issue where the data syncer skipped the Grype database and waited an hour when the catalog service was not yet available at startup.
• Fixes an issue where the source field was not populated in vendor_data in the image vulnerability list API response.

Application Version Jobs

• Fixes an issue where a stalled vulnerability feed update left behind orphaned job records that survived cleanup and jammed the retry loop permanently, so feed updates never resumed on their own.
• Fixes an issue where creating a work queue took an exclusive lock on the queue tables, blocking other jobs until it completed. Partition-safe creation is now the default.
• Fixes an issue where a work queue could dispatch an entire workflow for every item in the queue, multiplying the work actually performed.

API and Platform

• Fixes an issue where uploading an empty SBOM raised an uncaught HTTP 500.
• Fixes an issue where sorting Application Version contents by PURL returned HTTP 500 for a version containing packages with no PURL.
• Fixes an issue where listing the vulnerabilities of an Application Version returned HTTP 500 when any finding carried a fix version of kind first-observed-record. One such finding failed the whole response, so no vulnerabilities could be listed for that Application Version.
• Fixes an issue where the built-in Swagger UI was not present in v6.x deployments.
• Fixes an issue where the notification service router omitted the account header and fell back to admin when the header was absent, rather than failing fast as the rest of the service does. No cross-account data was exposed.
• Fixes an issue where the Enterprise build manifest omitted next-generation components.

Malware Scanning and Security

• Fixes an issue where the ClamAV signature database was written outside the locations expected to be writable.
• Addresses security findings in ClamAV 1.4.5.

Removals

• The legacy SBOM group event type has been removed. /service/event-types no longer advertises it, and existing events of that type are removed during upgrade. Legacy SBOM groups themselves were removed in v6.0.0; this clears the last surface that still referenced them.

UI Updates

UI Improvements

• Within Applications:
  • The Contents tab of an application version can now be filtered by whether a package has vulnerabilities and by vulnerability severity. Filter and sort selections are reflected in the URL, so a filtered view can be bookmarked and shared.
  • The Compliance tab can now be filtered by Has VEX Annotation and VEX Status, matching the Vulnerabilities tab. Filter and sort selections are reflected in the URL, and updating a VEX annotation refreshes compliance findings automatically.
  • The Policy Rule column on the Compliance tab can now be sorted, and findings can be filtered by policy rule set name.
  • Version tab counts now show a steady placeholder while they load, and a retryable error indicator when a count fails to load, so the tab labels no longer shift as the numbers resolve.
• Within Configuration:
  • Application log output can now be rendered as machine-parseable JSON for ingestion by log aggregation tools, using the new log_format configuration key (environment variable ANCHORE_LOG_FORMAT). The default text format is unchanged.
  • When log_format is set to json, inbound and outbound HTTP request log records carry typed fields - method, URL, numeric status, response time, user, account, and upstream request ID - for querying in log aggregation tools. Sensitive values such as passwords and API keys are redacted from log metadata automatically.
  • The UI service now participates in the platform’s request ID protocol: every request is tagged with an anchore-request-id that is echoed on the response, stamped on the request’s log records, and carried through to the platform services, so a single ID correlates UI and platform logs end to end. JSON log records share the platform’s field and level naming conventions, and uncaught application errors are logged in the configured output format.
• Within Image Analysis:
  • AI models discovered in an image are now listed in the Contents tab. Select the Model content type to view a sortable, paginated table of the models found.
  • The Security Data Export from the vulnerabilities view of image and source analysis now includes the package URL (PURL) for each vulnerable package, in both JSON and CSV formats.
• Within Quick Search:
  • Clicking a row in the Impacted Application Versions table now opens a side panel listing that application version’s affected packages, with their CVSS, EPSS and KEV details, affected assets, VEX status and available fixes. Use the panel’s arrows to step through the impacted versions.
• Tables with many columns can now be scrolled horizontally instead of clipping content, with a scrollbar that stays within reach at the bottom of the screen. Column headers remain visible and aligned while scrolling in both directions.

UI Fixes

• Fixed an issue where moving between pages kept the previous page’s scroll position, so a new page could open part-way down. Pages now open at the top, and going back returns you to where you were.
• Fixed an issue where a table’s loading spinner could be hidden behind the page header while data was loading, making the table appear unresponsive. This was most noticeable on an application version’s Compliance tab with filters applied.
• Fixed an issue where the VEX annotation button in the affected packages panel was disabled with no explanation for users whose role does not permit viewing or editing annotations. It now shows the same reason as the status dropdown beside it.
• Fixed the Events page Event Type filter so the Subcategory and Event dropdowns list every available option while the dropdowns above them are left on the wildcard, and so each dropdown is wide enough to show its selected value in full.
• Fixed an issue where the Policy Editor’s evaluation preview could crash the page when a policy could not be evaluated against the selected image. The preview now shows an error message instead of a blank screen.
• Fixed an issue where a policy loaded with empty (null) mapping or allowlist sections could not be saved, returning an error from the backend.
• Fixed an issue where a newly applied filter was inserted into the middle of the applied filters row. New filters are now added to the end of the row, and that order is preserved when a filtered view is reloaded or shared.
• Fixed an issue where the Filter menu was partially hidden behind applied filter pills.
• Fixed an issue where app tour beacons and popups could appear on top of open modal dialogs, such as the vulnerability Export modal.
• Fixed an issue where the Generate Now, Save as Template, and Copy Template actions for STIG reports and templates could still be triggered while disabled on instances without the STIG feature.
• Fixed an issue where following a Kubernetes inventory link from an image view resulted in a blank page when the reporting service had not yet finished aggregating inventory data. The Kubernetes page now displays its inactive state until the data becomes available.
• Fixed an issue where a failure to retrieve Kubernetes inventory data went unreported when viewing the images of a specific cluster or namespace. The page now displays an error message when inventory data cannot be loaded.
• Fixed an issue where testing a notification endpoint while adding it from the Policy Compliance view cleared the values already entered in the form, such as the webhook URL.
• Fixed an issue where breadcrumb separators were too faint to see clearly in light mode.
• Fixed an issue where following an event link to a report that had since been deleted displayed a 500 service error. A not-found message is now shown instead, with a link back to the Saved Reports list, or to the New Report view when no saved reports remain.
• Fixed an issue where a table’s sticky header, or the page context panel, could pin to the wrong position after the browser window was resized, until the page was reloaded.
• Fixed an issue where switching to a version with no assets via the version dropdown could trigger unnecessary requests for its Contents, Compliance, and Vulnerabilities data before returning to the Summary tab.
• Fixed flickering as a long table scrolled back to the top after a sort or filter change, or when stepping between vulnerability findings, which was most noticeable in Firefox. A long reset now jumps straight to the top rather than animating over a distance too great to follow, and the table dims as soon as the view resets, so the previous ordering no longer flashes up before the new results arrive.
• Fixed an issue where a long application or version name ran past the Version Name column in Quick Search results. The application name and version now truncate separately, so both stay readable and the version is not the part that gets cut.
• Fixed an issue where navigating to a URL belonging to an inaccessible account context kept the full path after redirecting back to the user’s own context, landing on a 404 page. The user is now taken to the top of the corresponding section instead.
• Various supporting libraries have been updated in order to improve security, performance, and also to remove deprecation warnings from browser and server output logs. Redundant libraries have been removed to reduce the app startup time and overall size.

Recommended Component Versions

Anchore Helm Chart can be found at https://github.com/anchore/anchore-charts

Syft Release Notes can be found at https://github.com/anchore/syft/releases/tag/v1.51.0

Grype Release Notes can be found at https://github.com/anchore/grype/releases/tag/v0.117.0