Anchore Enterprise Release Notes - Version 6.3.0

Anchore Enterprise v6.3.0

Enterprise Service

Anchore Enterprise v6.3.0 adds a Packages gate for Application policies, Ubuntu ESM support for image vulnerability scans, package search across every Application Version, notifications when a vulnerability’s severity, score, or KEV status changes, and lifecycle policies for Application Versions. It also improves performance for very large SBOMs and fixes defects that could leave vulnerability results incomplete or out of date.

Requirements

• Anchore Enterprise v6.x requires PostgreSQL 17 or greater with the pg_cron extension installed and accessible by Anchore Enterprise. Pre-flight checks verify at startup that the database version and required extensions are working correctly, and the deployment will fail to start if these requirements are not met.
• SBOM ingestion in v6.x drives larger parallel query plans against PostgreSQL, which use dynamic shared memory (/dev/shm on Linux). Docker’s default tmpfs of 64 MiB is insufficient for typical SBOM workloads. Operators running PostgreSQL on Kubernetes or self-managed hosts should size /dev/shm to at least 1 GiB - see Shared Memory for full guidance. Managed databases (Amazon RDS, Aurora) are unaffected.

Announcements

Upgrade Duration

Behavior Changes

• The Application Version policy compliance CSV export adds VEX Status and Anchore Score columns after Fix Version, which moves the Asset ID, Asset Name, Asset Class, and Asset Type columns two places to the right. Scripts that read those columns by position need updating. A new gate request field selects vulnerabilities (the default) or packages for the Packages gate, whose export carries Package Name, Package Version, Package Type, and Package PURL in place of the vulnerability columns. The exported file name now includes the gate name.
• The Application Version vulnerability CSV export (/v2/apps/{app_id}/jobs/export-vulnerabilities) adds Fix State, EPSS Percentile, CVSS Source, and Is Primary columns at the end of each row.

Policy Gates That Require Anchore Enforce

Anchore Enforce is the Anchore Enterprise module for policy-based compliance, and it is enabled by the Module:Enforce entitlement in your license. These policy gates are part of Anchore Enforce:

• Image policies: ancestry, distro, dockerfile, files, image_source_drift, licenses, metadata, packages, passwd_file, retrieved_files, and tag_drift
• Application policies: the new Packages gate

For the license each gate requires, see Gate Licensing.

If your license does not include Anchore Enforce, a rule that uses one of these gates now produces this warning in the policy evaluation results:

The specified gate requires the "Module:Enforce" license entitlement.

In v6.3.0 this is a warning only: the rule is still evaluated and enforced as before. A future release will stop evaluating these rules. If you see this warning, contact Anchore Customer Success about your license.

New Features

Vulnerability Data

Ubuntu Expanded Security Maintenance

Ubuntu images that use Canonical’s Expanded Security Maintenance (ESM) packages are now scanned against ESM fixes, so vulnerabilities Canonical has already fixed for ESM no longer appear as false positives. No configuration is required. Images analyzed before the upgrade pick up ESM results once they are re-analyzed. ESM does not yet apply to Application Version assets. For details, see Ubuntu Expanded Security Maintenance.

VEX Annotation Source

VEX annotations on both images and Application Versions now record where they came from, in a source object, so a reader can tell who made each statement. The type is user for an annotation created in your organization, or external for a statement from an outside vendor, and the name identifies the source.

You can filter annotations by source with the source_type and source_name parameters on:

• GET /v2/images/{image_digest}/vuln-annotations, for images
• GET /v2/apps/{app_id}/versions/{version_id}/vulnerability-annotations, for Application Versions, and with --source-type and --source-name on anchorectl app version vex list

Image Tag Vulnerable From Date

The Tags by Vulnerability report gains an Image Tag Vulnerable From column (imageTagVulnerableFrom): the earliest date a vulnerability was detected on a tag, across every image the tag has pointed to. Previously each new image pushed to a tag restarted the clock, so a long-standing vulnerability could look days old. The new vulnerableForAtLeastDays and vulnerableForAtMostDays filters select vulnerabilities by how long they have been present.

Application Versions

Packages Gate

Application policies can now make rules about the packages an Application Version contains, not only its vulnerabilities. The Packages gate’s match trigger flags every package that matches a given name, version, or type - for example, any log4j-core at version 2.*, or a package below a minimum version. Versions are compared using each ecosystem’s own version rules. Package findings are listed at /v2/apps/{app_id}/versions/{version_id}/policy/findings/packages and exported through the compliance CSV export (see Behavior Changes).

Quick Package Search

You can now find every Application Version that contains a package in one search, by package name, name@version, or PURL. This helps when a new vulnerability is announced before it reaches a vulnerability feed. The search is available from the UI command palette and through the experimental GET /exp/quick-search/packages-lookup and GET /exp/quick-search/apps-by-package APIs.

Notifications for Vulnerability Metadata Changes

A new user.application_version.vulnerabilities_updated event is raised when a feed update changes a vulnerability already present in an Application Version: its severity or CVSS score changes, its EPSS score moves to a different band, or it is added to or removed from the CISA Known Exploited Vulnerabilities (KEV) catalog. Each event lists up to 50 changes. End-of-life Application Versions do not raise it. See Notifications.

Artifact Lifecycle Policies for Application Versions

Artifact lifecycle policies can now delete Application Versions that have been end-of-life (EOL) for a given number of days, together with their assets. Rules are managed through the API and AnchoreCTL; UI support is planned for a later release. Image lifecycle rules no longer delete an image that an Application Version asset still uses. Read Artifact Lifecycle Policies before enabling a rule: versions that are already past the threshold are deleted on the first run.

Export Application Versions Affected by a Vulnerability

A new CSV export lists every Application Version affected by a vulnerability, with the vulnerability’s severity, CVSS, EPSS, and KEV details and each application’s version, status, release date, and contact information. Start it with POST /v2/jobs/export-apps-by-vulnerability, or use AnchoreCTL.

AI Model Packages

AI models cataloged from GGUF files, supported for images since v6.2.0, now also appear in Application Version package listings, vulnerability scans, and exports.

Organization Name

Accounts and Applications can now carry an Organization Name. Anchore Enterprise uses it as the author of generated SBOM, VEX, and VDR documents, and as the source name of the VEX annotations your team records. A system administrator sets it for each account, and existing accounts are given their account name during the upgrade. An Application can set its own, or uses its account’s.

Large SBOM Performance

This release improves memory use and performance across analysis, import, vulnerability scanning, and policy evaluation, particularly for very large SBOMs. SBOMs and analysis bundles larger than 2 GiB can now be imported. To import an SBOM larger than 100 MB, raise max_import_content_size_mb (ANCHORE_MAX_IMPORT_CONTENT_SIZE_MB) above its default of 100 MB.

Improvements

• Centralized image analysis is faster, because it runs on the AnchoreCTL v6.3 analysis engine bundled with the Enterprise image. See the AnchoreCTL v6.3.0 release notes.
• Editing an image allowlist no longer invalidates the policy evaluation cache, so re-evaluating an image after an allowlist change is faster. The API and UI are unchanged.
• The vulnerabilities gate’s annotation_status parameter accepts none, for vulnerabilities with no VEX annotation, and can be combined with the other statuses.
• Operating system information is now imported from CycloneDX SBOMs, so their OS packages can be matched against distribution vulnerability data. Expect higher vulnerability counts for newly imported CycloneDX SBOMs: these are vulnerabilities that were present but could not be matched before.
• GET /v2/images/{image_digest}/content/licenses now returns each package’s CPEs in a cpes field.
• Centrally analyzed images now keep all of their analysis documents with their Application Version asset, not only the SBOM, so the data survives the image’s removal from the image catalog.

Fixes

Security

• Addresses the compromise of the eMudhra intermediate certificate authorities. Anchore Enterprise no longer trusts TLS certificates issued by them: the operating system trust store, certifi (GHSA-6q48-6c7w-9gw2), skopeo, AnchoreCTL, and the vulnerability scanner have all been updated.

Vulnerability Data and Accuracy

• Fixes an issue where a vulnerability feed update could time out on slower deployments, leaving the deployment on stale vulnerability data with no visible error.
• Fixes an issue where vulnerability records could be missing from the database, so affected packages silently received no results for those vulnerabilities.
• Fixes an issue where the policy engine could keep using an incomplete vulnerability database after an interrupted download, so scans came back clean.
• Fixes an issue where the policy engine stopped updating its vulnerability database, until restarted, if the database was removed from disk.
• Fixes an issue where one policy engine worker could delete a vulnerability database that another worker was still scanning against.
• Fixes an issue where a scan could be recorded as run against a newer vulnerability database than the one it used.
• Fixes an issue where an image’s vulnerability reports could stop refreshing after a finding reappeared, for example when an advisory lost and regained its CVE alias, with no error shown.
• Fixes an issue where a scan returned HTTP 500 instead of a report of the problem when no vulnerability match exclusions data was available.
• Fixes an issue where the vulnerability package_path for a Java package nested inside another JAR held only the outer JAR’s path, so results could not be joined to image content by location. The full location, as in v5.x, is restored.
• Fixes an issue where a package correction for a Linux kernel package could not be created, because linux-kernel was rejected as a match type.
• Fixes an issue where listing an Application Version’s vulnerabilities, or the packages affected by a vulnerability, returned HTTP 500 when the results included Go vulnerabilities whose fix version is of kind release. This fix was also delivered in v6.2.2.
• Fixes an issue where a feed update that removed vulnerabilities sent vulnerabilities_updated events to only some of the affected applications.

Analysis and SBOM Reliability

• Fixes an issue where an analysis archive rule could archive, and so remove, an image that an Application Version asset still used.
• Fixes an issue where a worker pool that paused briefly, for example under memory pressure, failed every job queued for it. Those jobs are now returned to the queue.
• Fixes an issue where an image imported from an SBOM with an invalid image digest was accepted, then could not be deleted. The import is now rejected with a clear error.
• Fixes an issue where the first read of a regenerated image SBOM could omit the account’s package corrections, affecting vulnerability scans, SBOM downloads, and exports.
• Fixes an issue where a package correction could cause an image’s content to be rebuilt and stored again on every read.
• Fixes an issue where many simultaneous content requests for the same image could overload the catalog until it failed health checks.
• Fixes an issue where the catalog could stop rebuilding content after a burst of requests, returning HTTP 500 while still reporting itself healthy.
• Fixes an issue where the SBOM of an image analyzed before mid-2023 could not be retrieved, returning HTTP 500.
• Fixes an issue where CycloneDX and SPDX SBOM exports for an Application Version omitted the relationships between packages.
• Fixes an issue where the SPDX SBOM export for an Application Version with several assets repeated each shared package once per asset.
• Fixes an issue where a license override with a non-SPDX license_id, such as public-domain, was exported as an SPDX license expression, which fails SBOM validation. It is now exported as a license name.

Exports and API

• Fixes an issue where GET /v2/apps/{app_id}/versions/{version_id}/vulnerabilities returned duplicate rows when a package was present in more than one asset. Expect fewer rows: the removed rows were duplicates.
• Fixes an issue where the Application Version vulnerabilities API and its CSV export returned different fields. The API now also returns last_found, fix_observed_at, source_url, and reference_urls.
• Fixes an issue where the list of assets containing a package was empty for an OS package whose distribution has no version number, such as Arch Linux.
• Fixes an issue where adding several images at once could fail with HTTP 500 when the account had more than one Amazon ECR registry configured. This fix was also delivered in v6.2.2.

Malware Scanning

• Fixes an issue where the first malware scan after ClamAV was enabled could fail with AN403 while the ClamAV database was still downloading.

Anchore Data Service

• Fixes an issue where every hourly feed sync downloaded the full vulnerability database even when it had not changed. This was fixed in the Anchore Data Service, so it applies to every deployment without an upgrade.

UI Updates

UI Improvements

• Within Applications:
  • Readable column headers on Version Compliance findings - The Policy Findings table on an application version’s Compliance tab no longer squeezes its columns below the width their own headers need, so headers such as Outcome and Affected Assets read in full instead of being truncated to an ellipsis. The table pans horizontally to accommodate them.
  • Return to a recent application version from the side navigation - Hovering the Applications item in the side navigation now offers a link back to the application version you were most recently viewing, returning you to the tab you left. The most recent location is remembered for the current session, and is cleared when you sign out, switch account data context, or delete the application or version it points to.
  • Application Organization Name - Applications now include an Organization Name field that can be set when creating an application and updated afterward. When left blank, the application inherits its account’s organization name. The organization appears alongside the contact details in the contact popup on the applications list and details pages, and the list can now be filtered by organization name.
  • CVSS scores from every source - Hovering a CVSS score now lists every source that scored the vulnerability - NVD, GitHub, CISA and vendor feeds - showing each source’s CVSS v2.0, v3.x and v4.0 severity and score side by side, with a link out to each source. On the Vulnerabilities tab the popup also names the CVE and links to the Anchore Vulnerability Database.
  • Packages Gate in Version Compliance - The Compliance tab of an application version now includes a Packages gate alongside Vulnerabilities, showing the package policy findings for that version with their own filters (package name, version, type, and PURL) and sort order, reflected in the URL for sharing. Its findings can also be exported as CSV, and the compliance export picks up the active gate so exporting Vulnerabilities and Packages produce separate files.
• Within Events & Notifications:
  • Events - Application version vulnerability changes - Events reporting vulnerability metadata changes for an application version now show a distinct resource icon, link directly to that version’s Vulnerabilities tab, and list each changed attribute (severity, CVSS score, EPSS score, KEV status) with its previous and new value in a dialog opened from the event’s details. Each identifier in that dialog links through to the version’s Vulnerabilities tab filtered to it, and the dialog title links to the application and to the version. Where an event carries more changes than it reports, the dialog says how many of the total it is showing.
• Within Image Analysis:
  • Distro-aware extended support indicator - The extended support indicator on the image analysis page now reflects the image’s distribution. Ubuntu images under Expanded Security Maintenance (ESM) show Ubuntu branding and ESM terminology, Red Hat images keep the existing EUS treatment, and any other distribution with extended support data shows a neutral Extended Support label.
• Within Policies:
  • Container Images First in the Policy Editor - The Mappings tab and the artifact type menus for adding rule sets and mappings now list Container Images first, followed by SBOMs and Source Repositories. Mappings opens on Container Images by default.
• Within Quick Search:
  • Quick Package Search - Search for a package by name, name@version, or PURL from the command palette, then open a results page of the application versions associated with it. The list can be filtered and sorted, and each version links through to its Contents tab, narrowed to the matching packages. When the search matches several packages, a breakdown of those packages by ecosystem is shown above the list.
• Within Reporting:
  • Tags by Vulnerability - Image Tag Vulnerable From column - The Tags by Vulnerability report template now includes an Image Tag Vulnerable From column, shown between Inherited From Base and Artifact Name, that reports the earliest date a vulnerability was detected on a tag across every image it has pointed at. The column is included in report previews and CSV/JSON downloads.
• Within User Management:
  • Account Organization Name - Accounts now carry a human-readable organization name used to identify the author of generated SBOM, VEX or VDR documents. System administrators are required to provide it when creating an account and can edit it from the account detail page, and it appears as a column in the accounts list.

UI Fixes

• Vulnerabilities > EPSS - Percentile shown as 0% when unknown - Fixed the EPSS popup claiming a percentile ranking of 0% for a vulnerability that has a score but no percentile. The ranking is now omitted rather than shown as zero, wherever the EPSS badge appears.
• Applications > Recent Activity - Job Details popup overflow - Fixed an issue where long filenames and image references could overrun the edge of the Job Details popup in the My Recent Activity panel, and where the popup for the last jobs in the list could be cut off by the bottom of the window.
• Applications > Vulnerabilities - Severity Filter Label - Renamed the Severity filter on an application version’s Vulnerabilities tab to Derived Severity, matching the column it filters.
• Quick Search > Results - Highlight overridden by the mouse pointer - Fixed an issue where the highlighted row in a Quick Search results list could be taken over by whichever row happened to sit under the mouse pointer, so arrow-key navigation appeared to jump or stall and a new search could open a row other than the one shown as highlighted. The pointer now only moves the highlight when it is the pointer that moved, and never while the keyboard is still stepping through the list.
• Dialogs - Re-opening a dialog served stale content - Fixed a dialog that had been opened more than once showing the first set of content rather than the latest, and needing to be closed once per opening. Re-opening a dialog now replaces the previous one.
• Tables - Edge shading now covers the horizontal scrollbar - Fixed an issue where the shaded edge marking clipped columns in a horizontally scrolling table stopped above the scrollbar, leaving a visible seam at the bottom corner of the table.
• Applications > Version Contents - Empty version label - Fixed an issue where packages cataloged without a version, such as AI models, showed an empty version label beside their name in the Contents tab of an Application Version.
• Quick Search > Results - Highlight lost while holding the arrow keys - Fixed the highlighted row scrolling out of view when holding the up or down arrow through a Quick Search results list, which left the list moving behind the keys with nothing on screen to follow. Stepping a row at a time still slides smoothly, and the movement is skipped altogether for anyone whose system is set to reduce motion.
• Policies > Policy Editor - Missing Artifact Type Icons - Fixed an issue where artifact type icons were missing from the policy editor’s Mappings tabs and from the Add New Rule Set and Add New Mapping menus.
• Filters > Filter Menu - Scroll Position When Adding a Toggle Filter - Fixed an issue where adding a toggle filter such as Has Fix or KEV from the Filter menu on a scrolled list left the view part-way down while the rows underneath it changed. The list now returns to the top, as it already did for other filter types.
• Applications > Contents - PURL Filter Special Characters - Fixed filtering Application Version Contents by PURL to match values containing a plus sign or space, so valid results are no longer silently excluded.
• Various supporting libraries have been updated in order to improve security, performance, and also to remove deprecation warnings from browser and server output logs. Redundant libraries have been removed to reduce the app startup time and overall size.

Recommended Component Versions

Anchore Helm Chart can be found at https://github.com/anchore/anchore-charts

Syft Release Notes can be found at https://github.com/anchore/syft/releases/tag/v1.55.0

Grype Release Notes can be found at https://github.com/anchore/grype/releases/tag/v0.121.0