Clair

<a name="unreleased"></a>

[Unreleased]

<a name="v4.9.0"></a>

[v4.9.0] - 2025-12-10

Claircore

• enrichment: don't consider vulnerability.Description for enrichments

<details>

Descriptions can often refer to different CVEs or multiple CVEs to the

actual CVE that is associated to the vulnerability leading to erroneous scores.

We should only consider the Name and Links fields.

</details>

• postgres: better GetEnrichments query

<details>

The new query is in "normal" JOIN-and-WHERE form and does not use

the latest_update_operations view. In testing, this was much quicker

to execute.

</details>

• rpm: fix use of unique.Handle pinning fs.FS

<details>

Previous code wouldn't allow memory resources to be reclaimed and could

lead to excessive memory consumption by the indexer in v1.5.40.

</details>

• vex: account for new VEX RPM module logic

<details>

The Red Hat security data team are updating how modules are represented

in VEX files, this change accounts for that update. Specifically, module

relationships are no longer formally expressed through VEX

relationships but rather as PURL qualifiers.

</details>

• cvss: switch to NVD 2.0 JSON feeds

<details>

NVD deprecated their 1.1 JSON feed which claircore relied on for CVSS

enrichment data. This change updates the CVSS enricher updater to use

the 2.0 feeds.

</details>

• chore: upgrade from pgx v4 to v5

<details>

In July 2025 v4 will reach end of life. This change updates claircore to use v5.

</details>

• vex: allow timeout to pull down VEX archive to be configurable

<details>

As part of the RHEL VEX update process claircore will initially pull down an

archive of all CVEs, this archive includes all CVEs not just the ones

that affect Red Hat products. This means the file (while compressed)

will be quite large. The code previously allowed a timeout of 2 minutes

to pull down this file. This value remains the default but users have the

option to configure it to a different value using

updaters.config.rhel-vex.compressed_file_timeout.

</details>

• rpm: add function to determine if packages are installed from RPMs

<details>

This change allows language detectors to be able to discard packages

that have been determined to have come from an RPM package. This ensures

that only the RPM package is matched to advisories and reduces

false-positives where language packages are patched but their metadata

is not updated (or cannot be updated).

</details>

• sbom: add encoder to encode index reports as SPDX documents

<details>

This change adds the ability in claircore to convert an index report

into an SPDX-2.3 document.

</details>

• rhel: deprecate updater in favor of VEX updater

<details>

We can extract vulnerability information about containers from the

VEX data. This negates the need to look for it in the cvemap.xml file.

This change modifies the VEX updater to allow for ingesting

vulnerabilities in a way that can be matched my the RHCC matcher.

</details>

• suse: dynamic distribution discovery

<details>

Previously Suse distributions were static/predefined in the code, the

lack of updates to those definitions had allowed the Suse support lapse.

This change adds dynamic support for two Suse distro flavors:

suse.linux.enterprise.server and opensuse.leap.

</details>

All

• 1aca06b8: fix formatted print calls

Amqp

• 1a9f8769: add deprecation notice

Build(Deps)

• e4feca46: bump golang.org/x/time from 0.7.0 to 0.8.0
• f54011b5: bump golang.o

Clair

Docker Repository on Quay

PkgGoDev

IRC Channel

Note: The main branch may be in an unstable or even broken state during development.

Please use [releases] instead of the main branch in order to get stable binaries.

Clair Logo

Clair is an open source project for the [static analysis] of vulnerabilities in

application containers (currently including [OCI] and [docker]).

Clients use the Clair API to index their container images and can then match it against known vulnerabilities.

Our goal is to enable a more transparent view of the security of container-based infrastructure.

Thus, the project was named Clair after the French term which translates to clear, bright, transparent.

[The book] contains all the documentation on Clair's architecture and operation.

[OCI]: https://github.com/opencontainers/image-spec/blob/master/spec.md

[docker]: https://github.com/docker/docker/blob/master/image/spec/v1.2.md

[releases]: https://github.com/quay/clair/releases

[static analysis]: https://en.wikipedia.org/wiki/Static_program_analysis

[The book]: https://quay.github.io/clair/

Community

• Mailing List: clair-dev@googlegroups.com
• IRC: #clair on freenode.org
• Bugs: issues

Contributing

See CONTRIBUTING for details on submitting patches and the contribution workflow.

License

Clair is under the Apache 2.0 license. See the LICENSE file for details.