grype zarf scan target scans Zarf package archives

Introduced 2026-06-05 · score 0.97

HOW TO USE IT

When scanning a Zarf package archive, run Grype with the `zarf:` target and JSON output to produce a vulnerability report. The documented example uses a `.tar.zst` archive.

WHY THIS HELPS

Scan a Zarf package archive and review vulnerabilities across its bundled artifacts.

REQUIREMENTS AND LIMITATIONS

• Version: v0.114.0
• zarf:<path> (required): Zarf package archive target; the documented archive format is `.tar.zst`.
• -o, --output: Select report output format; `json` is shown for this scan.
• Prerequisite: Use Grype v0.114.0 or later for the Zarf scan target.
• The described archive format is .tar.zst.

FIRST-PARTY EVIDENCE

• https://github.com/anchore/grype/releases/tag/v0.114.0
• https://github.com/anchore/grype/pull/3366
• https://github.com/anchore/grype/issues/3329
• https://github.com/anchore/grype/blob/v0.114.0/cmd/grype/cli/commands/root.go

Check the installed version and the source before using it. Entry JSON

Report a problem with this card