---
schema_version: 1
route: /t/grype.md
tool: "grype"
---

# sincecutoff.com /t/grype — Grype

- name: Grype
- kind: cli
- children: none
- homepage: <https://github.com/anchore/grype>

Changes to the tools coding agents drive, since a model's training cutoff, each linked to its first-party source. Check installed versions and limitations before acting; a cutoff date does not establish what a model knows.
Original editorial content: [Apache 2.0](https://sincecutoff.com/v1/data-license.txt), by [0xPatrick](https://0xpatrick.dev). Preserve applicable license and [NOTICE](https://sincecutoff.com/notice.txt) attribution when redistributing. Third-party source text and examples retain their own rights. [License scope and attribution](https://sincecutoff.com/v1/license.json).
To stay current, read the changes feed: [`/v1/changes.md?tool=grype`](https://sincecutoff.com/v1/changes.md?tool=grype) (or `.json`), adding `since=YYYY-MM-DD` for your training cutoff. Entries for registered children are included; the registry itself is `/v1/tools.json`. How to page and save your place: [llms.txt](https://sincecutoff.com/llms.txt).

### grype zarf scan target scans Zarf package archives (2026-06-05)
- slug: grype-zarf-scan-target-scans-zarf-package-archives-c9caf2173ec1
- score: 0.97

How to use it:

When scanning a Zarf package archive, run Grype with the `zarf:` target and JSON output to produce a vulnerability report. The documented example uses a `.tar.zst` archive.

Examples:

```
grype zarf:<path/to/package.tar.zst> -o json
```

- why_it_matters: Scan a Zarf package archive and review vulnerabilities across its bundled artifacts.
- sources: <https://github.com/anchore/grype/releases/tag/v0.114.0>, <https://github.com/anchore/grype/pull/3366>, <https://github.com/anchore/grype/issues/3329>, <https://github.com/anchore/grype/blob/v0.114.0/cmd/grype/cli/commands/root.go>
- gotchas: "Version: v0.114.0"; "zarf:<path> (required): Zarf package archive target; the documented archive format is `.tar.zst`."; "-o, --output: Select report output format; `json` is shown for this scan."; "Prerequisite: Use Grype v0.114.0 or later for the Zarf scan target."; "The described archive format is .tar.zst."

### grype db diff compares Grype v6 databases by package impact (2026-04-09)
- slug: grype-db-diff-compares-grype-v6-databases-by-package-impact-0d87062ecb4a
- score: 0.97

How to use it:

When you need to identify package matching changes between two Grype v6 databases, run `grype db diff <old_db_url_or_path> <new_db_url_or_path>`; it reports packages with added, removed, and modified vulnerability matches.

Examples:

```
grype db diff <old_db_url_or_path> <new_db_url_or_path>
```

- why_it_matters: Compare two Grype v6 databases to identify vulnerability data changes that affect package matching.
- sources: <https://github.com/anchore/grype/releases/tag/v0.111.0>, <https://github.com/anchore/grype/pull/3277>, <https://raw.githubusercontent.com/anchore/grype/v0.111.0/cmd/grype/cli/commands/db_diff.go>, <https://raw.githubusercontent.com/anchore/grype/v0.111.0/grype/db/v6/diff/db_resolver.go>
- gotchas: "Version: v0.111.0"; "old_db_url_or_path (required): First database: HTTP(S) URL, directory containing `vulnerability.db`, `.db` file path, or supported DB archive path."; "new_db_url_or_path (required): Second database; same supported URL or path forms as the first database."; "--output, -o: Output format; available formats are `text` and `json`."; "Prerequisite: Use Grype v0.111.0 or later with Grype v6 databases."; "The command compares Grype v6 databases."; "Docs conflict: The v0.111.0 source command syntax permits one or two positional database arguments, while the release note describes comparing two databases. The usage here follows the card's two-database task."

### grype library vulnerability matching supports context cancellation (2026-02-03)
- slug: grype-library-vulnerability-matching-supports-context-cancellation-1749b943d706
- score: 0.90

How to use it:

When integrating Grype’s Go library and matching may need to stop early, call `FindMatchesContext` with a `context.Context`; it checks cancellation before each matcher call and returns on a context error.

Examples:

```
ctx := context.Background() // replace with the workflow's cancellable context
remainingMatches, ignoredMatches, err := vulnMatcher.FindMatchesContext(ctx, pkgs, pkgContext)
```

- why_it_matters: Stop long-running vulnerability matching early when integrating Grype into a Go coding workflow.
- before: Call `FindMatches(pkgs, pkgContext)`; it uses `context.Background()` and does not support context cancellation.
- sources: <https://github.com/anchore/grype/releases/tag/v0.107.1>, <https://github.com/anchore/grype/pull/3200>, <https://raw.githubusercontent.com/anchore/grype/v0.107.1/grype/vulnerability_matcher.go>
- gotchas: "Version: v0.107.1"; "ctx (required): `context.Context`; checked for errors before each matcher call for a package. A non-nil error returns immediately."; "pkgs (required): Packages to match."; "pkgContext (required): Package context used for matching and subsequent VEX matching."

### grype adds a Hex matcher for Erlang and Elixir packages (2026-01-29)
- slug: grype-adds-a-hex-matcher-for-erlang-and-elixir-packages-b0c8b5cd02cc
- score: 0.91

How to use it:

When scanning an image with Erlang or Elixir packages, run Grype to use its Hex matcher for GHSA data. To enable CPE matching for this ecosystem, set `match.hex.using-cpes` to `true`; it is `false` by default.

Examples:

```
grype <image>
```

```
match:
  hex:
    using-cpes: true
```

- why_it_matters: Scan an image containing Erlang or Elixir packages for vulnerabilities.
- before: CPE matching was enabled by default for this ecosystem.
- sources: <https://github.com/anchore/grype/releases/tag/v0.107.0>, <https://github.com/anchore/grype/pull/3194>, <https://github.com/anchore/grype/blob/v0.107.0/README.md>, <https://github.com/anchore/grype/blob/v0.107.0/cmd/grype/cli/options/match.go>
- gotchas: "Version: v0.107.0"; "<image> (required): Image reference to scan."; "match.hex.using-cpes: Boolean that enables CPE matching for the Hex matcher; defaults to `false`."; "Prerequisite: Grype must be installed; the README documents installation using `curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin`."; "CPE matching for this ecosystem is turned off by default."