Grype scans container images, directories, and Software Bills of
Materials (SBOMs) for known vulnerabilities.

Requires google-go-lang (Go 1.26.8+) to build offline with the supplied
vendor archive. Go, Syft, Docker, and Podman are not required at runtime
for directory/SBOM scans. Linux container-storage support is included,
except the Btrfs storage driver, matching upstream's Linux builds. This
does not restrict ordinary directory scans on Btrfs filesystems.

Run as your normal user. Grype downloads a vulnerability database and
checks for application updates by default. No database is packaged.

  grype dir:/path/to/project
  grype sbom:/path/to/sbom.json

For offline scans, prepare the database with "grype db update" or
"grype db import FILE", then set GRYPE_DB_AUTO_UPDATE=false and
GRYPE_CHECK_FOR_APP_UPDATE=false. Stale databases may be rejected.
App checks contact toolbox-data.anchore.io; image pulls need registry
access. Do not assume Slackware system-package vulnerability coverage.

Documentation:
https://oss.anchore.com/docs/guides/vulnerability/getting-started/