Version history

Version 3.12.0, released 2026-01-13

New features

A new message File is added
A new field files is added to message .grafeas.v1.DiscoveryOccurrence
A new field return_partial_success is added to message .grafeas.v1.ListOccurrencesRequest
A new field unreachable is added to message .grafeas.v1.ListOccurrencesResponse
A new field return_partial_success is added to message .grafeas.v1.ListNotesRequest
A new field unreachable is added to message .grafeas.v1.ListNotesResponse
A new message Risk is added
A new message CISAKnownExploitedVulnerabilities is added
A new message ExploitPredictionScoringSystem is added
A new field data is added to message .grafeas.v1.SecretOccurrence
A new field digest is added to message .grafeas.v1.SecretOccurrence
A new value SECRET_KIND_GCP_API_KEY is added to enum SecretKind
A new value SECRET_KIND_GCP_OAUTH2_CLIENT_CREDENTIALS is added to enum SecretKind
A new value SECRET_KIND_GCP_OAUTH2_ACCESS_TOKEN is added to enum SecretKind
A new value SECRET_KIND_ANTHROPIC_ADMIN_API_KEY is added to enum SecretKind
A new value SECRET_KIND_ANTHROPIC_API_KEY is added to enum SecretKind
A new value SECRET_KIND_AZURE_ACCESS_TOKEN is added to enum SecretKind
A new value SECRET_KIND_AZURE_IDENTITY_TOKEN is added to enum SecretKind
A new value SECRET_KIND_DOCKER_HUB_PERSONAL_ACCESS_TOKEN is added to enum SecretKind
A new value SECRET_KIND_GITHUB_APP_REFRESH_TOKEN is added to enum SecretKind
A new value SECRET_KIND_GITHUB_APP_SERVER_TO_SERVER_TOKEN is added to enum SecretKind
A new value SECRET_KIND_GITHUB_APP_USER_TO_SERVER_TOKEN is added to enum SecretKind
A new value SECRET_KIND_GITHUB_CLASSIC_PERSONAL_ACCESS_TOKEN is added to enum SecretKind
A new value SECRET_KIND_GITHUB_FINE_GRAINED_PERSONAL_ACCESS_TOKEN is added to enum SecretKind
A new value SECRET_KIND_GITHUB_OAUTH_TOKEN is added to enum SecretKind
A new value SECRET_KIND_HUGGINGFACE_API_KEY is added to enum SecretKind
A new value SECRET_KIND_OPENAI_API_KEY is added to enum SecretKind
A new value SECRET_KIND_PERPLEXITY_API_KEY is added to enum SecretKind
A new value SECRET_KIND_STRIPE_SECRET_KEY is added to enum SecretKind
A new value SECRET_KIND_STRIPE_RESTRICTED_KEY is added to enum SecretKind
A new value SECRET_KIND_STRIPE_WEBHOOK_SECRET is added to enum SecretKind
A new field risk is added to message .grafeas.v1.VulnerabilityOccurrence

Documentation improvements

A comment for enum value SECRET_KIND_GCP_SERVICE_ACCOUNT_KEY in enum SecretKind is changed

Version 3.11.0, released 2025-11-05

New features

Update dependencies

Version 3.10.0, released 2025-05-08

Same code as 3.9.0, just a re-release to fix process issues.

Version 3.9.0, released 2025-05-06

Note: this release failed due to release process changes; we will release a 3.10.0 shortly.

New features

Support for Secrets
Support for Layer Details

Version 3.8.0, released 2025-04-03

New features

Allow Grafeas.V1 to use the default endpoint (commit 567992c)

Version 3.7.0, released 2024-11-18

New features

A new field version is added to message .grafeas.v1.ComplianceOccurrence (commit 5f100b4)
A new message VulnerabilityAttestation is added (commit 5f100b4)
A new field vulnerability_attestation is added to message .grafeas.v1.DiscoveryOccurrence (commit 5f100b4)
Add IServiceCollection extension methods for client registration where an IServiceProvider is required. (commit 022fab2)

Version 3.6.0, released 2024-03-28

Bug fixes

Set the transport of grafeas back to grpc only (commit 0b69ee2)

New features

Change netstandard2.1 target to netstandard2.0 (commit 82bea85)
A new field in_toto_slsa_provenance_v1 is added to message BuildOccurrence (commit 416cfff)
A new value SBOM_REFERENCE is added to enum NoteKind (commit 416cfff)
A new field impact is added to message ComplianceNote (commit 416cfff)
A new message SBOMStatus is added (commit 416cfff)
A new field sbom_status is added to message DiscoveryOccurrence (commit 416cfff)
A new field sbom_reference is added to message Occurrence (commit 416cfff)
A new field sbom_reference is added to message Note (commit 416cfff)
A new message InTotoSlsaProvenanceV1 is added (commit 416cfff)
A new message SBOMReferenceNote is added (commit 416cfff)
A new message SBOMReferenceOccurrence is added (commit 416cfff)
A new message SbomReferenceIntotoPayload is added (commit 416cfff)
A new message SbomReferenceIntotoPredicate is added (commit 416cfff)
A new field vulnerability_id is added to message VulnerabilityAssessmentNote (commit 416cfff)
A new field vulnerability_id is added to message VulnerabilityOccurrence (commit 416cfff)
A new field extra_details is added to message VulnerabilityOccurrence (commit 416cfff)

Documentation improvements

A comment for field cve in message VulnerabilityAssessmentNote is changed (commit 416cfff)
A comment for field cve in message VulnerabilityOccurrence is changed (commit 416cfff)

Version 3.5.0, released 2024-03-05

New features

Add session and session_template controllers (commit 14d4f40)

Version 3.4.0, released 2023-05-03

New features

Add enum for grafeas v1 cvss to support both cvss v2 and v3 (commit f493b96)

Version 3.3.0, released 2023-03-20

New features

Add VULNERABILITY_ASSESSMENT Note type to grafeas v1 API, adds Vex_Assessment derived from the Note to resources' occurrences, VEX notes now be written to add CVE assessments (commit 3375552)

Version 3.2.0, released 2023-03-06

New features

Import of Grafeas from Github (commit 6328e98)

Version 3.1.0, released 2023-02-08

New features

Make GrafeasClient simpler to work with (commit a589ac8)
Add new analysis status and cvss version fields (commit 14cf35b)

Version 3.0.0, released 2022-06-09

This is the first version of this package to depend on GAX v4.

There are some breaking changes, both in GAX v4 and in the generated code. The changes that aren't specific to any given API are described in the Google Cloud documentation. We don't anticipate any changes to most customer code, but please file a GitHub issue if you run into problems.

The most important change in this release is the use of the Grpc.Net.Client package for gRPC communication, instead of Grpc.Core. When using .NET Core 3.1 or .NET 5.0+ this should lead to a smaller installation footprint and greater compatibility (e.g. with Apple M1 chips). Any significant change in a core component comes with the risk of incompatibility, however - so again, please let us know if you encounter any issues.

API-specific new features

Import of Grafeas from Github (commit bf347e1)

Version 2.4.0, released 2022-01-18

Bug fixes

Modify the bazel.BUILD file by hand to include the compliance protos which are not autogenerated (commit 6c8513c)
Add java_outer_classname to intoto protos to fix java client generation issues due to name collisions (commit e9595c3)

New features

Updating the grafeas protos to include compliance and intoto attestation protos (commit 06c7007)

Version 2.3.0, released 2021-09-20

Commit ac367e2: feat: Regenerate all APIs to support self-signed JWTs

Version 2.2.0, released 2021-05-25

No API surface changes; just dependency updates.

Version 2.1.0, released 2020-11-12

Commit 0790924: fix: Add gRPC compatibility constructors
Commit 0ca05f5: chore: Regenerate all APIs using protoc 3.13 and Grpc.Tools 2.31
Commit 6bde7a3: docs: Regenerate all APIs with service comments in client documentation
Commit f83bdf1: fix: Apply timeouts to RPCs without retry
Commit 947a573: docs: Regenerate all clients with more explicit documentation

Version 2.0.0, released 2020-03-19

No API surface changes compared with 2.0.0-beta01, just dependency and implementation changes.

Version 2.0.0-beta01, released 2020-02-19

This is the first prerelease targeting GAX v3. Please see the breaking changes guide for details of changes to both GAX and code generation.

Version 1.0.0, released 2019-12-10

Initial GA release.