--- title: "May 2025 FOSSA Product Updates" description: "Learn about several recent FOSSA product updates, including container scanning and CycloneDX report improvements." canonical_url: "https://fossa.com/blog/may-2025-product-updates/" markdown_url: "https://fossa.com/blog/may-2025-product-updates.md" content_type: "blog" language: "en" date_published: "2025-05-05" date_modified: "2022-05-05" author: "Ryan Link" organization: "FOSSA" --- # May 2025 FOSSA Product Updates > Learn about several recent FOSSA product updates, including container scanning and CycloneDX report improvements. In recent weeks, we’ve shipped impactful updates across the FOSSA platform, enhancing vulnerability visibility, container analysis, and standards compliance. Here’s a look at what’s new. --- ## 🎯 CycloneDX Report Filtering: Focus Your View You can now filter CycloneDX reports to include only the vulnerabilities that matter for your workflow: * **Open Vulnerabilities**: Only includes those that have **not** been ignored * **Closed Vulnerabilities**: Only includes those that **have** been ignored This gives security and compliance teams better control over how vulnerability data is shared and consumed in downstream tools. --- ## 🧪 Validate Your SBOMs with Confidence We launched our [SBOM Validator](https://fossa.com/resources/devops-tools/ntia-sbom-validator/), a free tool to help you validate [CycloneDX SBOMs](https://fossa.com/learn/cyclonedx.md) against NTIA guidelines. The tool will also help you fill in gaps if it identifiees any missing elements. Whether you’re preparing for U.S. Executive Order compliance or aligning with industry standards, this tool ensures your SBOMs are complete, correct, and ready for audit. --- ## 🐳 Major Improvements to Container Scanning FOSSA CLI’s container scanning just got a major overhaul: * **Compatibility with modern Docker**: Exported containers from recent Docker versions are now supported * **Better support for OCI registries** * **Seamless integration with Docker’s native authentication providers** * **Improved reliability across authentication flows** * **Fallback support**: If something goes wrong, the older container scanning logic is still there as a backup Behind the scenes, FOSSA now uses a dedicated helper binary to pull images — this is bundled with the CLI, so there’s no additional setup required. --- ## ⚠️ The CVE Program Scare — And Our Take Last month, uncertainty around funding for the CVE Program sent ripples through the security community. CISA later confirmed that funding will continue — but the episode raised valid concerns, and the program's long-term future is still unclear. Here’s how FOSSA is prepared; we also encourage you to check out our CEO [Kevin Wang's LinkedIn post](https://www.linkedin.com/posts/kevinxizhao_its-been-a-chaotic-last-24-hours-as-weve-activity-7318438664450035714-fWKk?utm_source=share&utm_medium=member_desktop&rcm=ACoAAAbpHzQB6Y4APgOUqe9irczDINw1HmcJU3w) on the matter. * **Resilience by design**: We maintain a proprietary vulnerability database, continuously updated from multiple sources — not just the NVD. * **Adaptable infrastructure**: Our ingest pipeline is built to accommodate changes in source systems. * **Community support**: We’re actively tracking and supporting parallel efforts like the CVE Foundation and EUVD. No matter how the landscape evolves, we’re committed to helping teams maintain a strong vulnerability management posture. --- ## 🚀 Don’t Miss These: BCA & Package Labels In case you missed it: In April, we released several major products and product updates that may be of interest: * [**Binary Composition Analysis**](https://fossa.com/blog/introducing-fossa-binary-composition-analysis-bca.md) (BCA): Scan compiled binaries to uncover hidden security and license compliance risks * [**Package Labels**](https://fossa.com/blog/annotate-dependencies-context-introducing-package-labels.md): Tag, group, and manage packages by usage, risk, or any other dimension --- For a full list of product updates, you can reference our [Core Release Notes](https://support.fossa.com/fossa/article/ART-118-core-release-notes) and the [FOSSA CLI Changelog](https://github.com/fossas/fossa-cli/blob/master/Changelog.md). And, of course, feel free to contact your customer success representative with any questions or for more information on any of these features. ## Related resources - [Analyzing 5 Major OSS License Compliance Lawsuits](https://fossa.com/blog/analyzing-5-major-oss-license-compliance-lawsuits.md): Learn about five lawsuits that have helped shape global enforcement of open source software licenses. - [Annotate Dependencies with Context: Introducing Package Labels in FOSSA](https://fossa.com/blog/annotate-dependencies-context-introducing-package-labels.md): Introducing FOSSA Package Labels - a powerful way to annotate packages with contextual metadata, enabling more efficient and insightful reporting and filtering. - [License Compliance, SBOM, and Vulnerability Management for Smaller Teams: FOSSA Business Tier](https://fossa.com/blog/fossa-business-tier.md): FOSSA introduces a new business tier tailored for smaller teams, offering flexible pricing and comprehensive features for SBOM, vulnerability management, and license compliance. - [Fall 2024 Software Licensing Roundup](https://fossa.com/blog/fall-2024-software-licensing-roundup.md): Explore the significant licensing stories of fall 2024, including Elastics return to open source, the new fair source licensing model, and the PearAI controversy. - [Snippet Scanning, Explained](https://fossa.com/blog/snippet-scanning-explained.md): An in-depth look at snippet scanning tools, their methodologies, and their impact on open source license compliance. ## Source Canonical page: https://fossa.com/blog/may-2025-product-updates/