DockSec v2026.7.3 released
By SecBurg
UPDATE
v2026.7.3 is out:
## What's Changed
* Fix: AI-only analysis now writes a report instead of pointing to nonexistent files by @advaitpatel in https://github.com/OWASP/DockSec/pull/134
* Fix LLM-init crash, modernize HTML report, and expand comparison table by @advaitpatel in https://github.com/OWASP/DockSec/pull/137
* Add SBOM export, offline mode, install-skill, and fix-command output by @advaitpatel in https://github.com/OWASP/DockSec/pull/138
**Full Changelog**: https://github.com/OWASP/DockSec/compare/v2026.7.2...v2026.7.3
Full release notes: github.com/OWASP/DockSec/releases/tag/v2026.7.3
UPDATE
v2026.7.2 is out, a quick follow-up fix release:
## What's Changed
* Add contributor-focused GitHub workflows by @advaitpatel in https://github.com/OWASP/DockSec/pull/127
* Fix cache severity bug, AI exit code, HTML crash, and score weighting gaps (2026.7.2) by @advaitpatel in https://github.com/OWASP/DockSec/pull/128
**Full Changelog**: https://github.com/OWASP/DockSec/compare/v2026.7.1...v2026.7.2
Full release notes: github.com/OWASP/DockSec/releases/tag/v2026.7.2
DockSec is an OWASP Lab Project that bridges the gap between complex Docker security scan results and actionable fixes.
It combines industry-standard scanners (Trivy, Hadolint, Docker Scout) with multi-LLM support (OpenAI, Anthropic Claude, Google Gemini, or local Ollama) to deliver plain-English vulnerability explanations and line-specific Dockerfile remediation guidance.
v2026.7.1 is out:
- Pin GitHub workflow dependencies
- Phase 0 cleanup: quieter terminal output, PDF encoding fix, and dead-code removal
- Phase 1: terminal output overhaul - result summary, severity table, --quiet/--no-color
- Phase 2a: add --severity flag for image vulnerability scan scope
- Phase 2b: add --fail-on gate and CI-friendly 0/1/2/3 exit codes
- Phase 2c: add --format and --output-dir flags for report selection
- Phase 2d: add --json flag for machine-readable stdout output
- Phase 2e: add --sarif output and fix broken GitHub Action -o flag
- Phase 3: add --baseline/--update-baseline ratchet mode
- Route docker_scanner error/troubleshooting output through docksec.output
- Version bump to 2026.7.1
This is a big one for CI/CD integration: –fail-on gives you a proper severity gate with CI-friendly exit codes, –sarif output plugs straight into GitHub code scanning, and the new –baseline/–update-baseline ratchet mode lets you lock in current findings and only fail on new ones - handy for gradually hardening an existing Dockerfile fleet without breaking the build on day one.
Full release notes: github.com/OWASP/DockSec/releases/tag/v2026.7.1
Happy hacking! :-)