Compatibility Matrix

Ephor components are versioned independently. This matrix documents which versions of each component are compatible with each other.

Version Compatibility

ephor-scanner	ephor-api	ephor-dashboard	Trivy	Notes
0.1.x	0.1.x	0.1.x	0.69.x	Initial release, basic CVE scanning
0.2.x	0.2.x	0.2.x	0.69.x+	Workload context labels, CVSS scores, package classification, enriched payload

Versioning Policy

Each component follows semantic versioning:

• ephor-scanner - the Kubernetes scanner agent
• ephor-api - the backend API for ingestion and serving
• ephor-dashboard - the web UI for viewing and triaging findings
• Trivy - the bundled vulnerability scanner (third-party, pinned per scanner release)

Components evolve at their own pace. A scanner release may include payload changes that require a matching API version. Always consult this matrix when upgrading individual components.

Upgrade Guidelines

• Check this matrix before upgrading any single component
• When the scanner introduces new payload fields, the API must be upgraded first to accept them
• Trivy version is pinned in the scanner Docker image and does not need separate management