-
I am using Java duo-universal-sdk v1.1.3 and getting vulnerabilities reported from dependencies.
Vulnerabilities I get reported in IntelliJ, and with syft/grype are:
com.fasterxml.jackson.core:…
-
**What would you like to be added**:
When a Grype config is found in the repository and in the home directory I would like them to be merged
**Why is this needed**:
I would like to exclude f…
-
There are community provided vulnerability advisories published here (UI) https://bodhi.fedoraproject.org/updates/?type=security , ideally to support matching fedora based images/systems in grype.
…
-
**What would you like to be added**:
The SLES provider should be enhanced to pull in the OVAL data stating that a package is affected but not fixed
**Why is this needed**:
This would allow ma…
-
I know there is the `severity-cutoff: ` option for making the GHA workflow fail if vulnerabilities of a `` and above are found.
Is there a way however to configure the action to also only report vu…
-
-
_As these are implemented, please edit this field to include the PR that implements it within the wishlist below:_
- [x] ~Consider switching json column processing to bson or another format that is…
-
**What happened**:
grype generates different output content for the same image, which breaks the reproducibility.
Motivation comes from the https://github.com/in-toto/attestation/issues/58 to pu…
-
### Describe what should be investigated or refactored
Please look at the list of CVEs below and identify how we can resolve them.
### Additional context
```
➜ uds-cli git:(main) grype .
…
-
**What would you like to be added**:
The name of the file that grype ingested, is stored in a *variable* JSON location. See output from `grype -o json`
**Why is this needed**:
The grype CLI take…