-
**What would you like to be added**:
Right now, yardstick can capture the difference between different tool outputs, but it has no notion of a label provider, and tools that compare yardstick resul…
-
**What happened**:
Scan on image that has python3-zipp-0.6.0-150100.3.5.1.noarch installed.
It generates vulnerabilities:
NAME INSTALLED FIXED-IN TY…
-
It would be extremely beneficial if the scanner integration was more easily plumbable. If the output was an SBOM in SPDX or CycloneDX formats anyone could write their own task to implement the scanner…
-
There have been multiple requests for additions related to configuration in the CLI tools, and we should see if there are things that `fangs` can do to help facilitate the asks. Perhaps among other th…
-
**What happened**:
Ran multiple instances of grype CLI and the database ended up invalid, failing the integrity checks.
**What you expected to happen**:
It should be parallel safe.
**How to re…
-
What would you like to be added:
for each CVE provide also the epss score based on this - https://www.first.org/epss/
Why is this needed:
calculate better the risk for each CVE
Additional context:…
-
**What would you like to be added**:
I would like to be able to tell yardstick that the default max year for a given image is later (or earlier) than the default_max_year specified in the top level…
-
**What would you like to be added**:
CISA provided information regarding if vulnerabilities were exploit.
it will be helpful to present or use this kind of information in grype. I saw we already syn…
-
**What would you like to be added**:
The release of a new version of syft should exercise `syft | grype` and, if `grype` fails, warn the team that syft is ahead of grype, in the sense that the late…
-
In the case where both a direct match and indirect match are made for the same package and vulnerability ID, today we have two matches:
```
cat sbom-maven.json | grype -o json | jq '.matches[] | se…