search

nix-community / vulnix

Vulnerability (CVE) scanner for Nix/NixOS.
BSD 3-Clause "New" or "Revised" License
464 stars 35 forks source link

Add `--upgradable` option to Vulnix to show only packages for which an update exists. #82

Open Riscky opened 2 years ago

Riscky commented 2 years ago

arch-audit has an option --upgradable where it doesn't report vulnerabilities where upgrading won't fix it. Something similar would be nice for Vulnix. This would allow users to quickly see actionable upgrades.

To make this work, a user should pass two derivations to Vulnix, one based on the current nixpkgs snapshot and one based on a newer snapshot (nixpkgs-unstable for example). Vulnix should then only report vulnerabilities that appear in the first report but not in the second.

For syntax I would imagine something like vulnix current.drv --upgradable=newer.drv.