jaskaransinghdr6j comments

Results 11 comments of


                                            jaskaransinghdr6j

Adding a "component" / "service" data structure below products

+1, we face the same issue and currently have to flatten our application/service hierarchy for this and use Custom Fields and tags to point them to actual repositories. If implemented,...

Segmentation fault on parse error

Any update on this? This is blocking a lot of downstream automation.

False positive CVE-2015-5237 for protobuf-go

is there any update on this. This is still being flagged widely by grype.

False positive CVE-2015-5237 for protobuf-go

How can we disable CPE matching right now?

False positive CVE-2015-5237 for protobuf-go

Thanks, this works! Worried if this will result in False negatives though.

"Error while running rules: 0 bytes read on a total of 2 expected bytes" in Dockerfiles without trailing newlines

Is there any update on this? It's affecting our CI pipeline. Any workaround which does not involve modifying the Dockerfile itself?

grype feature parity with osv.dev

Is there any progress on slotting osv.dev integration? I find many Golang false negatives that could have been caught by an osv data feed.

Add support for SARIF output

Hey guys, any update on SARIF support?

Add support for SARIF output

+1 SARIF should ideally represent each "finding" as it's own line item. Being an interchange format, it would be right to use it as a 1 CVE per item template.

Add support for SARIF output

This is great! However, I feel as many findings aggregators will be using these findings to autofill fields like "Finding Title", the joined ruleId might be a bit too onerous....