DEV Community

Cover image for šŸ’‰ Grype 0.35.0 new feature : Indicate location of vulnerability
adriens for opt-nc

Posted on • Updated on

šŸ’‰ Grype 0.35.0 new feature : Indicate location of vulnerability

šŸ‘ Celebrating Issue #561

Previously when we were running grype on an image, we were could get vulnerabilities

... but not we could be easily aware of where they were coming from.

In other words its "type" (deb, java,... ) :

Image description

See previous demo for more about the previously available datas for vulnerabilities :

šŸ–• The new feature

Fortunately, the following issue has been shipped in the latest v0.35.0 grype release :

Indicate location of vulnerability #561

What would you like to be added: Add library location and software dependancy on scan output.

Why is this needed: The grype output only indicate the library/package. However it doesn't give a reference to where its hosted and which software might have installed it. This info is needed for vulnerability mitigation.

Additional context:

To get it :

brew install grype
Enter fullscreen mode Exit fullscreen mode

, to upgrade it :

brew upgrade grype
Enter fullscreen mode Exit fullscreen mode

šŸŽžļø Demo

Now let's see what it does look now :

ā¬…ļø Shift Left considerations

Since now, programmers can easily be aware of any security flaw during development pahse itself, on their workstation.

Top comments (0)