Repository navigation
Group transitive advisory aliases in vg scan --vulns JSON - #468
Draft
vibgrate-team wants to merge 1 commit into
Draft
vibgrate-team wants to merge 1 commit into
vibgrate-team wants to merge 1 commit into
Conversation
Collapse CVE, GHSA, and OSV ids that alias each other on one package, including through a third id, into one vg scan --vulns JSON finding. The primary id is the lowest CVE in the group when one is present, otherwise the lowest id by code-unit order, so a linking record that arrives last does not change the finding. SARIF still emits one result per advisory id. Fixes #302 Signed-off-by: Cursor Agent <cursoragent@cursor.com> Co-authored-by: vibgrate-team <vibgrate-team@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
vg scan --vulnsJSON now collapses advisories on the same package that alias each other, including a chain through a third id, into one finding. The primary id is the lowestCVE-id in the group when one is present, otherwise the lowest id by code-unit order.aliaseslists the remaining ids, sorted the same way. A linking record that arrives last does not change the group. An advisory that no other advisory on that package links to keeps its own id. The offline--package-manifestpath is covered.SARIF still writes one result per advisory id.
extended.vulnerabilitiesstill lists each source advisory.Related issues
Fixes #302
Checklist
pnpm testpassespnpm lintis cleanpnpm typecheckis cleangraph.json/ report output (content-hashed IDs, stable sorts; no time, randomness, or filesystem-order dependence)git commit -s, DCO)Notes for reviewers
JSON findings, the text report, and
.vibgrate/scan_result.jsonuse the grouped finding. Severity and the other record fields come from the advisory whose id is the primary when that record is present, otherwise from the lowest id. Fixing versions are the union of the group.