Entry documenting Vulnerability tracker Grype - #367
Open
SermishaNarayana wants to merge 13 commits into
Open
Conversation
✅ Deploy Preview for wonderful-mousse-057100 ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
gincrement
reviewed
May 26, 2026
| The `grype` report will list the vulnerabilities found in the scanned directory, along with details such as the package name, version, vulnerability ID, severity level, and a description of the issue. | ||
| The report will also provide recommendations for mitigating the vulnerabilities, such as updating to a newer version of the affected package or applying patches. | ||
|
|
||
| ### Vulnerability id |
gincrement
reviewed
May 26, 2026
|
|
||
| ### Vulnerability id | ||
| The vulnerability ID is a unique identifier assigned to each vulnerability, which can be used to look up more information about the issue and its potential impact. | ||
| For example, the vulnerability ID `CVE-2026-6100` can be looked up in the [National Vulnerability Database](https://nvd.nist.gov/) to find more details about the vulnerability, nature of the issue, including its severity level, affected versions, and recommended mitigation strategies. |
Member
There was a problem hiding this comment.
Also explain what the CVE ID (Common Vulnerabilities and Exposures; https://www.cve.org/) is.
Member
Author
There was a problem hiding this comment.
Thanks @gincrement for reviewing the PR. Have updated the PR regarding the IDs
SermishaNarayana
marked this pull request as ready for review
May 29, 2026 17:07
Member
|
@SermishaNarayana I did some testing for the PyPSA-Eur CI check PR and found that you can do the following to compare two vulnerability reports using sarif-tools. git checkout master
grype ... -o sarif --file vuln-old.sarif
git checkout feature-branch
grype ... -o sarif --file vuln-new.sarif
pixi exec --with sarif-tools sarif diff -o sarif-diff.json vuln-old.sarif vuln-new.sarifMight be worth adding it into this handbook entry. |
gincrement
self-requested a review
June 19, 2026 19:28
change backslash with slashes (from Windows to Unix style)
gincrement
approved these changes
Jun 19, 2026
gincrement
left a comment
gincrement
left a comment
Member
There was a problem hiding this comment.
Thanks for the first version of this document.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes # (if applicable).
Changes Proposed in This Pull Request
In this PR, a new page
Security Vulnerabilitieshas been added to theEngineeringsection of the handbook. This page documents conducting a SBOM vulnerability check using a package calledgrype.Checklist