From bc21c2e3695b3a9f66dea036f2ee4f973dc01cb8 Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Tue, 9 Jun 2026 20:58:12 +0700 Subject: [PATCH 1/4] cmd/osv-scanner: add E2E test for AlmaLinux ecosystem mapping --- .../image/__snapshots__/command_test.snap | 1289 +++++------------ cmd/osv-scanner/scan/image/command_test.go | 16 + .../cassettes/TestCommand_OCIImage.yaml | 130 ++ .../TestCommand_OCIImage_JSONFormat.yaml | 130 ++ .../testdata/test-almalinux-9.Dockerfile | 1 + 5 files changed, 678 insertions(+), 888 deletions(-) create mode 100644 cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap index 42402af15d0..38f71c75cce 100755 --- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap @@ -32,20 +32,19 @@ Scanning image "alpine:3.18.9" Container Scanning Result (Alpine Linux v3.18) (Based on "alpine" image): -Total 3 packages affected by 8 known vulnerabilities (0 Critical, 4 High, 4 Medium, 0 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 3 known vulnerabilities (0 Critical, 1 High, 2 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 3 vulnerabilities can be fixed. Alpine:v3.18 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r7 | No fix available | 1 | busybox... (3) | # 0 Layer | alpine | -| musl | 1.2.4-r2 | Fix Available | 1 | musl, musl-utils | # 0 Layer | alpine | -| openssl | 3.1.7-r0 | Partial fixes Available | 6 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| musl | 1.2.4-r2 | Fix Available | 1 | musl, musl-utils | # 0 Layer | alpine | +| openssl | 3.1.7-r0 | Fix Available | 2 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -286,22 +285,22 @@ Scanning local image tarball "./testdata/test-alpine.tar" Container Scanning Result (Alpine Linux v3.18) (Based on "alpine" image): -Total 5 packages affected by 51 known vulnerabilities (6 Critical, 24 High, 21 Medium, 0 Low, 0 Unknown) from 1 ecosystem. -46 vulnerabilities can be fixed. +Total 5 packages affected by 65 known vulnerabilities (6 Critical, 33 High, 26 Medium, 0 Low, 0 Unknown) from 1 ecosystem. +65 vulnerabilities can be fixed. Alpine:v3.18 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| apk-tools | 2.10.6-r0 | Fix Available | 1 | apk-tools | # 3 Layer | -- | -| busybox | 1.30.1-r5 | Partial fixes Available | 19 | busybox, ssl_client | # 3 Layer | -- | -| musl | 1.1.22-r4 | Fix Available | 3 | musl, musl-utils | # 3 Layer | -- | -| openssl | 1.1.1k-r0 | Partial fixes Available | 26 | libcrypto1.1... (2) | # 3 Layer | -- | -| zlib | 1.2.11-r1 | Fix Available | 2 | zlib | # 3 Layer | -- | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| apk-tools | 2.10.6-r0 | Fix Available | 2 | apk-tools | # 3 Layer | -- | +| busybox | 1.30.1-r5 | Fix Available | 19 | busybox, ssl_client | # 3 Layer | -- | +| musl | 1.1.22-r4 | Fix Available | 3 | musl, musl-utils | # 3 Layer | -- | +| openssl | 1.1.1k-r0 | Fix Available | 39 | libcrypto1.1... (2) | # 3 Layer | -- | +| zlib | 1.2.11-r1 | Fix Available | 2 | zlib | # 3 Layer | -- | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -321,9 +320,6 @@ Package Ubuntu:20.04/dpkg/1.19.7ubuntu3.2 has been filtered out because: Just wa Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gcc-10/10.5.0-1ubuntu1~20.04 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gnupg2/2.2.19-3ubuntu2.4 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/gzip/1.10-0ubuntu4.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/acl/2.2.53-6 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/attr/1:2.4.48-5 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/bzip2/1.0.8-2 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/glibc/2.31-0ubuntu9.17 has been filtered out because: Just want to test only unimportant vulns @@ -337,7 +333,6 @@ Package Ubuntu:20.04/xz-utils/5.2.4-1ubuntu1.1 has been filtered out because: Ju Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/p11-kit/0.23.20-1ubuntu0.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns @@ -360,7 +355,7 @@ Package Ubuntu:20.04/sed/4.7-1 has been filtered out because: Just want to test Package Ubuntu:20.04/tar/1.30+dfsg-7ubuntu0.20.04.4 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/zlib/1:1.2.11.dfsg-2ubuntu1.5 has been filtered out because: Just want to test only unimportant vulns -Filtered 46 ignored package/s from the scan. +Filtered 42 ignored package/s from the scan. Container Scanning Result (Ubuntu 20.04.6 LTS) (Based on "google/ubuntu2004" image): @@ -388,9 +383,6 @@ Package Ubuntu:20.04/dpkg/1.19.7ubuntu3.2 has been filtered out because: Just wa Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gcc-10/10.5.0-1ubuntu1~20.04 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/gnupg2/2.2.19-3ubuntu2.4 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/gzip/1.10-0ubuntu4.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/acl/2.2.53-6 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/attr/1:2.4.48-5 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/bzip2/1.0.8-2 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/glibc/2.31-0ubuntu9.17 has been filtered out because: Just want to test only unimportant vulns @@ -404,7 +396,6 @@ Package Ubuntu:20.04/xz-utils/5.2.4-1ubuntu1.1 has been filtered out because: Ju Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/ncurses/6.2-0ubuntu2.1 has been filtered out because: Just want to test only unimportant vulns -Package Ubuntu:20.04/p11-kit/0.23.20-1ubuntu0.1 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/pam/1.3.1-5ubuntu4.7 has been filtered out because: Just want to test only unimportant vulns @@ -427,7 +418,7 @@ Package Ubuntu:20.04/sed/4.7-1 has been filtered out because: Just want to test Package Ubuntu:20.04/tar/1.30+dfsg-7ubuntu0.20.04.4 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/util-linux/2.34-0.1ubuntu9.6 has been filtered out because: Just want to test only unimportant vulns Package Ubuntu:20.04/zlib/1:1.2.11.dfsg-2ubuntu1.5 has been filtered out because: Just want to test only unimportant vulns -Filtered 46 ignored package/s from the scan. +Filtered 42 ignored package/s from the scan. Container Scanning Result (Ubuntu 20.04.6 LTS) (Based on "google/ubuntu2004" image): @@ -457,8 +448,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" Container Scanning Result (Ubuntu 22.04.5 LTS) (Based on "ubuntu" image): -Total 29 packages affected by 91 known vulnerabilities (11 Critical, 28 High, 36 Medium, 6 Low, 10 Unknown) from 1 ecosystem. -39 vulnerabilities can be fixed. +Total 26 packages affected by 83 known vulnerabilities (10 Critical, 21 High, 36 Medium, 5 Low, 11 Unknown) from 1 ecosystem. +33 vulnerabilities can be fixed. Ubuntu:22.04 @@ -467,35 +458,32 @@ Ubuntu:22.04 +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ | SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| acl | 2.3.1-1 | No fix available | 2 | libacl1 | # 4 Layer | ubuntu | -| attr | 1:2.5.1-1build1 | No fix available | 1 | libattr1 | # 4 Layer | ubuntu | | bzip2 | 1.0.8-5build1 | No fix available | 1 | libbz2-1.0 | # 4 Layer | ubuntu | | coreutils | 8.32-4.1ubuntu1.2 | No fix available | 2 | coreutils | # 4 Layer | ubuntu | | dpkg | 1.21.1ubuntu2.3 | Fix Available | 1 | dpkg | # 4 Layer | ubuntu | | gcc-12 | 12.3.0-1ubuntu1~22.04 | Partial fixes Available | 2 | gcc-12-base... (3) | # 4 Layer | ubuntu | | glibc | 2.35-0ubuntu3.8 | Partial fixes Available | 8 | libc-bin, libc6 | # 4 Layer | ubuntu | -| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 5 | gpgv | # 4 Layer | ubuntu | +| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 4 | gpgv | # 4 Layer | ubuntu | | gnutls28 | 3.7.3-4ubuntu1.5 | Fix Available | 4 | libgnutls30 | # 4 Layer | ubuntu | -| gzip | 1.10-4ubuntu4.1 | Fix Available | 1 | gzip | # 4 Layer | ubuntu | | krb5 | 1.19.2-2ubuntu0.4 | Partial fixes Available | 5 | libgssapi-krb5-2... (4) | # 4 Layer | ubuntu | | libcap2 | 1:2.44-1ubuntu0.22.04.1 | Fix Available | 2 | libcap2 | # 4 Layer | ubuntu | | libgcrypt20 | 1.9.4-3ubuntu3 | Partial fixes Available | 2 | libgcrypt20 | # 4 Layer | ubuntu | | libtasn1-6 | 4.18.0-4build1 | Fix Available | 2 | libtasn1-6 | # 4 Layer | ubuntu | | libzstd | 1.4.8+dfsg-3build1 | No fix available | 1 | libzstd1 | # 4 Layer | ubuntu | | lz4 | 1.9.3-2build2 | No fix available | 1 | liblz4-1 | # 4 Layer | ubuntu | -| ncurses | 6.3-2ubuntu0.1 | Partial fixes Available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | +| ncurses | 6.3-2ubuntu0.1 | No fix available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | | openssl | 3.0.2-0ubuntu1.18 | Partial fixes Available | 7 | libssl3 | # 4 Layer | ubuntu | -| p11-kit | 0.24.0-6build1 | No fix available | 1 | libp11-kit0 | # 4 Layer | ubuntu | | pam | 1.4.0-11ubuntu2.5 | Partial fixes Available | 3 | libpam-modules... (4) | # 4 Layer | ubuntu | | pcre2 | 10.39-3ubuntu0.1 | No fix available | 1 | libpcre2-8-0 | # 4 Layer | ubuntu | -| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 13 | perl-base | # 4 Layer | ubuntu | +| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 12 | perl-base | # 4 Layer | ubuntu | | sed | 4.8-1ubuntu2 | Fix Available | 1 | sed | # 4 Layer | ubuntu | | shadow | 1:4.8.1-2ubuntu2.2 | No fix available | 2 | login, passwd | # 4 Layer | ubuntu | | systemd | 249.11-0ubuntu3.12 | Partial fixes Available | 4 | libsystemd0... (2) | # 4 Layer | ubuntu | -| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | Fix Available | 2 | tar | # 4 Layer | ubuntu | -| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 6 | bsdutils | # 4 Layer | ubuntu | -| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 7 | libblkid1... (6) | # 4 Layer | ubuntu | +| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | No fix available | 2 | tar | # 4 Layer | ubuntu | +| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 5 | bsdutils | # 4 Layer | ubuntu | +| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 6 | libblkid1... (6) | # 4 Layer | ubuntu | | xz-utils | 5.2.5-2ubuntu1 | Fix Available | 1 | liblzma5 | # 4 Layer | ubuntu | +| zlib | 1:1.2.11.dfsg-2ubuntu9.2 | No fix available | 1 | zlib1g | # 4 Layer | ubuntu | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ Hiding 5 number of vulnerabilities deemed unimportant, use --all-vulns to show them. @@ -513,8 +501,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" Container Scanning Result (Ubuntu 22.04.5 LTS) (Based on "ubuntu" image): -Total 29 packages affected by 91 known vulnerabilities (11 Critical, 28 High, 36 Medium, 6 Low, 10 Unknown) from 1 ecosystem. -39 vulnerabilities can be fixed. +Total 26 packages affected by 83 known vulnerabilities (10 Critical, 21 High, 36 Medium, 5 Low, 11 Unknown) from 1 ecosystem. +33 vulnerabilities can be fixed. Ubuntu:22.04 @@ -523,35 +511,32 @@ Ubuntu:22.04 +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ | SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| acl | 2.3.1-1 | No fix available | 2 | libacl1 | # 4 Layer | ubuntu | -| attr | 1:2.5.1-1build1 | No fix available | 1 | libattr1 | # 4 Layer | ubuntu | | bzip2 | 1.0.8-5build1 | No fix available | 1 | libbz2-1.0 | # 4 Layer | ubuntu | | coreutils | 8.32-4.1ubuntu1.2 | No fix available | 2 | coreutils | # 4 Layer | ubuntu | | dpkg | 1.21.1ubuntu2.3 | Fix Available | 1 | dpkg | # 4 Layer | ubuntu | | gcc-12 | 12.3.0-1ubuntu1~22.04 | Partial fixes Available | 2 | gcc-12-base... (3) | # 4 Layer | ubuntu | | glibc | 2.35-0ubuntu3.8 | Partial fixes Available | 8 | libc-bin, libc6 | # 4 Layer | ubuntu | -| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 5 | gpgv | # 4 Layer | ubuntu | +| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 4 | gpgv | # 4 Layer | ubuntu | | gnutls28 | 3.7.3-4ubuntu1.5 | Fix Available | 4 | libgnutls30 | # 4 Layer | ubuntu | -| gzip | 1.10-4ubuntu4.1 | Fix Available | 1 | gzip | # 4 Layer | ubuntu | | krb5 | 1.19.2-2ubuntu0.4 | Partial fixes Available | 5 | libgssapi-krb5-2... (4) | # 4 Layer | ubuntu | | libcap2 | 1:2.44-1ubuntu0.22.04.1 | Fix Available | 2 | libcap2 | # 4 Layer | ubuntu | | libgcrypt20 | 1.9.4-3ubuntu3 | Partial fixes Available | 2 | libgcrypt20 | # 4 Layer | ubuntu | | libtasn1-6 | 4.18.0-4build1 | Fix Available | 2 | libtasn1-6 | # 4 Layer | ubuntu | | libzstd | 1.4.8+dfsg-3build1 | No fix available | 1 | libzstd1 | # 4 Layer | ubuntu | | lz4 | 1.9.3-2build2 | No fix available | 1 | liblz4-1 | # 4 Layer | ubuntu | -| ncurses | 6.3-2ubuntu0.1 | Partial fixes Available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | +| ncurses | 6.3-2ubuntu0.1 | No fix available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | | openssl | 3.0.2-0ubuntu1.18 | Partial fixes Available | 7 | libssl3 | # 4 Layer | ubuntu | -| p11-kit | 0.24.0-6build1 | No fix available | 1 | libp11-kit0 | # 4 Layer | ubuntu | | pam | 1.4.0-11ubuntu2.5 | Partial fixes Available | 3 | libpam-modules... (4) | # 4 Layer | ubuntu | | pcre2 | 10.39-3ubuntu0.1 | No fix available | 1 | libpcre2-8-0 | # 4 Layer | ubuntu | -| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 13 | perl-base | # 4 Layer | ubuntu | +| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 12 | perl-base | # 4 Layer | ubuntu | | sed | 4.8-1ubuntu2 | Fix Available | 1 | sed | # 4 Layer | ubuntu | | shadow | 1:4.8.1-2ubuntu2.2 | No fix available | 2 | login, passwd | # 4 Layer | ubuntu | | systemd | 249.11-0ubuntu3.12 | Partial fixes Available | 4 | libsystemd0... (2) | # 4 Layer | ubuntu | -| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | Fix Available | 2 | tar | # 4 Layer | ubuntu | -| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 6 | bsdutils | # 4 Layer | ubuntu | -| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 7 | libblkid1... (6) | # 4 Layer | ubuntu | +| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | No fix available | 2 | tar | # 4 Layer | ubuntu | +| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 5 | bsdutils | # 4 Layer | ubuntu | +| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 6 | libblkid1... (6) | # 4 Layer | ubuntu | | xz-utils | 5.2.5-2ubuntu1 | Fix Available | 1 | liblzma5 | # 4 Layer | ubuntu | +| zlib | 1:1.2.11.dfsg-2ubuntu9.2 | No fix available | 1 | zlib1g | # 4 Layer | ubuntu | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ Filtered Vulnerabilities: @@ -583,13 +568,42 @@ failed to load image from tarball with path "../../testdata/locks-manyoci-image/ --- +[TestCommand_OCIImage/Scanning_AlmaLinux_9_image - 1] +Scanning local image tarball "./testdata/test-almalinux-9.tar" + +Total 2 packages affected by 9 known vulnerabilities (0 Critical, 3 High, 5 Medium, 1 Low, 0 Unknown) from 1 ecosystem. +9 vulnerabilities can be fixed. + ++-------------------------------------+------+-----------+------------+---------+---------------+-------------------------------------------------------------+ +| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE | ++-------------------------------------+------+-----------+------------+---------+---------------+-------------------------------------------------------------+ +| https://osv.dev/PYSEC-2023-228 | 6.8 | PyPI | pip | 21.2.3 | 23.3 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | +| https://osv.dev/GHSA-mq26-g339-26xf | | | | | | | +| https://osv.dev/PYSEC-2026-196 | 5.5 | PyPI | pip | 21.2.3 | 26.1.2 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | +| https://osv.dev/GHSA-4xh5-x5gv-qwph | 5.9 | PyPI | pip | 21.2.3 | 25.3 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | +| https://osv.dev/GHSA-58qw-9mgm-455v | 4.6 | PyPI | pip | 21.2.3 | 26.1 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | +| https://osv.dev/GHSA-6vgw-5pg2-w6jp | 2.0 | PyPI | pip | 21.2.3 | 26.0 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | +| https://osv.dev/GHSA-jp4c-xjxw-mgf9 | 5.3 | PyPI | pip | 21.2.3 | 26.1 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | +| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 53.0.0 | 65.5.1 | usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | +| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | | +| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 53.0.0 | 78.1.1 | usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | +| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | | +| https://osv.dev/GHSA-cx63-2mw6-8hw5 | 8.8 | PyPI | setuptools | 53.0.0 | 70.0.0 | usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | ++-------------------------------------+------+-----------+------------+---------+---------------+-------------------------------------------------------------+ + +--- + +[TestCommand_OCIImage/Scanning_AlmaLinux_9_image - 2] + +--- + [TestCommand_OCIImage/Scanning_Ubuntu_image_with_go_OS_packages_json - 1] Scanning local image tarball "./testdata/test-ubuntu-with-packages.tar" Container Scanning Result (Ubuntu 22.04.5 LTS) (Based on "ubuntu" image): -Total 30 packages affected by 93 known vulnerabilities (11 Critical, 30 High, 36 Medium, 6 Low, 10 Unknown) from 1 ecosystem. -39 vulnerabilities can be fixed. +Total 26 packages affected by 83 known vulnerabilities (10 Critical, 21 High, 36 Medium, 5 Low, 11 Unknown) from 1 ecosystem. +33 vulnerabilities can be fixed. Ubuntu:22.04 @@ -598,36 +612,32 @@ Ubuntu:22.04 +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ | SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| acl | 2.3.1-1 | No fix available | 2 | libacl1 | # 4 Layer | ubuntu | -| attr | 1:2.5.1-1build1 | No fix available | 1 | libattr1 | # 4 Layer | ubuntu | | bzip2 | 1.0.8-5build1 | No fix available | 1 | libbz2-1.0 | # 4 Layer | ubuntu | | coreutils | 8.32-4.1ubuntu1.2 | No fix available | 2 | coreutils | # 4 Layer | ubuntu | | dpkg | 1.21.1ubuntu2.3 | Fix Available | 1 | dpkg | # 4 Layer | ubuntu | -| fzf | 0.29.0-1ubuntu0.1 | No fix available | 2 | fzf | # 7 Layer | -- | | gcc-12 | 12.3.0-1ubuntu1~22.04 | Partial fixes Available | 2 | gcc-12-base... (3) | # 4 Layer | ubuntu | | glibc | 2.35-0ubuntu3.8 | Partial fixes Available | 8 | libc-bin, libc6 | # 4 Layer | ubuntu | -| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 5 | gpgv | # 4 Layer | ubuntu | +| gnupg2 | 2.2.27-3ubuntu2.1 | Partial fixes Available | 4 | gpgv | # 4 Layer | ubuntu | | gnutls28 | 3.7.3-4ubuntu1.5 | Fix Available | 4 | libgnutls30 | # 4 Layer | ubuntu | -| gzip | 1.10-4ubuntu4.1 | Fix Available | 1 | gzip | # 4 Layer | ubuntu | | krb5 | 1.19.2-2ubuntu0.4 | Partial fixes Available | 5 | libgssapi-krb5-2... (4) | # 4 Layer | ubuntu | | libcap2 | 1:2.44-1ubuntu0.22.04.1 | Fix Available | 2 | libcap2 | # 4 Layer | ubuntu | | libgcrypt20 | 1.9.4-3ubuntu3 | Partial fixes Available | 2 | libgcrypt20 | # 4 Layer | ubuntu | | libtasn1-6 | 4.18.0-4build1 | Fix Available | 2 | libtasn1-6 | # 4 Layer | ubuntu | | libzstd | 1.4.8+dfsg-3build1 | No fix available | 1 | libzstd1 | # 4 Layer | ubuntu | | lz4 | 1.9.3-2build2 | No fix available | 1 | liblz4-1 | # 4 Layer | ubuntu | -| ncurses | 6.3-2ubuntu0.1 | Partial fixes Available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | +| ncurses | 6.3-2ubuntu0.1 | No fix available | 3 | libncurses6... (5) | # 4 Layer | ubuntu | | openssl | 3.0.2-0ubuntu1.18 | Partial fixes Available | 7 | libssl3 | # 4 Layer | ubuntu | -| p11-kit | 0.24.0-6build1 | No fix available | 1 | libp11-kit0 | # 4 Layer | ubuntu | | pam | 1.4.0-11ubuntu2.5 | Partial fixes Available | 3 | libpam-modules... (4) | # 4 Layer | ubuntu | | pcre2 | 10.39-3ubuntu0.1 | No fix available | 1 | libpcre2-8-0 | # 4 Layer | ubuntu | -| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 13 | perl-base | # 4 Layer | ubuntu | +| perl | 5.34.0-3ubuntu1.3 | Partial fixes Available | 12 | perl-base | # 4 Layer | ubuntu | | sed | 4.8-1ubuntu2 | Fix Available | 1 | sed | # 4 Layer | ubuntu | | shadow | 1:4.8.1-2ubuntu2.2 | No fix available | 2 | login, passwd | # 4 Layer | ubuntu | | systemd | 249.11-0ubuntu3.12 | Partial fixes Available | 4 | libsystemd0... (2) | # 4 Layer | ubuntu | -| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | Fix Available | 2 | tar | # 4 Layer | ubuntu | -| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 6 | bsdutils | # 4 Layer | ubuntu | -| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 7 | libblkid1... (6) | # 4 Layer | ubuntu | +| tar | 1.34+dfsg-1ubuntu0.1.22.04.2 | No fix available | 2 | tar | # 4 Layer | ubuntu | +| util-linux | 1:2.37.2-4ubuntu3.4 | No fix available | 5 | bsdutils | # 4 Layer | ubuntu | +| util-linux | 2.37.2-4ubuntu3.4 | Partial fixes Available | 6 | libblkid1... (6) | # 4 Layer | ubuntu | | xz-utils | 5.2.5-2ubuntu1 | Fix Available | 1 | liblzma5 | # 4 Layer | ubuntu | +| zlib | 1:1.2.11.dfsg-2ubuntu9.2 | No fix available | 1 | zlib1g | # 4 Layer | ubuntu | +----------------+------------------------------+-------------------------+------------+-------------------------+------------------+---------------+ Hiding 5 number of vulnerabilities deemed unimportant, use --all-vulns to show them. @@ -645,62 +655,59 @@ Scanning local image tarball "./testdata/test-java-full.tar" Container Scanning Result (Alpine Linux v3.21) (Based on "eclipse-temurin" image): -Total 38 packages affected by 164 known vulnerabilities (5 Critical, 76 High, 74 Medium, 8 Low, 1 Unknown) from 2 ecosystems. -157 vulnerabilities can be fixed. +Total 35 packages affected by 136 known vulnerabilities (6 Critical, 66 High, 56 Medium, 7 Low, 1 Unknown) from 2 ecosystems. +136 vulnerabilities can be fixed. Maven -+-------------------------------------------------------------------------------------------------------------------------------------------+ -| Source:artifact:/app/target.jar | -+---------------------------------------------+-------------------+-------------------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------------------------------------------+-------------------+-------------------------+------------+------------------+---------------+ -| com.fasterxml.jackson.core:jackson-core | 2.10.2 | Fix Available | 3 | # 12 Layer | -- | -| com.fasterxml.jackson.core:jackson-databind | 2.12.7.1 | Partial fixes Available | 5 | # 12 Layer | -- | -| com.google.protobuf:protobuf-java | 3.21.12 | Fix Available | 1 | # 12 Layer | -- | -| com.nimbusds:nimbus-jose-jwt | 9.31 | Fix Available | 2 | # 12 Layer | -- | -| commons-beanutils:commons-beanutils | 1.9.4 | Fix Available | 1 | # 12 Layer | -- | -| dnsjava:dnsjava | 3.4.0 | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-codec | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | -| io.netty:netty-codec-dns | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-codec-haproxy | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | -| io.netty:netty-codec-http | 4.1.100.Final | Fix Available | 11 | # 12 Layer | -- | -| io.netty:netty-codec-http2 | 4.1.100.Final | Fix Available | 6 | # 12 Layer | -- | -| io.netty:netty-codec-mqtt | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-codec-redis | 4.1.100.Final | Fix Available | 5 | # 12 Layer | -- | -| io.netty:netty-codec-smtp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-common | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | -| io.netty:netty-handler | 4.1.100.Final | Fix Available | 4 | # 12 Layer | -- | -| io.netty:netty-handler-proxy | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-resolver-dns | 4.1.100.Final | Fix Available | 3 | # 12 Layer | -- | -| io.netty:netty-transport-native-epoll | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-transport-native-kqueue | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| io.netty:netty-transport-sctp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | -| org.apache.avro:avro | 1.9.2 | Fix Available | 2 | # 12 Layer | -- | -| org.apache.commons:commons-compress | 1.21 | Fix Available | 2 | # 12 Layer | -- | -| org.apache.commons:commons-configuration2 | 2.8.0 | Fix Available | 3 | # 12 Layer | -- | -| org.apache.commons:commons-lang3 | 3.12.0 | Fix Available | 1 | # 12 Layer | -- | -| org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | Fix Available | 3 | # 12 Layer | -- | -| org.jline:jline-remote-telnet | 3.9.0 | Fix Available | 2 | # 12 Layer | -- | -+---------------------------------------------+-------------------+-------------------------+------------+------------------+---------------+ ++-------------------------------------------------------------------------------------------------------------------------------+ +| Source:artifact:/app/target.jar | ++-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ +| com.fasterxml.jackson.core:jackson-core | 2.10.2 | Fix Available | 3 | # 12 Layer | -- | +| com.google.protobuf:protobuf-java | 3.21.12 | Fix Available | 1 | # 12 Layer | -- | +| com.nimbusds:nimbus-jose-jwt | 9.31 | Fix Available | 2 | # 12 Layer | -- | +| commons-beanutils:commons-beanutils | 1.9.4 | Fix Available | 1 | # 12 Layer | -- | +| dnsjava:dnsjava | 3.4.0 | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-codec | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | +| io.netty:netty-codec-dns | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-codec-haproxy | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | +| io.netty:netty-codec-http | 4.1.100.Final | Fix Available | 11 | # 12 Layer | -- | +| io.netty:netty-codec-http2 | 4.1.100.Final | Fix Available | 6 | # 12 Layer | -- | +| io.netty:netty-codec-mqtt | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-codec-redis | 4.1.100.Final | Fix Available | 5 | # 12 Layer | -- | +| io.netty:netty-codec-smtp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-common | 4.1.100.Final | Fix Available | 2 | # 12 Layer | -- | +| io.netty:netty-handler | 4.1.100.Final | Fix Available | 4 | # 12 Layer | -- | +| io.netty:netty-handler-proxy | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-resolver-dns | 4.1.100.Final | Fix Available | 3 | # 12 Layer | -- | +| io.netty:netty-transport-native-epoll | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-transport-native-kqueue | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| io.netty:netty-transport-sctp | 4.1.100.Final | Fix Available | 1 | # 12 Layer | -- | +| org.apache.avro:avro | 1.9.2 | Fix Available | 2 | # 12 Layer | -- | +| org.apache.commons:commons-compress | 1.21 | Fix Available | 2 | # 12 Layer | -- | +| org.apache.commons:commons-configuration2 | 2.8.0 | Fix Available | 3 | # 12 Layer | -- | +| org.apache.commons:commons-lang3 | 3.12.0 | Fix Available | 1 | # 12 Layer | -- | +| org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | Fix Available | 3 | # 12 Layer | -- | ++-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ Alpine:v3.21 -+---------------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+----------------------------+------------------+-----------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+----------------------------+------------------+-----------------+ -| busybox | 1.37.0-r9 | Partial fixes Available | 3 | busybox... (3) | # 0 Layer | alpine | -| expat | 2.6.4-r0 | Fix Available | 22 | libexpat | # 5 Layer | eclipse-temurin | -| gnupg | 2.4.7-r0 | Fix Available | 2 | gnupg... (11) | # 5 Layer | eclipse-temurin | -| gnutls | 3.8.8-r0 | Fix Available | 21 | gnutls | # 5 Layer | eclipse-temurin | -| libpng | 1.6.44-r0 | Fix Available | 10 | libpng | # 5 Layer | eclipse-temurin | -| libtasn1 | 4.19.0-r2 | Fix Available | 2 | libtasn1 | # 5 Layer | eclipse-temurin | -| musl | 1.2.5-r8 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | -| openssl | 3.3.2-r4 | Partial fixes Available | 25 | libcrypto3, libssl3... (3) | # 0 Layer | alpine | -| p11-kit | 0.25.5-r2 | Fix Available | 1 | p11-kit... (2) | # 5 Layer | eclipse-temurin | -| sqlite | 3.47.1-r0 | Partial fixes Available | 5 | sqlite-libs | # 5 Layer | eclipse-temurin | -| zlib | 1.3.1-r2 | Fix Available | 2 | zlib | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+----------------------------+------------------+-----------------+ ++-----------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+----------------------------+------------------+-----------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+----------------------------+------------------+-----------------+ +| busybox | 1.37.0-r9 | Fix Available | 2 | busybox... (3) | # 0 Layer | alpine | +| expat | 2.6.4-r0 | Fix Available | 7 | libexpat | # 5 Layer | eclipse-temurin | +| gnupg | 2.4.7-r0 | Fix Available | 2 | gnupg... (11) | # 5 Layer | eclipse-temurin | +| gnutls | 3.8.8-r0 | Fix Available | 21 | gnutls | # 5 Layer | eclipse-temurin | +| libpng | 1.6.44-r0 | Fix Available | 11 | libpng | # 5 Layer | eclipse-temurin | +| libtasn1 | 4.19.0-r2 | Fix Available | 2 | libtasn1 | # 5 Layer | eclipse-temurin | +| musl | 1.2.5-r8 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | +| openssl | 3.3.2-r4 | Fix Available | 21 | libcrypto3, libssl3... (3) | # 0 Layer | alpine | +| sqlite | 3.47.1-r0 | Fix Available | 4 | sqlite-libs | # 5 Layer | eclipse-temurin | +| zlib | 1.3.1-r2 | Fix Available | 2 | zlib | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+----------------------------+------------------+-----------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -716,7 +723,7 @@ Scanning local image tarball "./testdata/test-python-empty.tar" Container Scanning Result (Debian GNU/Linux 10 (buster)) (Based on "python" image): -Total 15 packages affected by 33 known vulnerabilities (0 Critical, 9 High, 8 Medium, 2 Low, 14 Unknown) from 2 ecosystems. +Total 15 packages affected by 33 known vulnerabilities (0 Critical, 7 High, 10 Medium, 2 Low, 14 Unknown) from 2 ecosystems. 33 vulnerabilities can be fixed. @@ -788,7 +795,7 @@ Scanning local image tarball "./testdata/test-python-full.tar" Container Scanning Result (Debian GNU/Linux 10 (buster)) (Based on "python" image): -Total 21 packages affected by 61 known vulnerabilities (1 Critical, 21 High, 22 Medium, 3 Low, 14 Unknown) from 2 ecosystems. +Total 21 packages affected by 61 known vulnerabilities (1 Critical, 19 High, 24 Medium, 3 Low, 14 Unknown) from 2 ecosystems. 61 vulnerabilities can be fixed. @@ -902,8 +909,8 @@ Scanning local image tarball "./testdata/test-package-tracing.tar" Container Scanning Result (Alpine Linux v3.20) (Based on "alpine" image): -Total 10 packages affected by 348 known vulnerabilities (2 Critical, 17 High, 15 Medium, 2 Low, 312 Unknown) from 2 ecosystems. -343 vulnerabilities can be fixed. +Total 10 packages affected by 331 known vulnerabilities (2 Critical, 14 High, 13 Medium, 2 Low, 300 Unknown) from 2 ecosystems. +331 vulnerabilities can be fixed. Go @@ -912,54 +919,54 @@ Go +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 9 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 9 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.2.0 | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 2 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 2 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.3.0 | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 4 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 4 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.3.0-moved | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 3 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 3 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-1.4.0 | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 2 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 2 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ +---------------------------------------------------------------------------------------------+ | Source:artifact:/go/bin/ptf-vulnerable | +---------+-------------------+---------------+------------+------------------+---------------+ | PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | +---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.22.4 | Fix Available | 52 | # 7 Layer | -- | +| stdlib | 1.22.4 | Fix Available | 50 | # 7 Layer | -- | +---------+-------------------+---------------+------------+------------------+---------------+ Alpine:v3.20 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r29 | Partial fixes Available | 3 | busybox... (3) | # 0 Layer | alpine | -| musl | 1.2.5-r0 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | -| openssl | 3.3.1-r0 | Partial fixes Available | 28 | libcrypto3, libssl3 | # 0 Layer | alpine | -| zlib | 1.3.1-r1 | Fix Available | 2 | zlib | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r29 | Fix Available | 2 | busybox... (3) | # 0 Layer | alpine | +| musl | 1.2.5-r0 | Fix Available | 3 | musl, musl-utils | # 0 Layer | alpine | +| openssl | 3.3.1-r0 | Fix Available | 24 | libcrypto3, libssl3 | # 0 Layer | alpine | +| zlib | 1.3.1-r1 | Fix Available | 2 | zlib | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1078,94 +1085,24 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne --- -[TestCommand_OCIImage/scanning_insecure_chiseled_ubuntu_image - 1] -Scanning local image tarball "./testdata/test-chisel.tar" - - -Container Scanning Result (Ubuntu 26.04 LTS): -Total 7 packages affected by 151 known vulnerabilities (0 Critical, 0 High, 1 Medium, 0 Low, 150 Unknown) from 2 ecosystems. -150 vulnerabilities can be fixed. - - -Go -+---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/bin/go | -+---------+-------------------+---------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | -+---------+-------------------+---------------+------------+------------------+---------------+ -+---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/bin/gofmt | -+---------+-------------------+---------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | -+---------+-------------------+---------------+------------+------------------+---------------+ -+---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/asm | -+---------+-------------------+---------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | -+---------+-------------------+---------------+------------+------------------+---------------+ -+---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/compile | -+---------+-------------------+---------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | -+---------+-------------------+---------------+------------+------------------+---------------+ -+---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/link | -+---------+-------------------+---------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | -+---------+-------------------+---------------+------------+------------------+---------------+ -+---------------------------------------------------------------------------------------------+ -| Source:artifact:/usr/lib/go-1.26/pkg/tool/linux_amd64/vet | -+---------+-------------------+---------------+------------+------------------+---------------+ -| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | -+---------+-------------------+---------------+------------+------------------+---------------+ -| stdlib | 1.26.0 | Fix Available | 25 | # 0 Layer | -- | -+---------+-------------------+---------------+------------+------------------+---------------+ -Ubuntu:26.04 -+-------------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/var/lib/chisel/manifest.wall | -+----------------+-----------------------------+------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-----------------------------+------------------+------------+-------------------------+------------------+---------------+ -| coreutils | 9.5-1ubuntu2+0.0.0~ubuntu25 | No fix available | 1 | coreutils | # 0 Layer | -- | -+----------------+-----------------------------+------------------+------------+-------------------------+------------------+---------------+ - -For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. -You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. - ---- - -[TestCommand_OCIImage/scanning_insecure_chiseled_ubuntu_image - 2] - ---- - [TestCommand_OCIImage/scanning_node_modules_using_npm_with_no_packages - 1] Scanning local image tarball "./testdata/test-node_modules-npm-empty.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1181,7 +1118,7 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 4 packages affected by 23 known vulnerabilities (3 Critical, 6 High, 12 Medium, 2 Low, 0 Unknown) from 2 ecosystems. +Total 4 packages affected by 18 known vulnerabilities (3 Critical, 3 High, 10 Medium, 2 Low, 0 Unknown) from 2 ecosystems. 17 vulnerabilities can be fixed. @@ -1195,14 +1132,14 @@ npm | minimist | 0.0.8 | Fix Available | 2 | # 13 Layer | -- | +----------+-------------------+------------------+------------+------------------+---------------+ Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1218,19 +1155,19 @@ Scanning local image tarball "./testdata/test-node_modules-pnpm-empty.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1246,19 +1183,19 @@ Scanning local image tarball "./testdata/test-node_modules-pnpm-full.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1274,19 +1211,19 @@ Scanning local image tarball "./testdata/test-node_modules-yarn-empty.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1302,19 +1239,19 @@ Scanning local image tarball "./testdata/test-node_modules-yarn-full.tar" Container Scanning Result (Alpine Linux v3.19) (Based on "node" image): -Total 2 packages affected by 20 known vulnerabilities (1 Critical, 6 High, 11 Medium, 2 Low, 0 Unknown) from 1 ecosystem. +Total 2 packages affected by 15 known vulnerabilities (1 Critical, 3 High, 9 Medium, 2 Low, 0 Unknown) from 1 ecosystem. 15 vulnerabilities can be fixed. Alpine:v3.19 -+----------------------------------------------------------------------------------------------------------------------------------------+ -| Source:os:/lib/apk/db/installed | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ -| busybox | 1.36.1-r15 | Partial fixes Available | 7 | busybox... (3) | # 0 Layer | alpine | -| openssl | 3.1.4-r5 | Partial fixes Available | 13 | libcrypto3, libssl3 | # 0 Layer | alpine | -+----------------+-------------------+-------------------------+------------+-------------------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/lib/apk/db/installed | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ +| busybox | 1.36.1-r15 | Fix Available | 6 | busybox... (3) | # 0 Layer | alpine | +| openssl | 3.1.4-r5 | Fix Available | 9 | libcrypto3, libssl3 | # 0 Layer | alpine | ++----------------+-------------------+---------------+------------+-------------------------+------------------+---------------+ For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. @@ -1331,7 +1268,7 @@ skipping file "home/linuxbrew/.linuxbrew/Homebrew/Library/Taps/homebrew/homebrew Container Scanning Result (Ubuntu 22.04.5 LTS): -Total 1 package affected by 3 known vulnerabilities (1 Critical, 1 High, 0 Medium, 1 Low, 0 Unknown) from 1 ecosystem. +Total 1 package affected by 3 known vulnerabilities (1 Critical, 1 High, 1 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 0 vulnerabilities can be fixed. @@ -1374,15 +1311,12 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 6, "vulnerabilities": [ "PYSEC-2023-228", - "PYSEC-2026-1795", - "PYSEC-2026-1796", "PYSEC-2026-196", "GHSA-4xh5-x5gv-qwph", "GHSA-58qw-9mgm-455v", "GHSA-6vgw-5pg2-w6jp", "GHSA-jp4c-xjxw-mgf9", - "GHSA-mq26-g339-26xf", - "GHSA-wf93-45jw-7689" + "GHSA-mq26-g339-26xf" ] } ] @@ -1406,7 +1340,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "vulnerabilities": [ "PYSEC-2022-43012", "PYSEC-2025-49", - "PYSEC-2026-1918", "GHSA-5rjg-fvgr-3xxf", "GHSA-cx63-2mw6-8hw5", "GHSA-r9hx-vwmv-q579" @@ -1432,7 +1365,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 7, "vulnerabilities": [ "PYSEC-2021-98", - "PYSEC-2026-1297", "GHSA-68w8-qjq3-2gfm", "GHSA-6w2r-r2m5-xq5w", "GHSA-7xr5-9hcq-chf9", @@ -1515,15 +1447,12 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 6, "vulnerabilities": [ "PYSEC-2023-228", - "PYSEC-2026-1795", - "PYSEC-2026-1796", "PYSEC-2026-196", "GHSA-4xh5-x5gv-qwph", "GHSA-58qw-9mgm-455v", "GHSA-6vgw-5pg2-w6jp", "GHSA-jp4c-xjxw-mgf9", - "GHSA-mq26-g339-26xf", - "GHSA-wf93-45jw-7689" + "GHSA-mq26-g339-26xf" ] } ] @@ -1546,8 +1475,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "groups": 4, "vulnerabilities": [ "PYSEC-2023-74", - "PYSEC-2026-1872", - "PYSEC-2026-1873", "GHSA-9hjg-9r4m-mvj7", "GHSA-9wx4-h78v-vm56", "GHSA-gc5v-m9x4-r6x2", @@ -1575,7 +1502,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "vulnerabilities": [ "PYSEC-2022-43012", "PYSEC-2025-49", - "PYSEC-2026-1918", "GHSA-5rjg-fvgr-3xxf", "GHSA-cx63-2mw6-8hw5", "GHSA-r9hx-vwmv-q579" @@ -1604,11 +1530,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne "PYSEC-2023-192", "PYSEC-2023-212", "PYSEC-2026-141", - "PYSEC-2026-1994", - "PYSEC-2026-1995", - "PYSEC-2026-1996", - "PYSEC-2026-1998", - "PYSEC-2026-1999", "GHSA-2xpw-w6gg-jr37", "GHSA-34jh-p97f-mpxf", "GHSA-38jv-5279-wg99", @@ -1639,7 +1560,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne }, "groups": 2, "vulnerabilities": [ - "PYSEC-2026-2044", "GHSA-29vq-49wr-vm6x", "GHSA-87hc-h4r5-73f7" ] @@ -1663,7 +1583,6 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne }, "groups": 1, "vulnerabilities": [ - "PYSEC-2026-2047", "GHSA-8rrh-rw8j-w5fx" ] } @@ -2138,19 +2057,19 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne }, { "diff_id": "sha256:...", - "command": "COPY ./python-fixture/req...", + "command": "COPY file:ac7d7ae19a2bef3...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c pip instal...", + "command": "RUN /0pip install --no-ca...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "COPY python-fixture/main....", + "command": "COPY file:0f8c0400baa4c00...", "is_empty": false, "base_image_index": 0 }, @@ -2182,6 +2101,103 @@ Scanning local image tarball "./testdata/test-python-full.tar" --- +[TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image - 1] +{ + "results": [ + { + "source": { + "path": "/usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl", + "type": "artifact" + }, + "packages": [ + { + "package": { + "name": "pip", + "version": "21.2.3", + "ecosystem": "PyPI", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "PYSEC-2023-228", + "PYSEC-2026-196", + "GHSA-4xh5-x5gv-qwph", + "GHSA-58qw-9mgm-455v", + "GHSA-6vgw-5pg2-w6jp", + "GHSA-jp4c-xjxw-mgf9", + "GHSA-mq26-g339-26xf" + ] + } + ] + }, + { + "source": { + "path": "/usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl", + "type": "artifact" + }, + "packages": [ + { + "package": { + "name": "setuptools", + "version": "53.0.0", + "ecosystem": "PyPI", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "PYSEC-2022-43012", + "PYSEC-2025-49", + "GHSA-5rjg-fvgr-3xxf", + "GHSA-cx63-2mw6-8hw5", + "GHSA-r9hx-vwmv-q579" + ] + } + ] + } + ], + "experimental_config": { + "licenses": { + "summary": false, + "allowlist": null + } + }, + "image_metadata": { + "os": "AlmaLinux 9.0 (Emerald Puma)", + "layer_metadata": [ + { + "diff_id": "sha256:...", + "command": "/bin/sh -c #(nop) ADD file:cdf5c88acfb05424d5a6583dd0a107526beb2cd9fda2ac5d4a586b74630305a2 in / ", + "is_empty": false, + "base_image_index": 1 + }, + { + "diff_id": "", + "command": "/bin/sh -c #(nop) CMD [/"/bin/bash/"]", + "is_empty": true, + "base_image_index": 1 + } + ], + "base_images": [ + {}, + { + "name": "almalinux", + "tags": null + } + ] + } +} + +--- + +[TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image - 2] +Scanning local image tarball "./testdata/test-almalinux-9.tar" + +--- + [TestCommand_OCIImage_JSONFormat/scanning_image_with_deprecated_packages - 1] { "results": [ @@ -2221,9 +2237,8 @@ Scanning local image tarball "./testdata/test-python-full.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2239,9 +2254,8 @@ Scanning local image tarball "./testdata/test-python-full.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2257,12 +2271,8 @@ Scanning local image tarball "./testdata/test-python-full.tar" "index": 0 } }, - "groups": 38, + "groups": 34, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2025-11187", "ALPINE-CVE-2025-15467", "ALPINE-CVE-2025-15468", @@ -2310,12 +2320,8 @@ Scanning local image tarball "./testdata/test-python-full.tar" "index": 0 } }, - "groups": 38, + "groups": 34, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2025-11187", "ALPINE-CVE-2025-15467", "ALPINE-CVE-2025-15468", @@ -2397,9 +2403,8 @@ Scanning local image tarball "./testdata/test-python-full.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2447,7 +2452,7 @@ Scanning local image tarball "./testdata/test-python-full.tar" }, { "diff_id": "sha256:...", - "command": "COPY /app/target/release/rust_novuln_deprecated /app/rust_novuln_deprecated # buildkit", + "command": "/bin/sh -c #(nop) COPY file:e0bac7c4525c896bfb37d9b34630a6644b68ef9ccc3e05a4d00efc9e596e37ef in /app/rust_novuln_deprecated ", "is_empty": false, "base_image_index": 0 } @@ -2501,7 +2506,7 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 2 } }, - "groups": 52, + "groups": 50, "vulnerabilities": [ "GO-2024-2963", "GO-2024-3105", @@ -2543,7 +2548,6 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "GO-2026-4918", "GO-2026-4946", "GO-2026-4947", - "GO-2026-4970", "GO-2026-4971", "GO-2026-4976", "GO-2026-4977", @@ -2553,8 +2557,7 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "GO-2026-4986", "GO-2026-5037", "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" + "GO-2026-5039" ] }, { @@ -2634,9 +2637,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2652,9 +2654,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2682,12 +2683,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 28, + "groups": 24, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-12797", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-5535", @@ -2725,12 +2722,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 28, + "groups": 24, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-12797", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-5535", @@ -2816,9 +2809,8 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" "index": 0 } }, - "groups": 3, + "groups": 2, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2024-58251", "ALPINE-CVE-2025-46394" ] @@ -2866,7 +2858,7 @@ Scanning local image tarball "./testdata/test-image-with-deprecated.tar" }, { "diff_id": "sha256:...", - "command": "COPY /work/ptf-1.4.0 /go/bin/ # buildkit", + "command": "COPY file:ebcf25e0dd60192f650632ee1757c00542fcea8440c0114b434811029d21d791 in /go/bin/ ", "is_empty": false, "base_image_index": 0 } @@ -2964,13 +2956,13 @@ Scanning local image tarball "./testdata/test-go-binary.tar" }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow # buildkit", + "command": "/bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow # buildkit", + "command": "/bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 } @@ -3068,13 +3060,13 @@ Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow # buildkit", + "command": "/bin/sh -c echo 'user-bcrypt:$2b$05$IYDlXvHmeORyyiUwu8KKuek2LE8VrxIYZ2skPvRDDNngpXJHRq7sG' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow # buildkit", + "command": "/bin/sh -c echo 'user-descrypt:chERDiI95PGCQ' /u003e/u003e /etc/shadow", "is_empty": false, "base_image_index": 0 } @@ -3100,369 +3092,36 @@ Scanning local image tarball "./testdata/test-alpine-etcshadow.tar" --- -[TestCommand_OCIImage_JSONFormat/scanning_insecure_chiseled_ubuntu_image - 1] +[TestCommand_OCIImage_JSONFormat/scanning_node_modules_using_npm_with_some_packages - 1] { "results": [ { "source": { - "path": "/usr/lib/go-1.26/bin/go", - "type": "artifact" + "path": "/lib/apk/db/installed", + "type": "os" }, "packages": [ { "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", + "name": "busybox", + "os_package_name": "busybox", + "version": "1.36.1-r15", + "ecosystem": "Alpine:v3.19", + "commit": "d1b6f274f29076967826e0ecf6ebcaa5d360272f", "image_origin_details": { "index": 0 } }, - "groups": 25, + "groups": 6, "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" + "ALPINE-CVE-2023-42363", + "ALPINE-CVE-2023-42364", + "ALPINE-CVE-2023-42365", + "ALPINE-CVE-2023-42366", + "ALPINE-CVE-2024-58251", + "ALPINE-CVE-2025-46394" ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/bin/gofmt", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/asm", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/compile", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/link", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/usr/lib/go-1.26/pkg/tool/linux_amd64/vet", - "type": "artifact" - }, - "packages": [ - { - "package": { - "name": "stdlib", - "version": "1.26.0", - "ecosystem": "Go", - "image_origin_details": { - "index": 0 - } - }, - "groups": 25, - "vulnerabilities": [ - "GO-2026-4599", - "GO-2026-4600", - "GO-2026-4601", - "GO-2026-4602", - "GO-2026-4603", - "GO-2026-4864", - "GO-2026-4865", - "GO-2026-4866", - "GO-2026-4869", - "GO-2026-4870", - "GO-2026-4918", - "GO-2026-4946", - "GO-2026-4947", - "GO-2026-4970", - "GO-2026-4971", - "GO-2026-4976", - "GO-2026-4977", - "GO-2026-4980", - "GO-2026-4981", - "GO-2026-4982", - "GO-2026-4986", - "GO-2026-5037", - "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" - ] - } - ] - }, - { - "source": { - "path": "/var/lib/chisel/manifest.wall", - "type": "os" - }, - "packages": [ - { - "package": { - "name": "coreutils", - "os_package_name": "coreutils", - "version": "9.5-1ubuntu2+0.0.0~ubuntu25", - "ecosystem": "Ubuntu:26.04", - "image_origin_details": { - "index": 0 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2025-5278" - ] - } - ] - } - ], - "experimental_config": { - "licenses": { - "summary": false, - "allowlist": null - } - }, - "image_metadata": { - "os": "Ubuntu 26.04 LTS", - "layer_metadata": [ - { - "diff_id": "sha256:...", - "command": "COPY /rootfs/ / # buildkit", - "is_empty": false, - "base_image_index": 0 - } - ], - "base_images": [ - {} - ] - } -} - ---- - -[TestCommand_OCIImage_JSONFormat/scanning_insecure_chiseled_ubuntu_image - 2] -Scanning local image tarball "./testdata/test-chisel.tar" - ---- - -[TestCommand_OCIImage_JSONFormat/scanning_node_modules_using_npm_with_some_packages - 1] -{ - "results": [ - { - "source": { - "path": "/lib/apk/db/installed", - "type": "os" - }, - "packages": [ - { - "package": { - "name": "busybox", - "os_package_name": "busybox", - "version": "1.36.1-r15", - "ecosystem": "Alpine:v3.19", - "commit": "d1b6f274f29076967826e0ecf6ebcaa5d360272f", - "image_origin_details": { - "index": 0 - } - }, - "groups": 7, - "vulnerabilities": [ - "ALPINE-CVE-2021-42376", - "ALPINE-CVE-2023-42363", - "ALPINE-CVE-2023-42364", - "ALPINE-CVE-2023-42365", - "ALPINE-CVE-2023-42366", - "ALPINE-CVE-2024-58251", - "ALPINE-CVE-2025-46394" - ] - }, + }, { "package": { "name": "busybox", @@ -3474,9 +3133,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2023-42363", "ALPINE-CVE-2023-42364", "ALPINE-CVE-2023-42365", @@ -3496,12 +3154,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 13, + "groups": 9, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-2511", "ALPINE-CVE-2024-4603", @@ -3524,12 +3178,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 13, + "groups": 9, "vulnerabilities": [ - "ALPINE-CVE-2022-1292", - "ALPINE-CVE-2022-2068", - "ALPINE-CVE-2023-0466", - "ALPINE-CVE-2023-4807", "ALPINE-CVE-2024-13176", "ALPINE-CVE-2024-2511", "ALPINE-CVE-2024-4603", @@ -3552,9 +3202,8 @@ Scanning local image tarball "./testdata/test-chisel.tar" "index": 0 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "ALPINE-CVE-2021-42376", "ALPINE-CVE-2023-42363", "ALPINE-CVE-2023-42364", "ALPINE-CVE-2023-42365", @@ -3680,31 +3329,31 @@ Scanning local image tarball "./testdata/test-chisel.tar" }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN |1 MANAGER_VERSION=10...", + "command": "|1 MANAGER_VERSION=10.2.4...", "is_empty": false, "base_image_index": 0 } @@ -3757,9 +3406,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 6, + "groups": 5, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -3826,65 +3474,16 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 5, + "groups": 4, "vulnerabilities": [ "USN-7412-1", "USN-7946-1", "UBUNTU-CVE-2022-3219", "UBUNTU-CVE-2025-30258", "UBUNTU-CVE-2025-68973", - "UBUNTU-CVE-2026-57062", "USN-7412-2" ] }, - { - "package": { - "name": "gzip", - "os_package_name": "gzip", - "version": "1.10-4ubuntu4.1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "USN-8512-1", - "UBUNTU-CVE-2026-41991", - "UBUNTU-CVE-2026-41992" - ] - }, - { - "package": { - "name": "acl", - "os_package_name": "libacl1", - "version": "2.3.1-1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 2, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54369", - "UBUNTU-CVE-2026-54370" - ] - }, - { - "package": { - "name": "attr", - "os_package_name": "libattr1", - "version": "1:2.5.1-1build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54371" - ] - }, { "package": { "name": "util-linux", @@ -3895,9 +3494,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4215,9 +3813,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4260,21 +3857,6 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "UBUNTU-CVE-2025-69720" ] }, - { - "package": { - "name": "p11-kit", - "os_package_name": "libp11-kit0", - "version": "0.24.0-6build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-13757" - ] - }, { "package": { "name": "pam", @@ -4387,9 +3969,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4555,9 +4136,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4607,9 +4187,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4678,7 +4257,7 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 14, + "groups": 13, "vulnerabilities": [ "USN-7434-1", "USN-7678-1", @@ -4693,7 +4272,6 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "UBUNTU-CVE-2026-48959", "UBUNTU-CVE-2026-48961", "UBUNTU-CVE-2026-48962", - "UBUNTU-CVE-2026-7017", "UBUNTU-CVE-2026-8376", "UBUNTU-CVE-2026-9538" ] @@ -4726,8 +4304,6 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" }, "groups": 2, "vulnerabilities": [ - "USN-8510-1", - "USN-8477-1", "UBUNTU-CVE-2025-45582", "UBUNTU-CVE-2026-5704" ] @@ -4742,9 +4318,8 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -4752,6 +4327,21 @@ Scanning local image tarball "./testdata/test-node_modules-npm-full.tar" "UBUNTU-CVE-2026-53615", "USN-8091-1" ] + }, + { + "package": { + "name": "zlib", + "os_package_name": "zlib1g", + "version": "1:1.2.11.dfsg-2ubuntu9.2", + "ecosystem": "Ubuntu:22.04", + "image_origin_details": { + "index": 4 + } + }, + "groups": 1, + "vulnerabilities": [ + "UBUNTU-CVE-2026-27171" + ] } ] } @@ -4849,7 +4439,7 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 7 } }, - "groups": 104, + "groups": 102, "vulnerabilities": [ "GO-2022-0477", "GO-2022-0493", @@ -4943,7 +4533,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "GO-2026-4918", "GO-2026-4946", "GO-2026-4947", - "GO-2026-4970", "GO-2026-4971", "GO-2026-4976", "GO-2026-4977", @@ -4953,8 +4542,7 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "GO-2026-4986", "GO-2026-5037", "GO-2026-5038", - "GO-2026-5039", - "GO-2026-5856" + "GO-2026-5039" ] } ] @@ -4975,9 +4563,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 6, + "groups": 5, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5017,22 +4604,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2025-6297" ] }, - { - "package": { - "name": "fzf", - "os_package_name": "fzf", - "version": "0.29.0-1ubuntu0.1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 7 - } - }, - "groups": 2, - "vulnerabilities": [ - "UBUNTU-CVE-2026-53432", - "UBUNTU-CVE-2026-53433" - ] - }, { "package": { "name": "gcc-12", @@ -5060,65 +4631,16 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 5, + "groups": 4, "vulnerabilities": [ "USN-7412-1", "USN-7946-1", "UBUNTU-CVE-2022-3219", "UBUNTU-CVE-2025-30258", "UBUNTU-CVE-2025-68973", - "UBUNTU-CVE-2026-57062", "USN-7412-2" ] }, - { - "package": { - "name": "gzip", - "os_package_name": "gzip", - "version": "1.10-4ubuntu4.1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "USN-8512-1", - "UBUNTU-CVE-2026-41991", - "UBUNTU-CVE-2026-41992" - ] - }, - { - "package": { - "name": "acl", - "os_package_name": "libacl1", - "version": "2.3.1-1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 2, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54369", - "UBUNTU-CVE-2026-54370" - ] - }, - { - "package": { - "name": "attr", - "os_package_name": "libattr1", - "version": "1:2.5.1-1build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-54371" - ] - }, { "package": { "name": "util-linux", @@ -5129,9 +4651,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5449,9 +4970,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5494,21 +5014,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2025-69720" ] }, - { - "package": { - "name": "p11-kit", - "os_package_name": "libp11-kit0", - "version": "0.24.0-6build1", - "ecosystem": "Ubuntu:22.04", - "image_origin_details": { - "index": 4 - } - }, - "groups": 1, - "vulnerabilities": [ - "UBUNTU-CVE-2026-13757" - ] - }, { "package": { "name": "pam", @@ -5621,9 +5126,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5789,9 +5293,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5841,9 +5344,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5912,7 +5414,7 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 14, + "groups": 13, "vulnerabilities": [ "USN-7434-1", "USN-7678-1", @@ -5927,7 +5429,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2026-48959", "UBUNTU-CVE-2026-48961", "UBUNTU-CVE-2026-48962", - "UBUNTU-CVE-2026-7017", "UBUNTU-CVE-2026-8376", "UBUNTU-CVE-2026-9538" ] @@ -5960,8 +5461,6 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" }, "groups": 2, "vulnerabilities": [ - "USN-8510-1", - "USN-8477-1", "UBUNTU-CVE-2025-45582", "UBUNTU-CVE-2026-5704" ] @@ -5976,9 +5475,8 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "index": 4 } }, - "groups": 7, + "groups": 6, "vulnerabilities": [ - "UBUNTU-CVE-2026-13595", "UBUNTU-CVE-2026-27456", "UBUNTU-CVE-2026-53612", "UBUNTU-CVE-2026-53613", @@ -5986,6 +5484,21 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" "UBUNTU-CVE-2026-53615", "USN-8091-1" ] + }, + { + "package": { + "name": "zlib", + "os_package_name": "zlib1g", + "version": "1:1.2.11.dfsg-2ubuntu9.2", + "ecosystem": "Ubuntu:22.04", + "image_origin_details": { + "index": 4 + } + }, + "groups": 1, + "vulnerabilities": [ + "UBUNTU-CVE-2026-27171" + ] } ] } @@ -6037,13 +5550,13 @@ Scanning local image tarball "./testdata/test-ubuntu.tar" }, { "diff_id": "sha256:...", - "command": "COPY ./sample-pkgs/fzf_0.29.0-1ubuntu0.1_amd64.deb /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb # buildkit", + "command": "/bin/sh -c #(nop) COPY file:e099eb298fe3dfbad8c2324167a33e9e74588d4638b7c6563cc931c288ff04b7 in /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb ", "is_empty": false, "base_image_index": 0 }, { "diff_id": "sha256:...", - "command": "RUN /bin/sh -c dpkg -i /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb /u0026/u0026 rm /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb # buildkit", + "command": "/bin/sh -c dpkg -i /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb /u0026/u0026 rm /tmp/fzf_0.29.0-1ubuntu0.1_amd64.deb", "is_empty": false, "base_image_index": 0 } diff --git a/cmd/osv-scanner/scan/image/command_test.go b/cmd/osv-scanner/scan/image/command_test.go index 07b8c895ddb..c7c441e10bc 100644 --- a/cmd/osv-scanner/scan/image/command_test.go +++ b/cmd/osv-scanner/scan/image/command_test.go @@ -235,6 +235,11 @@ func TestCommand_OCIImage(t *testing.T) { Args: []string{"", "image", "--archive", "./testdata/test-ubuntu.tar"}, Exit: 1, }, + { + Name: "Scanning_AlmaLinux_9_image", + Args: []string{"", "image", "--archive", "./testdata/test-almalinux-9.tar"}, + Exit: 1, + }, { Name: "Empty_Ubuntu_22.04_image_tar_with_unimportant_vulns", Args: []string{"", "image", "--all-vulns", "--archive", "./testdata/test-ubuntu.tar"}, @@ -448,6 +453,17 @@ func TestCommand_OCIImage_JSONFormat(t *testing.T) { testutility.AnyDiffID, }, }, + { + Name: "scanning_almalinux_9_image", + Args: []string{"", "image", "--archive", "--format=json", "./testdata/test-almalinux-9.tar"}, + Exit: 1, + ReplaceRules: []testutility.JSONReplaceRule{ + testutility.GroupsAsArrayLen, + testutility.OnlyIDVulnsRule, + testutility.OnlyFirstBaseImage, + testutility.AnyDiffID, + }, + }, { // This tests that the fzf go binary is not being reported because it's a OS package Name: "ubuntu_image_with_go_OS_packages_json", diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml index fabd5f39f6a..bb288ba8ae7 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml @@ -3834,6 +3834,136 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 626 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.15.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "21.2.3" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.16.1.3" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "53.0.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage/Scanning_AlmaLinux_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 867 + body: | + { + "results": [ + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + } + ] + } + headers: + Content-Length: + - "867" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index b64e77f150c..19128145f0f 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -1078,6 +1078,136 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 626 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.15.1" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "21.2.3" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.16.1.3" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "53.0.0" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 867 + body: | + { + "results": [ + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-03-24T01:42:37.905754Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-06-05T12:45:14.124059Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-02-04T03:54:02.259111Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2023-12-06T01:02:35.662444Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + } + ] + } + ] + } + headers: + Content-Length: + - "867" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile b/cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile new file mode 100644 index 00000000000..cdf2e5c1de5 --- /dev/null +++ b/cmd/osv-scanner/scan/image/testdata/test-almalinux-9.Dockerfile @@ -0,0 +1 @@ +FROM almalinux:9.0@sha256:a95a7766fd056b35f72f7b7f7301bcd46e40a6eecd9017e9c41cb4bf22ecb28b From f995ea597887509fbf5ad3e0c2ed977658a6cd25 Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Thu, 18 Jun 2026 20:13:49 +0700 Subject: [PATCH 2/4] cmd/osv-scanner: fix AlmaLinux image scanning to detect ALSA vulnerabilities MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two root causes were found that prevented ALSA advisories from being detected when scanning AlmaLinux container images: 1. RPM extractor was missing from the "artifact" preset (presets.go): The image scan uses the "artifact" extractor preset which included apk (Alpine), dpkg (Debian/Ubuntu), chisel, and homebrew — but NOT the rpm extractor. This caused all RPM packages (curl-minimal, openssl, bash, etc.) from AlmaLinux images to be completely ignored. 2. AlmaLinux ecosystem suffix was using full VERSION_ID instead of major only: /etc/os-release in almalinux:9.0 sets VERSION_ID="9.0", producing ecosystem "AlmaLinux:9.0". OSV.dev keys ALSA advisories by major version only ("AlmaLinux:9"), so zero advisories were matched. This is fixed upstream in google/osv-scalibr#2250; this PR includes a go.mod replace directive to pick up that fix while the upstream PR is reviewed. With both fixes applied, scanning almalinux:9.0 now correctly produces: AlmaLinux:9 | 68 packages | 282 known vulnerabilities from 2 ecosystems curl-minimal 7.76.1-14.el9_0.5 → 12 vulnerabilities including ALSA advisories Fixes google/osv-scanner#2870 (responds to @michaelkedar review) Depends on google/osv-scalibr#2250 (ecosystem suffix trim) --- .../image/__snapshots__/command_test.snap | 191 +- .../cassettes/TestCommand_OCIImage.yaml | 4228 ++++++++++++----- .../TestCommand_OCIImage_JSONFormat.yaml | 130 - go.mod | 1 + go.sum | 4 +- internal/scalibrplugin/presets.go | 3 + 6 files changed, 3335 insertions(+), 1222 deletions(-) diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap index 38f71c75cce..ba119984276 100755 --- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap @@ -571,25 +571,103 @@ failed to load image from tarball with path "../../testdata/locks-manyoci-image/ [TestCommand_OCIImage/Scanning_AlmaLinux_9_image - 1] Scanning local image tarball "./testdata/test-almalinux-9.tar" -Total 2 packages affected by 9 known vulnerabilities (0 Critical, 3 High, 5 Medium, 1 Low, 0 Unknown) from 1 ecosystem. -9 vulnerabilities can be fixed. - -+-------------------------------------+------+-----------+------------+---------+---------------+-------------------------------------------------------------+ -| OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE | -+-------------------------------------+------+-----------+------------+---------+---------------+-------------------------------------------------------------+ -| https://osv.dev/PYSEC-2023-228 | 6.8 | PyPI | pip | 21.2.3 | 23.3 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | -| https://osv.dev/GHSA-mq26-g339-26xf | | | | | | | -| https://osv.dev/PYSEC-2026-196 | 5.5 | PyPI | pip | 21.2.3 | 26.1.2 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | -| https://osv.dev/GHSA-4xh5-x5gv-qwph | 5.9 | PyPI | pip | 21.2.3 | 25.3 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | -| https://osv.dev/GHSA-58qw-9mgm-455v | 4.6 | PyPI | pip | 21.2.3 | 26.1 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | -| https://osv.dev/GHSA-6vgw-5pg2-w6jp | 2.0 | PyPI | pip | 21.2.3 | 26.0 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | -| https://osv.dev/GHSA-jp4c-xjxw-mgf9 | 5.3 | PyPI | pip | 21.2.3 | 26.1 | usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | -| https://osv.dev/PYSEC-2022-43012 | 8.7 | PyPI | setuptools | 53.0.0 | 65.5.1 | usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | -| https://osv.dev/GHSA-r9hx-vwmv-q579 | | | | | | | -| https://osv.dev/PYSEC-2025-49 | 8.8 | PyPI | setuptools | 53.0.0 | 78.1.1 | usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | -| https://osv.dev/GHSA-5rjg-fvgr-3xxf | | | | | | | -| https://osv.dev/GHSA-cx63-2mw6-8hw5 | 8.8 | PyPI | setuptools | 53.0.0 | 70.0.0 | usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | -+-------------------------------------+------+-----------+------------+---------+---------------+-------------------------------------------------------------+ + +Container Scanning Result (AlmaLinux 9.0 (Emerald Puma)) (Based on "almalinux" image): +Total 68 packages affected by 282 known vulnerabilities (0 Critical, 3 High, 5 Medium, 1 Low, 273 Unknown) from 2 ecosystems. +282 vulnerabilities can be fixed. + + +AlmaLinux:9 ++----------------------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/var/lib/rpm/rpmdb.sqlite | ++--------------------------+---------------------+---------------+------------+-----------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++--------------------------+---------------------+---------------+------------+-----------------------------+------------------+---------------+ +| bash | 5.1.8-4.el9 | Fix Available | 1 | bash | # 0 Layer | almalinux | +| binutils | 2.35.2-17.el9 | Fix Available | 2 | binutils | # 0 Layer | almalinux | +| binutils-gold | 2.35.2-17.el9 | Fix Available | 2 | binutils-gold | # 0 Layer | almalinux | +| bzip2-libs | 1.0.8-8.el9 | Fix Available | 1 | bzip2-libs | # 0 Layer | almalinux | +| curl-minimal | 7.76.1-14.el9_0.5 | Fix Available | 12 | curl-minimal | # 0 Layer | almalinux | +| dbus | 1.12.20-5.el9 | Fix Available | 2 | dbus | # 0 Layer | almalinux | +| dbus-common | 1.12.20-5.el9 | Fix Available | 2 | dbus-common | # 0 Layer | almalinux | +| expat | 2.2.10-12.el9_0.3 | Fix Available | 8 | expat | # 0 Layer | almalinux | +| file-libs | 5.39-8.el9 | Fix Available | 1 | file-libs | # 0 Layer | almalinux | +| glib2 | 2.68.4-5.el9 | Fix Available | 6 | glib2 | # 0 Layer | almalinux | +| glibc | 2.34-28.el9_0.2 | Fix Available | 6 | glibc | # 0 Layer | almalinux | +| glibc-common | 2.34-28.el9_0.2 | Fix Available | 6 | glibc-common | # 0 Layer | almalinux | +| glibc-minimal-langpack | 2.34-28.el9_0.2 | Fix Available | 6 | glibc-minimal-langpa... (1) | # 0 Layer | almalinux | +| gmp | 6.2.0-10.el9 | Fix Available | 1 | gmp | # 0 Layer | almalinux | +| gnupg2 | 2.3.3-2.el9_0 | Fix Available | 1 | gnupg2 | # 0 Layer | almalinux | +| gnutls | 3.7.6-12.el9_0 | Fix Available | 7 | gnutls | # 0 Layer | almalinux | +| iputils | 20210202-7.el9 | Fix Available | 2 | iputils | # 0 Layer | almalinux | +| krb5-libs | 1.19.1-15.el9_0 | Fix Available | 9 | krb5-libs | # 0 Layer | almalinux | +| less | 590-1.el9_0 | Fix Available | 3 | less | # 0 Layer | almalinux | +| libarchive | 3.5.3-2.el9_0 | Fix Available | 5 | libarchive | # 0 Layer | almalinux | +| libblkid | 2.37.4-3.el9 | Fix Available | 1 | libblkid | # 0 Layer | almalinux | +| libcap | 2.48-8.el9 | Fix Available | 3 | libcap | # 0 Layer | almalinux | +| libcom_err | 1.46.5-2.el9 | Fix Available | 1 | libcom_err | # 0 Layer | almalinux | +| libcurl-minimal | 7.76.1-14.el9_0.5 | Fix Available | 12 | libcurl-minimal | # 0 Layer | almalinux | +| libeconf | 0.4.1-2.el9 | Fix Available | 1 | libeconf | # 0 Layer | almalinux | +| libfdisk | 2.37.4-3.el9 | Fix Available | 1 | libfdisk | # 0 Layer | almalinux | +| libgcc | 11.2.1-9.4.el9.alma | Fix Available | 1 | libgcc | # 0 Layer | almalinux | +| libgcrypt | 1.10.0-5.el9_0 | Fix Available | 1 | libgcrypt | # 0 Layer | almalinux | +| libgomp | 11.2.1-9.4.el9.alma | Fix Available | 1 | libgomp | # 0 Layer | almalinux | +| libksba | 1.5.1-5.el9_0 | Fix Available | 1 | libksba | # 0 Layer | almalinux | +| libmount | 2.37.4-3.el9 | Fix Available | 1 | libmount | # 0 Layer | almalinux | +| libnghttp2 | 1.43.0-5.el9 | Fix Available | 4 | libnghttp2 | # 0 Layer | almalinux | +| libsmartcols | 2.37.4-3.el9 | Fix Available | 1 | libsmartcols | # 0 Layer | almalinux | +| libstdc++ | 11.2.1-9.4.el9.alma | Fix Available | 1 | libstdc++ | # 0 Layer | almalinux | +| libtasn1 | 4.16.0-7.el9 | Fix Available | 2 | libtasn1 | # 0 Layer | almalinux | +| libuuid | 2.37.4-3.el9 | Fix Available | 1 | libuuid | # 0 Layer | almalinux | +| libxml2 | 2.9.13-1.el9_0.1 | Fix Available | 10 | libxml2 | # 0 Layer | almalinux | +| lua-libs | 5.4.2-4.el9 | Fix Available | 3 | lua-libs | # 0 Layer | almalinux | +| ncurses-base | 6.2-8.20210508.el9 | Fix Available | 1 | ncurses-base | # 0 Layer | almalinux | +| ncurses-libs | 6.2-8.20210508.el9 | Fix Available | 1 | ncurses-libs | # 0 Layer | almalinux | +| openssl | 3.0.1-43.el9_0 | Fix Available | 15 | openssl | # 0 Layer | almalinux | +| openssl-libs | 3.0.1-43.el9_0 | Fix Available | 15 | openssl-libs | # 0 Layer | almalinux | +| p11-kit | 0.24.1-2.el9 | Fix Available | 1 | p11-kit | # 0 Layer | almalinux | +| p11-kit-trust | 0.24.1-2.el9 | Fix Available | 1 | p11-kit-trust | # 0 Layer | almalinux | +| pam | 1.5.1-9.el9_0.1 | Fix Available | 5 | pam | # 0 Layer | almalinux | +| python3 | 3.9.10-2.el9 | Fix Available | 24 | python3 | # 0 Layer | almalinux | +| python3-libs | 3.9.10-2.el9 | Fix Available | 24 | python3-libs | # 0 Layer | almalinux | +| python3-pip-wheel | 21.2.3-6.el9 | Fix Available | 1 | python3-pip-wheel | # 0 Layer | almalinux | +| python3-rpm | 4.16.1.3-12.el9_0 | Fix Available | 1 | python3-rpm | # 0 Layer | almalinux | +| python3-setuptools-wheel | 53.0.0-10.el9 | Fix Available | 3 | python3-setuptools-w... (1) | # 0 Layer | almalinux | +| rpm | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm | # 0 Layer | almalinux | +| rpm-build-libs | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm-build-libs | # 0 Layer | almalinux | +| rpm-libs | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm-libs | # 0 Layer | almalinux | +| rpm-sign-libs | 4.16.1.3-12.el9_0 | Fix Available | 1 | rpm-sign-libs | # 0 Layer | almalinux | +| shadow-utils | 4.9-3.el9 | Fix Available | 2 | shadow-utils | # 0 Layer | almalinux | +| sqlite-libs | 3.34.1-5.el9 | Fix Available | 4 | sqlite-libs | # 0 Layer | almalinux | +| systemd | 250-6.el9_0.1 | Fix Available | 6 | systemd | # 0 Layer | almalinux | +| systemd-libs | 250-6.el9_0.1 | Fix Available | 6 | systemd-libs | # 0 Layer | almalinux | +| systemd-pam | 250-6.el9_0.1 | Fix Available | 6 | systemd-pam | # 0 Layer | almalinux | +| systemd-rpm-macros | 250-6.el9_0.1 | Fix Available | 6 | systemd-rpm-macros | # 0 Layer | almalinux | +| tar | 1.34-3.el9 | Fix Available | 2 | tar | # 0 Layer | almalinux | +| tpm2-tss | 3.0.3-7.el9 | Fix Available | 1 | tpm2-tss | # 0 Layer | almalinux | +| util-linux | 2.37.4-3.el9 | Fix Available | 1 | util-linux | # 0 Layer | almalinux | +| util-linux-core | 2.37.4-3.el9 | Fix Available | 1 | util-linux-core | # 0 Layer | almalinux | +| vim-minimal | 8.2.2637-16.el9_0.3 | Fix Available | 12 | vim-minimal | # 0 Layer | almalinux | +| zlib | 1.2.11-31.el9_0.1 | Fix Available | 1 | zlib | # 0 Layer | almalinux | ++--------------------------+---------------------+---------------+------------+-----------------------------+------------------+---------------+ +PyPI ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/share/python3-wheels/pip-21.2.3-py3-none-any.whl | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| pip | 21.2.3 | Fix Available | 6 | # 0 Layer | almalinux | ++---------+-------------------+---------------+------------+------------------+---------------+ ++------------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/share/python3-wheels/setuptools-53.0.0-py3-none-any.whl | ++------------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++------------+-------------------+---------------+------------+------------------+---------------+ +| setuptools | 53.0.0 | Fix Available | 3 | # 0 Layer | almalinux | ++------------+-------------------+---------------+------------+------------------+---------------+ + +For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. +You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. --- @@ -655,8 +733,8 @@ Scanning local image tarball "./testdata/test-java-full.tar" Container Scanning Result (Alpine Linux v3.21) (Based on "eclipse-temurin" image): -Total 35 packages affected by 136 known vulnerabilities (6 Critical, 66 High, 56 Medium, 7 Low, 1 Unknown) from 2 ecosystems. -136 vulnerabilities can be fixed. +Total 36 packages affected by 138 known vulnerabilities (6 Critical, 68 High, 56 Medium, 7 Low, 1 Unknown) from 2 ecosystems. +138 vulnerabilities can be fixed. Maven @@ -690,6 +768,7 @@ Maven | org.apache.commons:commons-configuration2 | 2.8.0 | Fix Available | 3 | # 12 Layer | -- | | org.apache.commons:commons-lang3 | 3.12.0 | Fix Available | 1 | # 12 Layer | -- | | org.eclipse.jetty:jetty-http | 9.4.53.v20231009 | Fix Available | 3 | # 12 Layer | -- | +| org.jline:jline-remote-telnet | 3.9.0 | Fix Available | 2 | # 12 Layer | -- | +-------------------------------------------+-------------------+---------------+------------+------------------+---------------+ Alpine:v3.21 +-----------------------------------------------------------------------------------------------------------------------------------+ @@ -1085,6 +1164,76 @@ You can also view the full vulnerability list in your terminal with: `osv-scanne --- +[TestCommand_OCIImage/scanning_insecure_chiseled_ubuntu_image - 1] +Scanning local image tarball "./testdata/test-chisel.tar" + + +Container Scanning Result (Ubuntu 26.04 LTS): +Total 7 packages affected by 121 known vulnerabilities (0 Critical, 0 High, 1 Medium, 0 Low, 120 Unknown) from 2 ecosystems. +120 vulnerabilities can be fixed. + + +Go ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/lib/go-1.25/bin/go | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | ++---------+-------------------+---------------+------------+------------------+---------------+ ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/lib/go-1.25/bin/gofmt | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | ++---------+-------------------+---------------+------------+------------------+---------------+ ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/asm | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | ++---------+-------------------+---------------+------------+------------------+---------------+ ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/compile | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | ++---------+-------------------+---------------+------------+------------------+---------------+ ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/link | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | ++---------+-------------------+---------------+------------+------------------+---------------+ ++---------------------------------------------------------------------------------------------+ +| Source:artifact:/usr/lib/go-1.25/pkg/tool/linux_amd64/vet | ++---------+-------------------+---------------+------------+------------------+---------------+ +| PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | INTRODUCED LAYER | IN BASE IMAGE | ++---------+-------------------+---------------+------------+------------------+---------------+ +| stdlib | 1.25.7 | Fix Available | 20 | # 0 Layer | -- | ++---------+-------------------+---------------+------------+------------------+---------------+ +Ubuntu:26.04 ++-------------------------------------------------------------------------------------------------------------------------------------------+ +| Source:os:/var/lib/chisel/manifest.wall | ++----------------+-----------------------------+------------------+------------+-------------------------+------------------+---------------+ +| SOURCE PACKAGE | INSTALLED VERSION | FIX AVAILABLE | VULN COUNT | BINARY PACKAGES (COUNT) | INTRODUCED LAYER | IN BASE IMAGE | ++----------------+-----------------------------+------------------+------------+-------------------------+------------------+---------------+ +| coreutils | 9.5-1ubuntu2+0.0.0~ubuntu25 | No fix available | 1 | coreutils | # 0 Layer | -- | ++----------------+-----------------------------+------------------+------------+-------------------------+------------------+---------------+ + +For the most comprehensive scan results, we recommend using the HTML output: `osv-scanner scan image --serve `. +You can also view the full vulnerability list in your terminal with: `osv-scanner scan image --format vertical `. + +--- + +[TestCommand_OCIImage/scanning_insecure_chiseled_ubuntu_image - 2] + +--- + [TestCommand_OCIImage/scanning_node_modules_using_npm_with_no_packages - 1] Scanning local image tarball "./testdata/test-node_modules-npm-empty.tar" diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml index bb288ba8ae7..a5f7ef6f937 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage.yaml @@ -100,7 +100,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 3738 + content_length: 4733 body: | { "results": [ @@ -108,6 +108,10 @@ interactions: {}, { "vulns": [ + { + "id": "ALPINE-CVE-2021-30139", + "modified": "2026-06-15T18:18:08.714073Z" + }, { "id": "ALPINE-CVE-2021-36159", "modified": "2026-06-15T18:18:08.746967Z" @@ -116,37 +120,37 @@ interactions: }, { "vulns": [ + { + "id": "ALPINE-CVE-2021-28831", + "modified": "2026-06-15T18:18:08.705695Z" + }, { "id": "ALPINE-CVE-2021-42374", - "modified": "2026-07-08T04:31:02.060256Z" + "modified": "2026-06-15T18:18:08.840660Z" }, { "id": "ALPINE-CVE-2021-42375", "modified": "2026-06-15T18:18:08.840395Z" }, - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2021-42378", - "modified": "2026-07-08T04:31:06.769201Z" + "modified": "2026-06-15T18:18:08.841880Z" }, { "id": "ALPINE-CVE-2021-42379", - "modified": "2026-07-08T04:32:19.104411Z" + "modified": "2026-06-15T18:18:08.842644Z" }, { "id": "ALPINE-CVE-2021-42380", - "modified": "2026-07-08T04:31:00.322675Z" + "modified": "2026-06-15T18:18:08.841997Z" }, { "id": "ALPINE-CVE-2021-42381", - "modified": "2026-07-08T04:32:10.785299Z" + "modified": "2026-06-15T18:18:08.834974Z" }, { "id": "ALPINE-CVE-2021-42382", - "modified": "2026-07-08T04:32:12.046933Z" + "modified": "2026-06-15T18:18:08.835028Z" }, { "id": "ALPINE-CVE-2021-42383", @@ -154,15 +158,15 @@ interactions: }, { "id": "ALPINE-CVE-2021-42384", - "modified": "2026-07-08T04:31:06.790570Z" + "modified": "2026-06-15T18:18:08.836234Z" }, { "id": "ALPINE-CVE-2021-42385", - "modified": "2026-07-08T04:32:19.172204Z" + "modified": "2026-06-15T18:18:08.836953Z" }, { "id": "ALPINE-CVE-2021-42386", - "modified": "2026-07-08T04:31:06.765274Z" + "modified": "2026-06-15T18:18:08.836828Z" }, { "id": "ALPINE-CVE-2022-28391", @@ -200,11 +204,11 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2021-3711", - "modified": "2026-07-08T04:31:24.043051Z" + "modified": "2026-06-15T18:18:08.770439Z" }, { "id": "ALPINE-CVE-2021-3712", - "modified": "2026-07-08T04:31:02.195219Z" + "modified": "2026-06-15T18:18:08.771464Z" }, { "id": "ALPINE-CVE-2021-4044", @@ -212,63 +216,111 @@ interactions: }, { "id": "ALPINE-CVE-2022-0778", - "modified": "2026-07-08T04:31:46.947012Z" + "modified": "2026-06-15T18:18:09.135371Z" + }, + { + "id": "ALPINE-CVE-2022-1343", + "modified": "2026-06-15T18:18:09.138212Z" }, { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" + "id": "ALPINE-CVE-2022-1434", + "modified": "2026-06-15T18:18:09.138825Z" }, { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" + "id": "ALPINE-CVE-2022-1473", + "modified": "2026-06-15T18:18:09.138856Z" }, { "id": "ALPINE-CVE-2022-2097", - "modified": "2026-07-08T04:32:01.661758Z" + "modified": "2026-06-15T18:18:09.146422Z" + }, + { + "id": "ALPINE-CVE-2022-3358", + "modified": "2026-06-15T18:18:09.390102Z" + }, + { + "id": "ALPINE-CVE-2022-3602", + "modified": "2026-06-15T18:18:09.517800Z" + }, + { + "id": "ALPINE-CVE-2022-3786", + "modified": "2026-06-15T18:18:09.522195Z" + }, + { + "id": "ALPINE-CVE-2022-3996", + "modified": "2026-06-15T18:18:09.525255Z" + }, + { + "id": "ALPINE-CVE-2022-4203", + "modified": "2026-06-15T18:18:09.533823Z" }, { "id": "ALPINE-CVE-2022-4304", - "modified": "2026-07-08T04:32:21.270247Z" + "modified": "2026-06-15T18:18:09.620489Z" }, { "id": "ALPINE-CVE-2022-4450", - "modified": "2026-07-08T04:32:21.375815Z" + "modified": "2026-06-15T18:18:09.672426Z" }, { "id": "ALPINE-CVE-2023-0215", - "modified": "2026-07-08T04:32:27.003292Z" + "modified": "2026-06-15T18:18:09.698845Z" + }, + { + "id": "ALPINE-CVE-2023-0216", + "modified": "2026-06-15T18:18:09.699437Z" + }, + { + "id": "ALPINE-CVE-2023-0217", + "modified": "2026-06-15T18:18:09.699949Z" }, { "id": "ALPINE-CVE-2023-0286", - "modified": "2026-07-08T04:31:25.525715Z" + "modified": "2026-06-15T18:18:09.700482Z" + }, + { + "id": "ALPINE-CVE-2023-0401", + "modified": "2026-06-15T18:18:09.701357Z" }, { "id": "ALPINE-CVE-2023-0464", - "modified": "2026-07-08T04:31:25.527188Z" + "modified": "2026-06-15T18:18:09.705418Z" }, { "id": "ALPINE-CVE-2023-0465", - "modified": "2026-07-08T04:31:25.554087Z" + "modified": "2026-06-15T18:18:09.706166Z" }, { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" + "id": "ALPINE-CVE-2023-1255", + "modified": "2026-06-15T18:18:09.827455Z" }, { "id": "ALPINE-CVE-2023-2650", - "modified": "2026-07-08T04:32:01.995144Z" + "modified": "2026-06-15T18:18:09.897706Z" + }, + { + "id": "ALPINE-CVE-2023-2975", + "modified": "2026-06-15T18:18:09.910135Z" }, { "id": "ALPINE-CVE-2023-3446", "modified": "2026-06-15T18:18:09.921734Z" }, { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" + "id": "ALPINE-CVE-2023-3817", + "modified": "2026-06-15T18:18:09.950857Z" + }, + { + "id": "ALPINE-CVE-2023-5363", + "modified": "2026-06-15T18:18:10.091465Z" }, { "id": "ALPINE-CVE-2023-5678", - "modified": "2026-07-08T04:32:27.736265Z" + "modified": "2026-06-15T18:18:10.107790Z" + }, + { + "id": "ALPINE-CVE-2023-6129", + "modified": "2026-06-15T18:18:10.151147Z" }, { "id": "ALPINE-CVE-2023-6237", @@ -276,7 +328,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-0727", - "modified": "2026-07-08T04:32:27.704640Z" + "modified": "2026-06-15T18:18:10.233116Z" }, { "id": "ALPINE-CVE-2024-13176", @@ -298,6 +350,10 @@ interactions: "id": "ALPINE-CVE-2024-5535", "modified": "2026-06-15T18:18:10.502278Z" }, + { + "id": "ALPINE-CVE-2024-6119", + "modified": "2026-06-15T18:18:10.508459Z" + }, { "id": "ALPINE-CVE-2024-9143", "modified": "2026-06-15T18:18:10.531917Z" @@ -309,7 +365,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2019-14697", - "modified": "2026-07-08T04:30:41.388027Z" + "modified": "2026-06-09T21:31:30.348443Z" }, { "id": "ALPINE-CVE-2020-28928", @@ -317,7 +373,7 @@ interactions: }, { "id": "ALPINE-CVE-2025-26519", - "modified": "2026-07-08T04:32:24.548042Z" + "modified": "2026-06-15T18:18:10.600004Z" } ] }, @@ -326,7 +382,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2018-25032", - "modified": "2026-07-08T04:30:24.690369Z" + "modified": "2026-06-09T21:31:29.987152Z" }, { "id": "ALPINE-CVE-2022-37434", @@ -338,7 +394,7 @@ interactions: } headers: Content-Length: - - "3738" + - "4733" Content-Type: - application/json status: 200 OK @@ -348,7 +404,7 @@ interactions: proto: HTTP/1.1 proto_major: 1 proto_minor: 1 - content_length: 5113 + content_length: 5650 host: api.osv.dev body: | { @@ -437,6 +493,13 @@ interactions: }, "version": "3.4-1" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "gzip" + }, + "version": "1.10-0ubuntu4.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -451,6 +514,20 @@ interactions: }, "version": "1.57" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "acl" + }, + "version": "2.2.53-6" + }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "attr" + }, + "version": "1:2.4.48-5" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -521,6 +598,13 @@ interactions: }, "version": "2.2.0-2" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "p11-kit" + }, + "version": "0.23.20-1ubuntu0.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -625,7 +709,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 205 + content_length: 217 body: | { "results": [ @@ -653,6 +737,10 @@ interactions: {}, {}, {}, + {}, + {}, + {}, + {}, { "vulns": [ { @@ -677,7 +765,7 @@ interactions: } headers: Content-Length: - - "205" + - "217" Content-Type: - application/json status: 200 OK @@ -687,7 +775,7 @@ interactions: proto: HTTP/1.1 proto_major: 1 proto_minor: 1 - content_length: 5113 + content_length: 5650 host: api.osv.dev body: | { @@ -776,6 +864,13 @@ interactions: }, "version": "3.4-1" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "gzip" + }, + "version": "1.10-0ubuntu4.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -790,6 +885,20 @@ interactions: }, "version": "1.57" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "acl" + }, + "version": "2.2.53-6" + }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "attr" + }, + "version": "1:2.4.48-5" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -860,6 +969,13 @@ interactions: }, "version": "2.2.0-2" }, + { + "package": { + "ecosystem": "Ubuntu:20.04", + "name": "p11-kit" + }, + "version": "0.23.20-1ubuntu0.1" + }, { "package": { "ecosystem": "Ubuntu:20.04", @@ -964,7 +1080,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 205 + content_length: 217 body: | { "results": [ @@ -992,6 +1108,10 @@ interactions: {}, {}, {}, + {}, + {}, + {}, + {}, { "vulns": [ { @@ -1016,7 +1136,7 @@ interactions: } headers: Content-Length: - - "205" + - "217" Content-Type: - application/json status: 200 OK @@ -1541,7 +1661,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 12798 + content_length: 11969 body: | { "results": [ @@ -1552,10 +1672,6 @@ interactions: {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -1638,10 +1754,6 @@ interactions: "id": "UBUNTU-CVE-2025-68973", "modified": "2026-02-05T00:30:28.335358Z" }, - { - "id": "UBUNTU-CVE-2026-57062", - "modified": "2026-06-29T18:15:10.272222Z" - }, { "id": "USN-7412-1", "modified": "2026-02-10T04:47:47Z" @@ -1652,56 +1764,19 @@ interactions: }, { "id": "USN-7946-1", - "modified": "2026-06-25T13:32:31.788231Z" + "modified": "2026-05-20T16:03:55.565581Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-41991", - "modified": "2026-07-06T20:30:58.394348Z" - }, - { - "id": "UBUNTU-CVE-2026-41992", - "modified": "2026-07-06T20:30:59.127897Z" - }, - { - "id": "USN-8512-1", - "modified": "2026-07-06T20:44:29.397826Z" - } - ] - }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54369", - "modified": "2026-07-01T21:27:56Z" - }, - { - "id": "UBUNTU-CVE-2026-54370", - "modified": "2026-07-01T21:27:56Z" - } - ] - }, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54371", - "modified": "2026-07-06T20:31:13.100309Z" - } - ] - }, + {}, + {}, + {}, {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -1740,7 +1815,7 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2016-20013", - "modified": "2026-07-08T22:45:12.334407Z" + "modified": "2026-06-01T15:45:11.069074Z" }, { "id": "UBUNTU-CVE-2025-0395", @@ -1784,7 +1859,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-6238", - "modified": "2026-06-24T11:00:25.318641Z" + "modified": "2026-05-29T19:15:06.810342Z" }, { "id": "USN-7259-1", @@ -1800,7 +1875,7 @@ interactions: }, { "id": "USN-8005-1", - "modified": "2026-06-25T13:32:31.787765Z" + "modified": "2026-05-20T16:03:57.629529Z" } ] }, @@ -1809,11 +1884,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-1390", - "modified": "2026-06-23T22:00:07.953148Z" + "modified": "2026-04-22T15:31:21.010462Z" }, { "id": "UBUNTU-CVE-2026-4878", - "modified": "2026-06-24T02:29:23.557692Z" + "modified": "2026-04-29T11:29:22.138592Z" }, { "id": "USN-7287-1", @@ -1833,11 +1908,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-2236", - "modified": "2026-07-01T23:40:15.314704Z" + "modified": "2026-06-02T14:00:10.803243Z" }, { "id": "UBUNTU-CVE-2026-41989", - "modified": "2026-06-26T19:30:06.785492Z" + "modified": "2026-06-02T14:00:20.958338Z" }, { "id": "USN-8319-1", @@ -1850,11 +1925,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-12243", - "modified": "2026-07-06T20:44:27.631542Z" + "modified": "2026-04-22T14:37:38.949616Z" }, { "id": "UBUNTU-CVE-2025-14831", - "modified": "2026-07-06T20:44:29.080707Z" + "modified": "2026-05-11T10:46:40.301990Z" }, { "id": "UBUNTU-CVE-2025-32988", @@ -1874,55 +1949,55 @@ interactions: }, { "id": "UBUNTU-CVE-2025-9820", - "modified": "2026-07-06T20:44:29.852110Z" + "modified": "2026-05-11T10:40:33.804944Z" }, { "id": "UBUNTU-CVE-2026-33845", - "modified": "2026-07-06T20:44:27.233455Z" + "modified": "2026-06-02T12:00:06.980060Z" }, { "id": "UBUNTU-CVE-2026-33846", - "modified": "2026-07-06T20:44:28.879211Z" + "modified": "2026-06-02T12:00:06.967548Z" }, { "id": "UBUNTU-CVE-2026-3832", - "modified": "2026-06-30T03:45:07.126536Z" + "modified": "2026-06-02T12:00:06.982846Z" }, { "id": "UBUNTU-CVE-2026-3833", - "modified": "2026-07-06T20:44:29.145695Z" + "modified": "2026-06-02T12:00:06.885767Z" }, { "id": "UBUNTU-CVE-2026-42009", - "modified": "2026-07-06T20:44:28.218328Z" + "modified": "2026-06-02T12:00:08.420027Z" }, { "id": "UBUNTU-CVE-2026-42010", - "modified": "2026-07-06T20:44:27.505571Z" + "modified": "2026-06-02T12:00:08.351396Z" }, { "id": "UBUNTU-CVE-2026-42011", - "modified": "2026-07-06T16:02:54.226888Z" + "modified": "2026-06-02T12:00:08.463825Z" }, { "id": "UBUNTU-CVE-2026-42012", - "modified": "2026-07-06T16:02:54.199597Z" + "modified": "2026-06-02T12:00:08.689551Z" }, { "id": "UBUNTU-CVE-2026-42013", - "modified": "2026-07-06T16:02:54.272277Z" + "modified": "2026-06-02T12:00:08.530311Z" }, { "id": "UBUNTU-CVE-2026-42014", - "modified": "2026-07-06T16:02:52.889534Z" + "modified": "2026-06-17T11:01:28.854907Z" }, { "id": "UBUNTU-CVE-2026-42015", - "modified": "2026-07-06T16:02:53.058495Z" + "modified": "2026-06-02T12:00:08.586508Z" }, { "id": "UBUNTU-CVE-2026-5260", - "modified": "2026-07-06T20:44:27.171088Z" + "modified": "2026-06-02T12:00:09.990926Z" }, { "id": "USN-7281-1", @@ -1975,15 +2050,15 @@ interactions: }, { "id": "UBUNTU-CVE-2026-40355", - "modified": "2026-07-09T21:30:58.285031Z" + "modified": "2026-05-29T10:45:29.205811Z" }, { "id": "UBUNTU-CVE-2026-40356", - "modified": "2026-07-09T21:30:58.537034Z" + "modified": "2026-05-29T10:45:29.281566Z" }, { "id": "USN-7257-1", - "modified": "2026-06-25T13:32:30.106589Z" + "modified": "2026-05-20T16:03:28.032877Z" }, { "id": "USN-7314-1", @@ -1991,7 +2066,7 @@ interactions: }, { "id": "USN-7542-1", - "modified": "2026-06-25T13:32:30.616782Z" + "modified": "2026-05-20T16:03:46.356475Z" } ] }, @@ -2022,27 +2097,20 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-50495", - "modified": "2026-07-02T22:45:21.903948Z" + "modified": "2026-04-22T14:15:03.155150Z" }, { "id": "UBUNTU-CVE-2025-6141", - "modified": "2026-07-07T21:03:19.257825Z" + "modified": "2026-04-22T16:08:19.927561Z" }, { "id": "UBUNTU-CVE-2025-69720", - "modified": "2026-07-08T18:30:10.365748Z" + "modified": "2026-04-22T16:13:35.392426Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-13757", - "modified": "2026-07-01T21:19:39Z" - } - ] - }, + {}, { "vulns": [ { @@ -2055,7 +2123,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-54411", - "modified": "2026-06-24T09:03:12Z" + "modified": "2026-06-17T11:02:56.948731Z" }, { "id": "USN-7580-1", @@ -2092,7 +2160,7 @@ interactions: }, { "id": "UBUNTU-CVE-2024-41996", - "modified": "2026-07-08T22:45:14.910732Z" + "modified": "2026-06-16T13:30:41.910018Z" }, { "id": "UBUNTU-CVE-2024-9143", @@ -2100,7 +2168,7 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15467", - "modified": "2026-07-08T22:45:12.561148Z" + "modified": "2026-06-18T04:30:07.553679Z" }, { "id": "UBUNTU-CVE-2025-27587", @@ -2108,15 +2176,15 @@ interactions: }, { "id": "UBUNTU-CVE-2025-68160", - "modified": "2026-07-08T22:45:11.201806Z" + "modified": "2026-05-20T16:23:45.899710Z" }, { "id": "UBUNTU-CVE-2025-69418", - "modified": "2026-07-08T22:45:10.238757Z" + "modified": "2026-05-20T16:23:51.325414Z" }, { "id": "UBUNTU-CVE-2025-69419", - "modified": "2026-07-08T22:45:10.652331Z" + "modified": "2026-05-20T16:23:51.080907Z" }, { "id": "UBUNTU-CVE-2025-69420", @@ -2136,71 +2204,71 @@ interactions: }, { "id": "UBUNTU-CVE-2026-22796", - "modified": "2026-07-08T22:45:13.369897Z" + "modified": "2026-05-20T16:24:15.294811Z" }, { "id": "UBUNTU-CVE-2026-28387", - "modified": "2026-07-08T22:45:14.045974Z" + "modified": "2026-05-20T16:24:53.583373Z" }, { "id": "UBUNTU-CVE-2026-28388", - "modified": "2026-07-08T22:45:13.947607Z" + "modified": "2026-05-20T16:24:55.415353Z" }, { "id": "UBUNTU-CVE-2026-28389", - "modified": "2026-07-08T22:45:14.128002Z" + "modified": "2026-05-20T16:24:55.036642Z" }, { "id": "UBUNTU-CVE-2026-28390", - "modified": "2026-07-08T22:45:14.501164Z" + "modified": "2026-05-20T16:24:54.756018Z" }, { "id": "UBUNTU-CVE-2026-31789", - "modified": "2026-07-08T22:45:08.612244Z" + "modified": "2026-06-16T13:30:43.522021Z" }, { "id": "UBUNTU-CVE-2026-31790", - "modified": "2026-07-08T22:45:15.194189Z" + "modified": "2026-06-16T13:30:47.743687Z" }, { "id": "UBUNTU-CVE-2026-34180", - "modified": "2026-07-08T22:45:16.182260Z" + "modified": "2026-06-17T16:15:20.130456Z" }, { "id": "UBUNTU-CVE-2026-34182", - "modified": "2026-07-08T22:45:16.771546Z" + "modified": "2026-06-17T16:15:21.278388Z" }, { "id": "UBUNTU-CVE-2026-42766", - "modified": "2026-07-08T22:45:18.180633Z" + "modified": "2026-06-17T16:15:12.063144Z" }, { "id": "UBUNTU-CVE-2026-42767", - "modified": "2026-07-08T22:45:18.595864Z" + "modified": "2026-06-17T16:15:10.718836Z" }, { "id": "UBUNTU-CVE-2026-42770", - "modified": "2026-07-08T22:45:20.235150Z" + "modified": "2026-06-17T16:15:10.643613Z" }, { "id": "UBUNTU-CVE-2026-45445", - "modified": "2026-07-08T22:45:20.031829Z" + "modified": "2026-06-17T16:15:15.523263Z" }, { "id": "UBUNTU-CVE-2026-45446", - "modified": "2026-07-08T22:45:20.225145Z" + "modified": "2026-06-17T16:15:13.306370Z" }, { "id": "UBUNTU-CVE-2026-45447", - "modified": "2026-07-08T22:45:20.175237Z" + "modified": "2026-06-17T16:15:13.449894Z" }, { "id": "UBUNTU-CVE-2026-7383", - "modified": "2026-07-08T22:45:20.213109Z" + "modified": "2026-06-17T16:15:24.043621Z" }, { "id": "UBUNTU-CVE-2026-9076", - "modified": "2026-07-08T22:45:20.169764Z" + "modified": "2026-06-17T16:15:14.309841Z" }, { "id": "USN-7278-1", @@ -2208,11 +2276,11 @@ interactions: }, { "id": "USN-7786-1", - "modified": "2026-06-25T13:32:31.234820Z" + "modified": "2026-05-20T16:03:48.800001Z" }, { "id": "USN-7980-1", - "modified": "2026-06-30T18:15:13.934266Z" + "modified": "2026-06-18T04:30:17.825715Z" }, { "id": "USN-8155-1", @@ -2220,7 +2288,7 @@ interactions: }, { "id": "USN-8414-1", - "modified": "2026-06-30T18:17:25.786836Z" + "modified": "2026-06-17T11:01:06.567847Z" } ] }, @@ -2317,11 +2385,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-31486", - "modified": "2026-06-24T15:30:22.242365Z" + "modified": "2026-05-20T16:13:34.139215Z" }, { "id": "UBUNTU-CVE-2023-47039", - "modified": "2026-06-24T15:30:22.223640Z" + "modified": "2026-04-22T14:15:27.303492Z" }, { "id": "UBUNTU-CVE-2024-56406", @@ -2329,47 +2397,43 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15649", - "modified": "2026-07-01T13:50:56.760041Z" + "modified": "2026-06-01T07:15:36.150813Z" }, { "id": "UBUNTU-CVE-2025-40909", - "modified": "2026-06-24T15:30:22.288512Z" + "modified": "2026-04-22T16:02:28.067448Z" }, { "id": "UBUNTU-CVE-2026-12087", - "modified": "2026-07-01T13:51:29.763714Z" + "modified": "2026-06-17T06:31:05.062220Z" }, { "id": "UBUNTU-CVE-2026-42496", - "modified": "2026-07-01T18:56:57.544972Z" + "modified": "2026-05-29T18:00:44.834841Z" }, { "id": "UBUNTU-CVE-2026-42497", - "modified": "2026-07-01T13:53:02.335741Z" + "modified": "2026-05-29T18:00:44.772881Z" }, { "id": "UBUNTU-CVE-2026-48959", - "modified": "2026-07-01T13:53:12.524471Z" + "modified": "2026-06-01T07:15:44.250395Z" }, { "id": "UBUNTU-CVE-2026-48961", - "modified": "2026-07-01T13:53:13.376190Z" + "modified": "2026-06-01T07:15:44.261753Z" }, { "id": "UBUNTU-CVE-2026-48962", - "modified": "2026-07-01T13:53:13.252080Z" - }, - { - "id": "UBUNTU-CVE-2026-7017", - "modified": "2026-07-09T17:15:52.841661Z" + "modified": "2026-05-29T18:01:00.200422Z" }, { "id": "UBUNTU-CVE-2026-8376", - "modified": "2026-07-01T18:57:39.513466Z" + "modified": "2026-05-29T18:01:03.136712Z" }, { "id": "UBUNTU-CVE-2026-9538", - "modified": "2026-07-01T13:53:19.355510Z" + "modified": "2026-05-29T18:01:01.753968Z" }, { "id": "USN-7434-1", @@ -2399,30 +2463,29 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-45582", - "modified": "2026-07-06T16:00:24.944880Z" + "modified": "2026-05-20T16:23:29.580676Z" }, { "id": "UBUNTU-CVE-2026-5704", - "modified": "2026-06-26T14:47:36.043245Z" - }, - { - "id": "USN-8477-1", - "modified": "2026-06-26T14:59:24.298942Z" - }, - { - "id": "USN-8510-1", - "modified": "2026-07-06T20:34:34.654931Z" + "modified": "2026-05-20T16:26:24.372107Z" } ] }, {}, {}, - {} + { + "vulns": [ + { + "id": "UBUNTU-CVE-2026-27171", + "modified": "2026-06-16T13:30:42.791654Z" + } + ] + } ] } headers: Content-Length: - - "12798" + - "11969" Content-Type: - application/json status: 200 OK @@ -2947,7 +3010,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 12798 + content_length: 11969 body: | { "results": [ @@ -2958,10 +3021,6 @@ interactions: {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -3044,10 +3103,6 @@ interactions: "id": "UBUNTU-CVE-2025-68973", "modified": "2026-02-05T00:30:28.335358Z" }, - { - "id": "UBUNTU-CVE-2026-57062", - "modified": "2026-06-29T18:15:10.272222Z" - }, { "id": "USN-7412-1", "modified": "2026-02-10T04:47:47Z" @@ -3058,56 +3113,19 @@ interactions: }, { "id": "USN-7946-1", - "modified": "2026-06-25T13:32:31.788231Z" + "modified": "2026-05-20T16:03:55.565581Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-41991", - "modified": "2026-07-06T20:30:58.394348Z" - }, - { - "id": "UBUNTU-CVE-2026-41992", - "modified": "2026-07-06T20:30:59.127897Z" - }, - { - "id": "USN-8512-1", - "modified": "2026-07-06T20:44:29.397826Z" - } - ] - }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54369", - "modified": "2026-07-01T21:27:56Z" - }, - { - "id": "UBUNTU-CVE-2026-54370", - "modified": "2026-07-01T21:27:56Z" - } - ] - }, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54371", - "modified": "2026-07-06T20:31:13.100309Z" - } - ] - }, + {}, + {}, + {}, {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -3146,7 +3164,7 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2016-20013", - "modified": "2026-07-08T22:45:12.334407Z" + "modified": "2026-06-01T15:45:11.069074Z" }, { "id": "UBUNTU-CVE-2025-0395", @@ -3190,7 +3208,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-6238", - "modified": "2026-06-24T11:00:25.318641Z" + "modified": "2026-05-29T19:15:06.810342Z" }, { "id": "USN-7259-1", @@ -3206,7 +3224,7 @@ interactions: }, { "id": "USN-8005-1", - "modified": "2026-06-25T13:32:31.787765Z" + "modified": "2026-05-20T16:03:57.629529Z" } ] }, @@ -3215,11 +3233,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-1390", - "modified": "2026-06-23T22:00:07.953148Z" + "modified": "2026-04-22T15:31:21.010462Z" }, { "id": "UBUNTU-CVE-2026-4878", - "modified": "2026-06-24T02:29:23.557692Z" + "modified": "2026-04-29T11:29:22.138592Z" }, { "id": "USN-7287-1", @@ -3239,11 +3257,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-2236", - "modified": "2026-07-01T23:40:15.314704Z" + "modified": "2026-06-02T14:00:10.803243Z" }, { "id": "UBUNTU-CVE-2026-41989", - "modified": "2026-06-26T19:30:06.785492Z" + "modified": "2026-06-02T14:00:20.958338Z" }, { "id": "USN-8319-1", @@ -3256,11 +3274,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-12243", - "modified": "2026-07-06T20:44:27.631542Z" + "modified": "2026-04-22T14:37:38.949616Z" }, { "id": "UBUNTU-CVE-2025-14831", - "modified": "2026-07-06T20:44:29.080707Z" + "modified": "2026-05-11T10:46:40.301990Z" }, { "id": "UBUNTU-CVE-2025-32988", @@ -3280,55 +3298,55 @@ interactions: }, { "id": "UBUNTU-CVE-2025-9820", - "modified": "2026-07-06T20:44:29.852110Z" + "modified": "2026-05-11T10:40:33.804944Z" }, { "id": "UBUNTU-CVE-2026-33845", - "modified": "2026-07-06T20:44:27.233455Z" + "modified": "2026-06-02T12:00:06.980060Z" }, { "id": "UBUNTU-CVE-2026-33846", - "modified": "2026-07-06T20:44:28.879211Z" + "modified": "2026-06-02T12:00:06.967548Z" }, { "id": "UBUNTU-CVE-2026-3832", - "modified": "2026-06-30T03:45:07.126536Z" + "modified": "2026-06-02T12:00:06.982846Z" }, { "id": "UBUNTU-CVE-2026-3833", - "modified": "2026-07-06T20:44:29.145695Z" + "modified": "2026-06-02T12:00:06.885767Z" }, { "id": "UBUNTU-CVE-2026-42009", - "modified": "2026-07-06T20:44:28.218328Z" + "modified": "2026-06-02T12:00:08.420027Z" }, { "id": "UBUNTU-CVE-2026-42010", - "modified": "2026-07-06T20:44:27.505571Z" + "modified": "2026-06-02T12:00:08.351396Z" }, { "id": "UBUNTU-CVE-2026-42011", - "modified": "2026-07-06T16:02:54.226888Z" + "modified": "2026-06-02T12:00:08.463825Z" }, { "id": "UBUNTU-CVE-2026-42012", - "modified": "2026-07-06T16:02:54.199597Z" + "modified": "2026-06-02T12:00:08.689551Z" }, { "id": "UBUNTU-CVE-2026-42013", - "modified": "2026-07-06T16:02:54.272277Z" + "modified": "2026-06-02T12:00:08.530311Z" }, { "id": "UBUNTU-CVE-2026-42014", - "modified": "2026-07-06T16:02:52.889534Z" + "modified": "2026-06-17T11:01:28.854907Z" }, { "id": "UBUNTU-CVE-2026-42015", - "modified": "2026-07-06T16:02:53.058495Z" + "modified": "2026-06-02T12:00:08.586508Z" }, { "id": "UBUNTU-CVE-2026-5260", - "modified": "2026-07-06T20:44:27.171088Z" + "modified": "2026-06-02T12:00:09.990926Z" }, { "id": "USN-7281-1", @@ -3381,15 +3399,15 @@ interactions: }, { "id": "UBUNTU-CVE-2026-40355", - "modified": "2026-07-09T21:30:58.285031Z" + "modified": "2026-05-29T10:45:29.205811Z" }, { "id": "UBUNTU-CVE-2026-40356", - "modified": "2026-07-09T21:30:58.537034Z" + "modified": "2026-05-29T10:45:29.281566Z" }, { "id": "USN-7257-1", - "modified": "2026-06-25T13:32:30.106589Z" + "modified": "2026-05-20T16:03:28.032877Z" }, { "id": "USN-7314-1", @@ -3397,7 +3415,7 @@ interactions: }, { "id": "USN-7542-1", - "modified": "2026-06-25T13:32:30.616782Z" + "modified": "2026-05-20T16:03:46.356475Z" } ] }, @@ -3428,27 +3446,20 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-50495", - "modified": "2026-07-02T22:45:21.903948Z" + "modified": "2026-04-22T14:15:03.155150Z" }, { "id": "UBUNTU-CVE-2025-6141", - "modified": "2026-07-07T21:03:19.257825Z" + "modified": "2026-04-22T16:08:19.927561Z" }, { "id": "UBUNTU-CVE-2025-69720", - "modified": "2026-07-08T18:30:10.365748Z" + "modified": "2026-04-22T16:13:35.392426Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-13757", - "modified": "2026-07-01T21:19:39Z" - } - ] - }, + {}, { "vulns": [ { @@ -3461,7 +3472,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-54411", - "modified": "2026-06-24T09:03:12Z" + "modified": "2026-06-17T11:02:56.948731Z" }, { "id": "USN-7580-1", @@ -3498,7 +3509,7 @@ interactions: }, { "id": "UBUNTU-CVE-2024-41996", - "modified": "2026-07-08T22:45:14.910732Z" + "modified": "2026-06-16T13:30:41.910018Z" }, { "id": "UBUNTU-CVE-2024-9143", @@ -3506,7 +3517,7 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15467", - "modified": "2026-07-08T22:45:12.561148Z" + "modified": "2026-06-18T04:30:07.553679Z" }, { "id": "UBUNTU-CVE-2025-27587", @@ -3514,15 +3525,15 @@ interactions: }, { "id": "UBUNTU-CVE-2025-68160", - "modified": "2026-07-08T22:45:11.201806Z" + "modified": "2026-05-20T16:23:45.899710Z" }, { "id": "UBUNTU-CVE-2025-69418", - "modified": "2026-07-08T22:45:10.238757Z" + "modified": "2026-05-20T16:23:51.325414Z" }, { "id": "UBUNTU-CVE-2025-69419", - "modified": "2026-07-08T22:45:10.652331Z" + "modified": "2026-05-20T16:23:51.080907Z" }, { "id": "UBUNTU-CVE-2025-69420", @@ -3542,71 +3553,71 @@ interactions: }, { "id": "UBUNTU-CVE-2026-22796", - "modified": "2026-07-08T22:45:13.369897Z" + "modified": "2026-05-20T16:24:15.294811Z" }, { "id": "UBUNTU-CVE-2026-28387", - "modified": "2026-07-08T22:45:14.045974Z" + "modified": "2026-05-20T16:24:53.583373Z" }, { "id": "UBUNTU-CVE-2026-28388", - "modified": "2026-07-08T22:45:13.947607Z" + "modified": "2026-05-20T16:24:55.415353Z" }, { "id": "UBUNTU-CVE-2026-28389", - "modified": "2026-07-08T22:45:14.128002Z" + "modified": "2026-05-20T16:24:55.036642Z" }, { "id": "UBUNTU-CVE-2026-28390", - "modified": "2026-07-08T22:45:14.501164Z" + "modified": "2026-05-20T16:24:54.756018Z" }, { "id": "UBUNTU-CVE-2026-31789", - "modified": "2026-07-08T22:45:08.612244Z" + "modified": "2026-06-16T13:30:43.522021Z" }, { "id": "UBUNTU-CVE-2026-31790", - "modified": "2026-07-08T22:45:15.194189Z" + "modified": "2026-06-16T13:30:47.743687Z" }, { "id": "UBUNTU-CVE-2026-34180", - "modified": "2026-07-08T22:45:16.182260Z" + "modified": "2026-06-17T16:15:20.130456Z" }, { "id": "UBUNTU-CVE-2026-34182", - "modified": "2026-07-08T22:45:16.771546Z" + "modified": "2026-06-17T16:15:21.278388Z" }, { "id": "UBUNTU-CVE-2026-42766", - "modified": "2026-07-08T22:45:18.180633Z" + "modified": "2026-06-17T16:15:12.063144Z" }, { "id": "UBUNTU-CVE-2026-42767", - "modified": "2026-07-08T22:45:18.595864Z" + "modified": "2026-06-17T16:15:10.718836Z" }, { "id": "UBUNTU-CVE-2026-42770", - "modified": "2026-07-08T22:45:20.235150Z" + "modified": "2026-06-17T16:15:10.643613Z" }, { "id": "UBUNTU-CVE-2026-45445", - "modified": "2026-07-08T22:45:20.031829Z" + "modified": "2026-06-17T16:15:15.523263Z" }, { "id": "UBUNTU-CVE-2026-45446", - "modified": "2026-07-08T22:45:20.225145Z" + "modified": "2026-06-17T16:15:13.306370Z" }, { "id": "UBUNTU-CVE-2026-45447", - "modified": "2026-07-08T22:45:20.175237Z" + "modified": "2026-06-17T16:15:13.449894Z" }, { "id": "UBUNTU-CVE-2026-7383", - "modified": "2026-07-08T22:45:20.213109Z" + "modified": "2026-06-17T16:15:24.043621Z" }, { "id": "UBUNTU-CVE-2026-9076", - "modified": "2026-07-08T22:45:20.169764Z" + "modified": "2026-06-17T16:15:14.309841Z" }, { "id": "USN-7278-1", @@ -3614,11 +3625,11 @@ interactions: }, { "id": "USN-7786-1", - "modified": "2026-06-25T13:32:31.234820Z" + "modified": "2026-05-20T16:03:48.800001Z" }, { "id": "USN-7980-1", - "modified": "2026-06-30T18:15:13.934266Z" + "modified": "2026-06-18T04:30:17.825715Z" }, { "id": "USN-8155-1", @@ -3626,7 +3637,7 @@ interactions: }, { "id": "USN-8414-1", - "modified": "2026-06-30T18:17:25.786836Z" + "modified": "2026-06-17T11:01:06.567847Z" } ] }, @@ -3723,11 +3734,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-31486", - "modified": "2026-06-24T15:30:22.242365Z" + "modified": "2026-05-20T16:13:34.139215Z" }, { "id": "UBUNTU-CVE-2023-47039", - "modified": "2026-06-24T15:30:22.223640Z" + "modified": "2026-04-22T14:15:27.303492Z" }, { "id": "UBUNTU-CVE-2024-56406", @@ -3735,47 +3746,43 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15649", - "modified": "2026-07-01T13:50:56.760041Z" + "modified": "2026-06-01T07:15:36.150813Z" }, { "id": "UBUNTU-CVE-2025-40909", - "modified": "2026-06-24T15:30:22.288512Z" + "modified": "2026-04-22T16:02:28.067448Z" }, { "id": "UBUNTU-CVE-2026-12087", - "modified": "2026-07-01T13:51:29.763714Z" + "modified": "2026-06-17T06:31:05.062220Z" }, { "id": "UBUNTU-CVE-2026-42496", - "modified": "2026-07-01T18:56:57.544972Z" + "modified": "2026-05-29T18:00:44.834841Z" }, { "id": "UBUNTU-CVE-2026-42497", - "modified": "2026-07-01T13:53:02.335741Z" + "modified": "2026-05-29T18:00:44.772881Z" }, { "id": "UBUNTU-CVE-2026-48959", - "modified": "2026-07-01T13:53:12.524471Z" + "modified": "2026-06-01T07:15:44.250395Z" }, { "id": "UBUNTU-CVE-2026-48961", - "modified": "2026-07-01T13:53:13.376190Z" + "modified": "2026-06-01T07:15:44.261753Z" }, { "id": "UBUNTU-CVE-2026-48962", - "modified": "2026-07-01T13:53:13.252080Z" - }, - { - "id": "UBUNTU-CVE-2026-7017", - "modified": "2026-07-09T17:15:52.841661Z" + "modified": "2026-05-29T18:01:00.200422Z" }, { "id": "UBUNTU-CVE-2026-8376", - "modified": "2026-07-01T18:57:39.513466Z" + "modified": "2026-05-29T18:01:03.136712Z" }, { "id": "UBUNTU-CVE-2026-9538", - "modified": "2026-07-01T13:53:19.355510Z" + "modified": "2026-05-29T18:01:01.753968Z" }, { "id": "USN-7434-1", @@ -3805,30 +3812,29 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-45582", - "modified": "2026-07-06T16:00:24.944880Z" + "modified": "2026-05-20T16:23:29.580676Z" }, { "id": "UBUNTU-CVE-2026-5704", - "modified": "2026-06-26T14:47:36.043245Z" - }, - { - "id": "USN-8477-1", - "modified": "2026-06-26T14:59:24.298942Z" - }, - { - "id": "USN-8510-1", - "modified": "2026-07-06T20:34:34.654931Z" + "modified": "2026-05-20T16:26:24.372107Z" } ] }, {}, {}, - {} + { + "vulns": [ + { + "id": "UBUNTU-CVE-2026-27171", + "modified": "2026-06-16T13:30:42.791654Z" + } + ] + } ] } headers: Content-Length: - - "12798" + - "11969" Content-Type: - application/json status: 200 OK @@ -3838,98 +3844,2368 @@ interactions: proto: HTTP/1.1 proto_major: 1 proto_minor: 1 - content_length: 626 + content_length: 21849 host: api.osv.dev body: | { "queries": [ { "package": { - "ecosystem": "PyPI", - "name": "gpg" + "ecosystem": "AlmaLinux:9", + "name": "acl" }, - "version": "1.15.1" + "version": "2.3.1-3.el9" }, { "package": { - "ecosystem": "PyPI", - "name": "libcomps" + "ecosystem": "AlmaLinux:9", + "name": "almalinux-gpg-keys" }, - "version": "0.1.18" + "version": "9.0-4.el9" }, { "package": { - "ecosystem": "PyPI", - "name": "pip" + "ecosystem": "AlmaLinux:9", + "name": "almalinux-release" }, - "version": "21.2.3" + "version": "9.0-4.el9" }, { "package": { - "ecosystem": "PyPI", - "name": "rpm" + "ecosystem": "AlmaLinux:9", + "name": "almalinux-repos" }, - "version": "4.16.1.3" + "version": "9.0-4.el9" }, { "package": { - "ecosystem": "PyPI", - "name": "setuptools" + "ecosystem": "AlmaLinux:9", + "name": "alternatives" }, - "version": "53.0.0" - } - ] - } - headers: - Content-Type: - - application/json - X-Test-Name: - - TestCommand_OCIImage/Scanning_AlmaLinux_9_image - url: https://api.osv.dev/v1/querybatch - method: POST - response: - proto: HTTP/2.0 - proto_major: 2 - proto_minor: 0 - content_length: 867 - body: | - { - "results": [ - {}, - {}, + "version": "1.20-2.el9" + }, { - "vulns": [ - { - "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-03-24T01:43:53.135277Z" - }, - { - "id": "GHSA-58qw-9mgm-455v", - "modified": "2026-05-20T21:00:09.920997Z" - }, - { - "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-03-24T01:43:46.425088Z" - }, - { - "id": "GHSA-jp4c-xjxw-mgf9", - "modified": "2026-05-07T16:59:14.079020Z" - }, - { - "id": "GHSA-mq26-g339-26xf", - "modified": "2026-03-24T01:43:05.410801Z" - }, - { - "id": "PYSEC-2023-228", - "modified": "2026-03-24T01:42:37.905754Z" - }, - { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "audit-libs" + }, + "version": "3.0.7-101.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "basesystem" + }, + "version": "11-13.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bash" + }, + "version": "5.1.8-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils-gold" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bzip2-libs" + }, + "version": "1.0.8-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ca-certificates" + }, + "version": "2022.2.54-90.2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "coreutils-single" + }, + "version": "8.32-31.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib-dicts" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies-scripts" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cryptsetup-libs" + }, + "version": "2.4.3-4.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "curl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cyrus-sasl-lib" + }, + "version": "2.1.27-20.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-broker" + }, + "version": "28-5.1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-common" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper-libs" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf-data" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-debuginfod-client" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-default-yama-scope" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libelf" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libs" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "expat" + }, + "version": "2.2.10-12.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "file-libs" + }, + "version": "5.39-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "filesystem" + }, + "version": "3.16-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "findutils" + }, + "version": "4.8.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gawk" + }, + "version": "5.1.0-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gdbm-libs" + }, + "version": "1.19-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glib2" + }, + "version": "2.68.4-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-common" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-minimal-langpack" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gmp" + }, + "version": "6.2.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnupg2" + }, + "version": "2.3.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnutls" + }, + "version": "3.7.6-12.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.15.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpg-pubkey" + }, + "version": "b86b3716-61e69f29" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpgme" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "grep" + }, + "version": "3.6-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gzip" + }, + "version": "1.10-9.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "hostname" + }, + "version": "3.23-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ima-evm-utils" + }, + "version": "1.4-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "iputils" + }, + "version": "20210202-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "json-c" + }, + "version": "0.14-11.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "keyutils-libs" + }, + "version": "1.6.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "kmod-libs" + }, + "version": "28-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "krb5-libs" + }, + "version": "1.19.1-15.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "less" + }, + "version": "590-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libacl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libarchive" + }, + "version": "3.5.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libassuan" + }, + "version": "2.5.5-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libattr" + }, + "version": "2.5.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libblkid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap" + }, + "version": "2.48-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap-ng" + }, + "version": "0.8.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcom_err" + }, + "version": "1.46.5-2.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcurl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdb" + }, + "version": "5.3.28-53.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libeconf" + }, + "version": "0.4.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libevent" + }, + "version": "2.1.12-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libfdisk" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libffi" + }, + "version": "3.4.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcc" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcrypt" + }, + "version": "1.10.0-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgomp" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgpg-error" + }, + "version": "1.42-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libidn2" + }, + "version": "2.3.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libksba" + }, + "version": "1.5.1-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmodulemd" + }, + "version": "2.13.0-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmount" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libnghttp2" + }, + "version": "1.43.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libpwquality" + }, + "version": "1.4.4-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "librepo" + }, + "version": "1.14.2-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libreport-filesystem" + }, + "version": "2.15.2-6.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libseccomp" + }, + "version": "2.5.2-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libselinux" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsemanage" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsepol" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsigsegv" + }, + "version": "2.13-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsmartcols" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsolv" + }, + "version": "0.7.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libstdc++" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libtasn1" + }, + "version": "4.16.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libunistring" + }, + "version": "0.9.10-15.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libutempter" + }, + "version": "1.2.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libuuid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libverto" + }, + "version": "0.3.2-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxcrypt" + }, + "version": "4.4.18-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxml2" + }, + "version": "2.9.13-1.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libyaml" + }, + "version": "0.2.5-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libzstd" + }, + "version": "1.5.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lua-libs" + }, + "version": "5.4.2-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lz4-libs" + }, + "version": "1.9.3-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "mpfr" + }, + "version": "4.1.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-base" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-libs" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "nettle" + }, + "version": "3.8-3.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "npth" + }, + "version": "1.6-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap-compat" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl-libs" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit-trust" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pam" + }, + "version": "1.5.1-9.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre" + }, + "version": "8.44-3.el9.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2-syntax" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "21.2.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "popt" + }, + "version": "1.18-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-gpg" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-hawkey" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libs" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-pip-wheel" + }, + "version": "21.2.3-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-setuptools-wheel" + }, + "version": "53.0.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "readline" + }, + "version": "8.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rootfiles" + }, + "version": "8.1-31.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.16.1.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-build-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-sign-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sed" + }, + "version": "4.8-9.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "setup" + }, + "version": "2.13.7-6.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "53.0.0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "shadow-utils" + }, + "version": "4.9-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sqlite-libs" + }, + "version": "3.34.1-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-libs" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-pam" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-rpm-macros" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tar" + }, + "version": "1.34-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tpm2-tss" + }, + "version": "3.0.3-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tzdata" + }, + "version": "2022e-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux-core" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "vim-minimal" + }, + "version": "8.2.2637-16.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz-libs" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "yum" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "zlib" + }, + "version": "1.2.11-31.el9_0.1" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage/Scanning_AlmaLinux_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 19728 + body: | + { + "results": [ + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0340", + "modified": "2026-02-04T02:39:05.013813Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:0925", + "modified": "2026-02-04T04:23:04.673700Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0337", + "modified": "2026-02-04T02:41:37.038356Z" + }, + { + "id": "ALSA-2024:1530", + "modified": "2026-02-04T03:35:33.402240Z" + }, + { + "id": "ALSA-2024:6754", + "modified": "2026-02-04T02:22:22.919987Z" + }, + { + "id": "ALSA-2024:9541", + "modified": "2026-02-04T03:35:28.908623Z" + }, + { + "id": "ALSA-2025:22175", + "modified": "2026-02-04T04:22:01.629753Z" + }, + { + "id": "ALSA-2025:3531", + "modified": "2026-02-04T04:35:39.307337Z" + }, + { + "id": "ALSA-2025:7444", + "modified": "2026-02-04T03:11:34.139518Z" + }, + { + "id": "ALSA-2026:23230", + "modified": "2026-06-11T16:00:04.147520Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:2512", + "modified": "2026-02-04T04:24:23.275314Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6631", + "modified": "2026-02-04T04:27:47.395873Z" + }, + { + "id": "ALSA-2024:6464", + "modified": "2026-02-04T03:27:15.983684Z" + }, + { + "id": "ALSA-2025:11140", + "modified": "2026-02-04T02:55:31.495927Z" + }, + { + "id": "ALSA-2026:0936", + "modified": "2026-02-04T02:25:08.416995Z" + }, + { + "id": "ALSA-2026:15971", + "modified": "2026-05-11T20:00:09.038847Z" + }, + { + "id": "ALSA-2026:19361", + "modified": "2026-05-26T16:00:28.465116Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6661", + "modified": "2026-02-04T02:21:41.980408Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:0719", + "modified": "2026-02-04T04:34:34.329237Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:1141", + "modified": "2026-02-04T03:18:59.660613Z" + }, + { + "id": "ALSA-2024:0533", + "modified": "2026-02-04T03:48:34.100512Z" + }, + { + "id": "ALSA-2024:1879", + "modified": "2026-02-04T03:31:06.672839Z" + }, + { + "id": "ALSA-2024:2570", + "modified": "2026-02-04T04:01:53.202219Z" + }, + { + "id": "ALSA-2025:16116", + "modified": "2026-02-04T03:15:22.241525Z" + }, + { + "id": "ALSA-2025:7076", + "modified": "2026-02-04T04:25:27.782684Z" + }, + { + "id": "ALSA-2026:4188", + "modified": "2026-03-16T08:43:59.018031Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:17558", + "modified": "2026-02-04T03:25:13.978615Z" + }, + { + "id": "ALSA-2025:9432", + "modified": "2026-02-04T02:18:41.302098Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8637", + "modified": "2026-02-04T04:01:02.274891Z" + }, + { + "id": "ALSA-2023:2570", + "modified": "2026-02-04T03:25:10.056435Z" + }, + { + "id": "ALSA-2023:6699", + "modified": "2026-02-04T03:59:17.349120Z" + }, + { + "id": "ALSA-2024:6166", + "modified": "2026-02-04T04:13:16.807291Z" + }, + { + "id": "ALSA-2024:9331", + "modified": "2026-02-04T02:40:52.136074Z" + }, + { + "id": "ALSA-2024:9474", + "modified": "2026-02-04T04:30:53.060846Z" + }, + { + "id": "ALSA-2025:7067", + "modified": "2026-02-04T02:48:22.293400Z" + }, + { + "id": "ALSA-2025:9430", + "modified": "2026-02-04T03:20:09.135780Z" + }, + { + "id": "ALSA-2026:19357", + "modified": "2026-05-26T16:14:26.075210Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:3725", + "modified": "2026-02-04T02:57:26.406617Z" + }, + { + "id": "ALSA-2024:1692", + "modified": "2026-02-04T03:07:17.609765Z" + }, + { + "id": "ALSA-2024:3513", + "modified": "2026-02-04T04:02:37.699304Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:2532", + "modified": "2026-02-04T03:30:59.962630Z" + }, + { + "id": "ALSA-2025:14130", + "modified": "2026-02-04T02:59:02.777670Z" + }, + { + "id": "ALSA-2025:9431", + "modified": "2026-02-04T04:26:59.474540Z" + }, + { + "id": "ALSA-2026:5080", + "modified": "2026-03-24T11:41:56.671370Z" + }, + { + "id": "ALSA-2026:8510", + "modified": "2026-04-17T13:19:53.082048Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5071", + "modified": "2026-02-04T03:18:20.022576Z" + }, + { + "id": "ALSA-2026:12441", + "modified": "2026-05-01T20:45:11.742990Z" + }, + { + "id": "ALSA-2026:19346", + "modified": "2026-05-26T16:00:23.989197Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8361", + "modified": "2026-02-04T04:00:37.440096Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:4347", + "modified": "2026-02-04T04:26:55.222844Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:9404", + "modified": "2026-02-04T04:39:46.445150Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0626", + "modified": "2026-02-04T03:37:23.910138Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5838", + "modified": "2026-02-04T03:21:23.106321Z" + }, + { + "id": "ALSA-2023:6746", + "modified": "2026-02-04T02:52:20.689534Z" + }, + { + "id": "ALSA-2024:3501", + "modified": "2026-02-04T04:30:58.924693Z" + }, + { + "id": "ALSA-2026:7668", + "modified": "2026-04-17T13:19:22.946826Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0343", + "modified": "2026-02-04T02:58:56.421179Z" + }, + { + "id": "ALSA-2025:7077", + "modified": "2026-02-04T02:57:21.340790Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0338", + "modified": "2026-02-04T04:15:50.026698Z" + }, + { + "id": "ALSA-2023:4349", + "modified": "2026-02-04T03:56:40.445151Z" + }, + { + "id": "ALSA-2023:7747", + "modified": "2026-02-04T02:47:05.174021Z" + }, + { + "id": "ALSA-2024:2679", + "modified": "2026-02-04T03:53:53.131809Z" + }, + { + "id": "ALSA-2025:10699", + "modified": "2026-02-04T03:45:10.417784Z" + }, + { + "id": "ALSA-2025:12447", + "modified": "2026-02-04T04:08:24.796808Z" + }, + { + "id": "ALSA-2025:13428", + "modified": "2026-02-04T03:51:53.872437Z" + }, + { + "id": "ALSA-2025:1350", + "modified": "2026-02-04T04:02:12.419510Z" + }, + { + "id": "ALSA-2025:22376", + "modified": "2026-02-04T04:03:23.679067Z" + }, + { + "id": "ALSA-2025:2679", + "modified": "2026-02-04T02:16:14.070103Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7329", + "modified": "2026-02-04T02:28:25.713104Z" + }, + { + "id": "ALSA-2023:0957", + "modified": "2026-02-04T02:27:45.919035Z" + }, + { + "id": "ALSA-2023:2582", + "modified": "2026-02-04T03:10:44.508101Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:10244", + "modified": "2026-02-04T03:21:58.697081Z" + }, + { + "id": "ALSA-2024:11250", + "modified": "2026-02-04T03:37:50.674762Z" + }, + { + "id": "ALSA-2024:2438", + "modified": "2026-02-04T04:21:40.830719Z" + }, + { + "id": "ALSA-2025:15099", + "modified": "2026-02-04T03:59:03.032487Z" + }, + { + "id": "ALSA-2025:9526", + "modified": "2026-02-04T03:35:27.405905Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-03-24T01:43:53.135277Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-03-24T01:43:46.425088Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-06-10T17:01:27.606909Z" + }, + { "id": "PYSEC-2026-196", "modified": "2026-06-05T12:45:14.124059Z" } ] }, {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6694", + "modified": "2026-02-04T02:39:28.003450Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0952", + "modified": "2026-02-04T02:32:42.835672Z" + }, + { + "id": "ALSA-2024:5534", + "modified": "2026-02-04T02:43:30.286669Z" + }, + { + "id": "ALSA-2025:10407", + "modified": "2026-02-04T03:52:34.406526Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + {}, + {}, { "vulns": [ { @@ -3946,19 +6222,263 @@ interactions: }, { "id": "PYSEC-2022-43012", - "modified": "2023-12-06T01:02:35.662444Z" + "modified": "2026-06-10T17:02:40.148961Z" }, { "id": "PYSEC-2025-49", "modified": "2026-05-11T00:26:34.671259Z" } ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6632", + "modified": "2026-02-04T04:16:01.058999Z" + }, + { + "id": "ALSA-2025:20559", + "modified": "2026-02-04T02:22:46.209033Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0339", + "modified": "2026-02-04T03:25:10.768446Z" + }, + { + "id": "ALSA-2024:0465", + "modified": "2026-02-04T02:44:43.937586Z" + }, + { + "id": "ALSA-2025:11992", + "modified": "2026-02-04T03:22:31.337630Z" + }, + { + "id": "ALSA-2025:20936", + "modified": "2026-02-04T04:26:46.773530Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0959", + "modified": "2026-02-04T03:24:09.816450Z" + }, + { + "id": "ALSA-2026:0067", + "modified": "2026-02-04T02:19:32.940449Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6685", + "modified": "2026-02-04T04:02:01.414267Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:5242", + "modified": "2026-02-04T03:09:49.111890Z" + }, + { + "id": "ALSA-2022:5942", + "modified": "2026-02-04T04:29:25.863952Z" + }, + { + "id": "ALSA-2023:0958", + "modified": "2026-02-04T02:48:00.905849Z" + }, + { + "id": "ALSA-2024:9405", + "modified": "2026-02-04T03:08:35.008158Z" + }, + { + "id": "ALSA-2025:17742", + "modified": "2026-02-04T03:32:56.810406Z" + }, + { + "id": "ALSA-2025:20945", + "modified": "2026-02-04T04:32:36.215823Z" + }, + { + "id": "ALSA-2025:7440", + "modified": "2026-02-04T03:33:27.312996Z" + }, + { + "id": "ALSA-2026:11510", + "modified": "2026-04-30T14:30:20.381957Z" + }, + { + "id": "ALSA-2026:19224", + "modified": "2026-05-26T16:00:23.463648Z" + }, + { + "id": "ALSA-2026:22717", + "modified": "2026-06-04T11:15:04.513534Z" + }, + { + "id": "ALSA-2026:5602", + "modified": "2026-03-27T09:01:15.379885Z" + }, + { + "id": "ALSA-2026:8259", + "modified": "2026-04-17T13:19:37.888342Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7314", + "modified": "2026-02-04T02:40:45.002131Z" + } + ] } ] } headers: Content-Length: - - "867" + - "19728" Content-Type: - application/json status: 200 OK @@ -4497,7 +7017,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 19399 + content_length: 18291 body: | { "results": [ @@ -4508,10 +7028,6 @@ interactions: {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -4557,25 +7073,14 @@ interactions: "modified": "2026-04-22T16:08:20.375647Z" }, { - "id": "USN-7768-1", - "modified": "2026-04-27T18:17:26.257929Z" - } - ] - }, - {}, - {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-53432", - "modified": "2026-07-03T21:45:17.460958Z" - }, - { - "id": "UBUNTU-CVE-2026-53433", - "modified": "2026-07-03T21:45:30.861784Z" + "id": "USN-7768-1", + "modified": "2026-04-27T18:17:26.257929Z" } ] }, + {}, + {}, + {}, { "vulns": [ { @@ -4888,7 +7393,7 @@ interactions: }, { "id": "GO-2025-4014", - "modified": "2026-06-26T12:29:46.364453Z" + "modified": "2026-06-04T10:29:16.617520Z" }, { "id": "GO-2025-4015", @@ -4896,7 +7401,7 @@ interactions: }, { "id": "GO-2025-4155", - "modified": "2026-07-09T10:44:32.536665Z" + "modified": "2026-06-12T10:29:15.211985Z" }, { "id": "GO-2025-4175", @@ -4904,7 +7409,7 @@ interactions: }, { "id": "GO-2026-4337", - "modified": "2026-07-07T10:29:23.547454Z" + "modified": "2026-06-12T10:29:15.605437Z" }, { "id": "GO-2026-4340", @@ -4912,11 +7417,11 @@ interactions: }, { "id": "GO-2026-4341", - "modified": "2026-07-07T10:29:23.472772Z" + "modified": "2026-06-12T10:29:15.035295Z" }, { "id": "GO-2026-4342", - "modified": "2026-07-02T10:44:29.686144Z" + "modified": "2026-06-12T10:29:15.283039Z" }, { "id": "GO-2026-4403", @@ -4924,7 +7429,7 @@ interactions: }, { "id": "GO-2026-4601", - "modified": "2026-07-09T10:44:32.269952Z" + "modified": "2026-06-17T10:29:19.633057Z" }, { "id": "GO-2026-4602", @@ -4936,7 +7441,7 @@ interactions: }, { "id": "GO-2026-4864", - "modified": "2026-07-09T10:44:33.381720Z" + "modified": "2026-06-16T10:29:15.527117Z" }, { "id": "GO-2026-4865", @@ -4948,23 +7453,19 @@ interactions: }, { "id": "GO-2026-4870", - "modified": "2026-07-09T10:44:33.055212Z" + "modified": "2026-06-17T10:29:19.204036Z" }, { "id": "GO-2026-4918", - "modified": "2026-06-27T10:44:20.771417Z" + "modified": "2026-05-11T08:11:05.383192Z" }, { "id": "GO-2026-4946", - "modified": "2026-07-09T10:44:33.129570Z" + "modified": "2026-06-17T10:29:19.549582Z" }, { "id": "GO-2026-4947", - "modified": "2026-07-09T10:44:33.192298Z" - }, - { - "id": "GO-2026-4970", - "modified": "2026-07-08T20:29:26.853236Z" + "modified": "2026-06-17T10:29:19.948808Z" }, { "id": "GO-2026-4971", @@ -4972,7 +7473,7 @@ interactions: }, { "id": "GO-2026-4976", - "modified": "2026-06-27T10:44:21.221469Z" + "modified": "2026-05-11T08:11:26.883618Z" }, { "id": "GO-2026-4977", @@ -4984,11 +7485,11 @@ interactions: }, { "id": "GO-2026-4981", - "modified": "2026-07-09T10:44:32.677126Z" + "modified": "2026-06-09T10:29:17.671297Z" }, { "id": "GO-2026-4982", - "modified": "2026-06-27T10:44:21.066171Z" + "modified": "2026-05-11T08:11:21.041304Z" }, { "id": "GO-2026-4986", @@ -4996,7 +7497,7 @@ interactions: }, { "id": "GO-2026-5037", - "modified": "2026-07-09T10:44:33.680614Z" + "modified": "2026-06-05T07:56:06.303534Z" }, { "id": "GO-2026-5038", @@ -5004,11 +7505,7 @@ interactions: }, { "id": "GO-2026-5039", - "modified": "2026-06-27T10:44:21.143168Z" - }, - { - "id": "GO-2026-5856", - "modified": "2026-07-08T20:29:26.756890Z" + "modified": "2026-06-05T07:56:26.571479Z" } ] }, @@ -5026,10 +7523,6 @@ interactions: "id": "UBUNTU-CVE-2025-68973", "modified": "2026-02-05T00:30:28.335358Z" }, - { - "id": "UBUNTU-CVE-2026-57062", - "modified": "2026-06-29T18:15:10.272222Z" - }, { "id": "USN-7412-1", "modified": "2026-02-10T04:47:47Z" @@ -5040,56 +7533,19 @@ interactions: }, { "id": "USN-7946-1", - "modified": "2026-06-25T13:32:31.788231Z" + "modified": "2026-05-20T16:03:55.565581Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-41991", - "modified": "2026-07-06T20:30:58.394348Z" - }, - { - "id": "UBUNTU-CVE-2026-41992", - "modified": "2026-07-06T20:30:59.127897Z" - }, - { - "id": "USN-8512-1", - "modified": "2026-07-06T20:44:29.397826Z" - } - ] - }, {}, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54369", - "modified": "2026-07-01T21:27:56Z" - }, - { - "id": "UBUNTU-CVE-2026-54370", - "modified": "2026-07-01T21:27:56Z" - } - ] - }, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-54371", - "modified": "2026-07-06T20:31:13.100309Z" - } - ] - }, + {}, + {}, + {}, {}, { "vulns": [ - { - "id": "UBUNTU-CVE-2026-13595", - "modified": "2026-07-09T17:15:27.672147Z" - }, { "id": "UBUNTU-CVE-2026-27456", "modified": "2026-05-20T16:24:53.388662Z" @@ -5128,7 +7584,7 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2016-20013", - "modified": "2026-07-08T22:45:12.334407Z" + "modified": "2026-06-01T15:45:11.069074Z" }, { "id": "UBUNTU-CVE-2025-0395", @@ -5172,7 +7628,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-6238", - "modified": "2026-06-24T11:00:25.318641Z" + "modified": "2026-05-29T19:15:06.810342Z" }, { "id": "USN-7259-1", @@ -5188,7 +7644,7 @@ interactions: }, { "id": "USN-8005-1", - "modified": "2026-06-25T13:32:31.787765Z" + "modified": "2026-05-20T16:03:57.629529Z" } ] }, @@ -5197,11 +7653,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-1390", - "modified": "2026-06-23T22:00:07.953148Z" + "modified": "2026-04-22T15:31:21.010462Z" }, { "id": "UBUNTU-CVE-2026-4878", - "modified": "2026-06-24T02:29:23.557692Z" + "modified": "2026-04-29T11:29:22.138592Z" }, { "id": "USN-7287-1", @@ -5221,11 +7677,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-2236", - "modified": "2026-07-01T23:40:15.314704Z" + "modified": "2026-06-02T14:00:10.803243Z" }, { "id": "UBUNTU-CVE-2026-41989", - "modified": "2026-06-26T19:30:06.785492Z" + "modified": "2026-06-02T14:00:20.958338Z" }, { "id": "USN-8319-1", @@ -5238,11 +7694,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2024-12243", - "modified": "2026-07-06T20:44:27.631542Z" + "modified": "2026-04-22T14:37:38.949616Z" }, { "id": "UBUNTU-CVE-2025-14831", - "modified": "2026-07-06T20:44:29.080707Z" + "modified": "2026-05-11T10:46:40.301990Z" }, { "id": "UBUNTU-CVE-2025-32988", @@ -5262,55 +7718,55 @@ interactions: }, { "id": "UBUNTU-CVE-2025-9820", - "modified": "2026-07-06T20:44:29.852110Z" + "modified": "2026-05-11T10:40:33.804944Z" }, { "id": "UBUNTU-CVE-2026-33845", - "modified": "2026-07-06T20:44:27.233455Z" + "modified": "2026-06-02T12:00:06.980060Z" }, { "id": "UBUNTU-CVE-2026-33846", - "modified": "2026-07-06T20:44:28.879211Z" + "modified": "2026-06-02T12:00:06.967548Z" }, { "id": "UBUNTU-CVE-2026-3832", - "modified": "2026-06-30T03:45:07.126536Z" + "modified": "2026-06-02T12:00:06.982846Z" }, { "id": "UBUNTU-CVE-2026-3833", - "modified": "2026-07-06T20:44:29.145695Z" + "modified": "2026-06-02T12:00:06.885767Z" }, { "id": "UBUNTU-CVE-2026-42009", - "modified": "2026-07-06T20:44:28.218328Z" + "modified": "2026-06-02T12:00:08.420027Z" }, { "id": "UBUNTU-CVE-2026-42010", - "modified": "2026-07-06T20:44:27.505571Z" + "modified": "2026-06-02T12:00:08.351396Z" }, { "id": "UBUNTU-CVE-2026-42011", - "modified": "2026-07-06T16:02:54.226888Z" + "modified": "2026-06-02T12:00:08.463825Z" }, { "id": "UBUNTU-CVE-2026-42012", - "modified": "2026-07-06T16:02:54.199597Z" + "modified": "2026-06-02T12:00:08.689551Z" }, { "id": "UBUNTU-CVE-2026-42013", - "modified": "2026-07-06T16:02:54.272277Z" + "modified": "2026-06-02T12:00:08.530311Z" }, { "id": "UBUNTU-CVE-2026-42014", - "modified": "2026-07-06T16:02:52.889534Z" + "modified": "2026-06-17T11:01:28.854907Z" }, { "id": "UBUNTU-CVE-2026-42015", - "modified": "2026-07-06T16:02:53.058495Z" + "modified": "2026-06-02T12:00:08.586508Z" }, { "id": "UBUNTU-CVE-2026-5260", - "modified": "2026-07-06T20:44:27.171088Z" + "modified": "2026-06-02T12:00:09.990926Z" }, { "id": "USN-7281-1", @@ -5363,15 +7819,15 @@ interactions: }, { "id": "UBUNTU-CVE-2026-40355", - "modified": "2026-07-09T21:30:58.285031Z" + "modified": "2026-05-29T10:45:29.205811Z" }, { "id": "UBUNTU-CVE-2026-40356", - "modified": "2026-07-09T21:30:58.537034Z" + "modified": "2026-05-29T10:45:29.281566Z" }, { "id": "USN-7257-1", - "modified": "2026-06-25T13:32:30.106589Z" + "modified": "2026-05-20T16:03:28.032877Z" }, { "id": "USN-7314-1", @@ -5379,7 +7835,7 @@ interactions: }, { "id": "USN-7542-1", - "modified": "2026-06-25T13:32:30.616782Z" + "modified": "2026-05-20T16:03:46.356475Z" } ] }, @@ -5410,27 +7866,20 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-50495", - "modified": "2026-07-02T22:45:21.903948Z" + "modified": "2026-04-22T14:15:03.155150Z" }, { "id": "UBUNTU-CVE-2025-6141", - "modified": "2026-07-07T21:03:19.257825Z" + "modified": "2026-04-22T16:08:19.927561Z" }, { "id": "UBUNTU-CVE-2025-69720", - "modified": "2026-07-08T18:30:10.365748Z" + "modified": "2026-04-22T16:13:35.392426Z" } ] }, {}, - { - "vulns": [ - { - "id": "UBUNTU-CVE-2026-13757", - "modified": "2026-07-01T21:19:39Z" - } - ] - }, + {}, { "vulns": [ { @@ -5443,7 +7892,7 @@ interactions: }, { "id": "UBUNTU-CVE-2026-54411", - "modified": "2026-06-24T09:03:12Z" + "modified": "2026-06-17T11:02:56.948731Z" }, { "id": "USN-7580-1", @@ -5480,7 +7929,7 @@ interactions: }, { "id": "UBUNTU-CVE-2024-41996", - "modified": "2026-07-08T22:45:14.910732Z" + "modified": "2026-06-16T13:30:41.910018Z" }, { "id": "UBUNTU-CVE-2024-9143", @@ -5488,7 +7937,7 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15467", - "modified": "2026-07-08T22:45:12.561148Z" + "modified": "2026-06-18T04:30:07.553679Z" }, { "id": "UBUNTU-CVE-2025-27587", @@ -5496,15 +7945,15 @@ interactions: }, { "id": "UBUNTU-CVE-2025-68160", - "modified": "2026-07-08T22:45:11.201806Z" + "modified": "2026-05-20T16:23:45.899710Z" }, { "id": "UBUNTU-CVE-2025-69418", - "modified": "2026-07-08T22:45:10.238757Z" + "modified": "2026-05-20T16:23:51.325414Z" }, { "id": "UBUNTU-CVE-2025-69419", - "modified": "2026-07-08T22:45:10.652331Z" + "modified": "2026-05-20T16:23:51.080907Z" }, { "id": "UBUNTU-CVE-2025-69420", @@ -5524,71 +7973,71 @@ interactions: }, { "id": "UBUNTU-CVE-2026-22796", - "modified": "2026-07-08T22:45:13.369897Z" + "modified": "2026-05-20T16:24:15.294811Z" }, { "id": "UBUNTU-CVE-2026-28387", - "modified": "2026-07-08T22:45:14.045974Z" + "modified": "2026-05-20T16:24:53.583373Z" }, { "id": "UBUNTU-CVE-2026-28388", - "modified": "2026-07-08T22:45:13.947607Z" + "modified": "2026-05-20T16:24:55.415353Z" }, { "id": "UBUNTU-CVE-2026-28389", - "modified": "2026-07-08T22:45:14.128002Z" + "modified": "2026-05-20T16:24:55.036642Z" }, { "id": "UBUNTU-CVE-2026-28390", - "modified": "2026-07-08T22:45:14.501164Z" + "modified": "2026-05-20T16:24:54.756018Z" }, { "id": "UBUNTU-CVE-2026-31789", - "modified": "2026-07-08T22:45:08.612244Z" + "modified": "2026-06-16T13:30:43.522021Z" }, { "id": "UBUNTU-CVE-2026-31790", - "modified": "2026-07-08T22:45:15.194189Z" + "modified": "2026-06-16T13:30:47.743687Z" }, { "id": "UBUNTU-CVE-2026-34180", - "modified": "2026-07-08T22:45:16.182260Z" + "modified": "2026-06-17T16:15:20.130456Z" }, { "id": "UBUNTU-CVE-2026-34182", - "modified": "2026-07-08T22:45:16.771546Z" + "modified": "2026-06-17T16:15:21.278388Z" }, { "id": "UBUNTU-CVE-2026-42766", - "modified": "2026-07-08T22:45:18.180633Z" + "modified": "2026-06-17T16:15:12.063144Z" }, { "id": "UBUNTU-CVE-2026-42767", - "modified": "2026-07-08T22:45:18.595864Z" + "modified": "2026-06-17T16:15:10.718836Z" }, { "id": "UBUNTU-CVE-2026-42770", - "modified": "2026-07-08T22:45:20.235150Z" + "modified": "2026-06-17T16:15:10.643613Z" }, { "id": "UBUNTU-CVE-2026-45445", - "modified": "2026-07-08T22:45:20.031829Z" + "modified": "2026-06-17T16:15:15.523263Z" }, { "id": "UBUNTU-CVE-2026-45446", - "modified": "2026-07-08T22:45:20.225145Z" + "modified": "2026-06-17T16:15:13.306370Z" }, { "id": "UBUNTU-CVE-2026-45447", - "modified": "2026-07-08T22:45:20.175237Z" + "modified": "2026-06-17T16:15:13.449894Z" }, { "id": "UBUNTU-CVE-2026-7383", - "modified": "2026-07-08T22:45:20.213109Z" + "modified": "2026-06-17T16:15:24.043621Z" }, { "id": "UBUNTU-CVE-2026-9076", - "modified": "2026-07-08T22:45:20.169764Z" + "modified": "2026-06-17T16:15:14.309841Z" }, { "id": "USN-7278-1", @@ -5596,11 +8045,11 @@ interactions: }, { "id": "USN-7786-1", - "modified": "2026-06-25T13:32:31.234820Z" + "modified": "2026-05-20T16:03:48.800001Z" }, { "id": "USN-7980-1", - "modified": "2026-06-30T18:15:13.934266Z" + "modified": "2026-06-18T04:30:17.825715Z" }, { "id": "USN-8155-1", @@ -5608,7 +8057,7 @@ interactions: }, { "id": "USN-8414-1", - "modified": "2026-06-30T18:17:25.786836Z" + "modified": "2026-06-17T11:01:06.567847Z" } ] }, @@ -5705,11 +8154,11 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2023-31486", - "modified": "2026-06-24T15:30:22.242365Z" + "modified": "2026-05-20T16:13:34.139215Z" }, { "id": "UBUNTU-CVE-2023-47039", - "modified": "2026-06-24T15:30:22.223640Z" + "modified": "2026-04-22T14:15:27.303492Z" }, { "id": "UBUNTU-CVE-2024-56406", @@ -5717,47 +8166,43 @@ interactions: }, { "id": "UBUNTU-CVE-2025-15649", - "modified": "2026-07-01T13:50:56.760041Z" + "modified": "2026-06-01T07:15:36.150813Z" }, { "id": "UBUNTU-CVE-2025-40909", - "modified": "2026-06-24T15:30:22.288512Z" + "modified": "2026-04-22T16:02:28.067448Z" }, { "id": "UBUNTU-CVE-2026-12087", - "modified": "2026-07-01T13:51:29.763714Z" + "modified": "2026-06-17T06:31:05.062220Z" }, { "id": "UBUNTU-CVE-2026-42496", - "modified": "2026-07-01T18:56:57.544972Z" + "modified": "2026-05-29T18:00:44.834841Z" }, { "id": "UBUNTU-CVE-2026-42497", - "modified": "2026-07-01T13:53:02.335741Z" + "modified": "2026-05-29T18:00:44.772881Z" }, { "id": "UBUNTU-CVE-2026-48959", - "modified": "2026-07-01T13:53:12.524471Z" + "modified": "2026-06-01T07:15:44.250395Z" }, { "id": "UBUNTU-CVE-2026-48961", - "modified": "2026-07-01T13:53:13.376190Z" + "modified": "2026-06-01T07:15:44.261753Z" }, { "id": "UBUNTU-CVE-2026-48962", - "modified": "2026-07-01T13:53:13.252080Z" - }, - { - "id": "UBUNTU-CVE-2026-7017", - "modified": "2026-07-09T17:15:52.841661Z" + "modified": "2026-05-29T18:01:00.200422Z" }, { "id": "UBUNTU-CVE-2026-8376", - "modified": "2026-07-01T18:57:39.513466Z" + "modified": "2026-05-29T18:01:03.136712Z" }, { "id": "UBUNTU-CVE-2026-9538", - "modified": "2026-07-01T13:53:19.355510Z" + "modified": "2026-05-29T18:01:01.753968Z" }, { "id": "USN-7434-1", @@ -5787,30 +8232,29 @@ interactions: "vulns": [ { "id": "UBUNTU-CVE-2025-45582", - "modified": "2026-07-06T16:00:24.944880Z" + "modified": "2026-05-20T16:23:29.580676Z" }, { "id": "UBUNTU-CVE-2026-5704", - "modified": "2026-06-26T14:47:36.043245Z" - }, - { - "id": "USN-8477-1", - "modified": "2026-06-26T14:59:24.298942Z" - }, - { - "id": "USN-8510-1", - "modified": "2026-07-06T20:34:34.654931Z" + "modified": "2026-05-20T16:26:24.372107Z" } ] }, {}, {}, - {} + { + "vulns": [ + { + "id": "UBUNTU-CVE-2026-27171", + "modified": "2026-06-16T13:30:42.791654Z" + } + ] + } ] } headers: Content-Length: - - "19399" + - "18291" Content-Type: - application/json status: 200 OK @@ -7105,7 +9549,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 12548 + content_length: 10676 body: | { "results": [ @@ -7117,10 +9561,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2024-58251", "modified": "2026-06-15T18:18:10.508036Z" @@ -7150,30 +9590,7 @@ interactions: } ] }, - { - "vulns": [ - { - "id": "GHSA-3wrr-7qpf-2prh", - "modified": "2026-06-30T05:59:24.605767Z" - }, - { - "id": "GHSA-5jmj-h7xm-6q6v", - "modified": "2026-06-30T21:15:09.170694Z" - }, - { - "id": "GHSA-hgj6-7826-r7m5", - "modified": "2026-06-25T00:29:24.783131Z" - }, - { - "id": "GHSA-j3rv-43j4-c7qm", - "modified": "2026-06-25T00:29:23.656899Z" - }, - { - "id": "GHSA-rmj7-2vxq-3g9f", - "modified": "2026-06-25T00:29:23.888358Z" - } - ] - }, + {}, {}, {}, {}, @@ -7370,7 +9787,7 @@ interactions: }, { "id": "GHSA-h2qv-fj59-j46j", - "modified": "2026-07-09T15:45:32.592357Z" + "modified": "2026-06-12T22:29:19.482629Z" } ] }, @@ -7434,7 +9851,7 @@ interactions: }, { "id": "GHSA-c2gf-v879-257j", - "modified": "2026-07-09T15:45:32.546754Z" + "modified": "2026-06-12T19:45:11.448753Z" }, { "id": "GHSA-f6hv-jmp6-3vwv", @@ -7475,7 +9892,7 @@ interactions: }, { "id": "GHSA-6jv9-x5w9-2ccm", - "modified": "2026-07-07T13:15:14.336923Z" + "modified": "2026-06-13T00:29:28.808735Z" }, { "id": "GHSA-rgrr-p7gp-5xj7", @@ -7540,11 +9957,11 @@ interactions: "vulns": [ { "id": "GHSA-5pvg-856g-cp85", - "modified": "2026-07-07T13:15:14.354147Z" + "modified": "2026-06-12T19:45:11.459442Z" }, { "id": "GHSA-676x-f7gg-47vc", - "modified": "2026-07-07T13:15:14.331855Z" + "modified": "2026-06-12T19:45:11.461282Z" }, { "id": "GHSA-xmv7-r254-6q78", @@ -7594,22 +10011,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-12797", "modified": "2026-06-15T18:18:10.256734Z" @@ -7620,35 +10021,35 @@ interactions: }, { "id": "ALPINE-CVE-2025-15467", - "modified": "2026-07-08T04:31:54.237773Z" + "modified": "2026-06-15T18:18:10.574070Z" }, { "id": "ALPINE-CVE-2025-15468", - "modified": "2026-07-08T04:31:54.236044Z" + "modified": "2026-06-15T18:18:10.574416Z" }, { "id": "ALPINE-CVE-2025-66199", - "modified": "2026-07-08T04:30:11.899340Z" + "modified": "2026-06-15T18:18:10.877115Z" }, { "id": "ALPINE-CVE-2025-68160", - "modified": "2026-07-08T04:32:27.950152Z" + "modified": "2026-06-15T18:18:10.890200Z" }, { "id": "ALPINE-CVE-2025-69418", - "modified": "2026-07-08T04:31:55.406338Z" + "modified": "2026-06-15T18:18:10.901963Z" }, { "id": "ALPINE-CVE-2025-69419", - "modified": "2026-07-08T04:31:54.597659Z" + "modified": "2026-06-15T18:18:10.902306Z" }, { "id": "ALPINE-CVE-2025-69420", - "modified": "2026-07-08T04:31:55.393Z" + "modified": "2026-06-15T18:18:10.902344Z" }, { "id": "ALPINE-CVE-2025-69421", - "modified": "2026-07-08T04:30:11.908070Z" + "modified": "2026-06-15T18:18:10.907897Z" }, { "id": "ALPINE-CVE-2025-9230", @@ -7664,35 +10065,35 @@ interactions: }, { "id": "ALPINE-CVE-2026-22795", - "modified": "2026-07-08T04:32:28.331714Z" + "modified": "2026-06-15T18:18:11.004265Z" }, { "id": "ALPINE-CVE-2026-22796", - "modified": "2026-07-08T04:32:29.030190Z" + "modified": "2026-06-15T18:18:11.007022Z" }, { "id": "ALPINE-CVE-2026-28387", - "modified": "2026-07-08T04:32:29.167238Z" + "modified": "2026-06-15T18:18:11.052819Z" }, { "id": "ALPINE-CVE-2026-28388", - "modified": "2026-07-08T04:32:29.169509Z" + "modified": "2026-06-15T18:18:11.053496Z" }, { "id": "ALPINE-CVE-2026-28389", - "modified": "2026-07-08T04:31:56.091480Z" + "modified": "2026-06-15T18:18:11.053742Z" }, { "id": "ALPINE-CVE-2026-28390", - "modified": "2026-07-08T04:31:57.860412Z" + "modified": "2026-06-15T18:18:11.053815Z" }, { "id": "ALPINE-CVE-2026-31789", - "modified": "2026-07-08T04:30:12.004739Z" + "modified": "2026-06-15T18:18:11.056839Z" }, { "id": "ALPINE-CVE-2026-31790", - "modified": "2026-07-08T04:32:29.132271Z" + "modified": "2026-06-15T18:18:11.057167Z" } ] }, @@ -7725,66 +10126,6 @@ interactions: { "id": "ALPINE-CVE-2026-32778", "modified": "2026-06-15T18:18:11.072930Z" - }, - { - "id": "ALPINE-CVE-2026-41080", - "modified": "2026-06-20T12:30:05.052957Z" - }, - { - "id": "ALPINE-CVE-2026-45186", - "modified": "2026-06-20T12:30:05.157190Z" - }, - { - "id": "ALPINE-CVE-2026-50219", - "modified": "2026-06-29T15:30:06.451101Z" - }, - { - "id": "ALPINE-CVE-2026-56131", - "modified": "2026-06-29T15:30:04.915303Z" - }, - { - "id": "ALPINE-CVE-2026-56132", - "modified": "2026-06-29T15:30:04.969406Z" - }, - { - "id": "ALPINE-CVE-2026-56403", - "modified": "2026-06-29T15:30:04.960433Z" - }, - { - "id": "ALPINE-CVE-2026-56404", - "modified": "2026-06-29T15:30:04.962121Z" - }, - { - "id": "ALPINE-CVE-2026-56405", - "modified": "2026-06-29T15:30:06.454363Z" - }, - { - "id": "ALPINE-CVE-2026-56406", - "modified": "2026-06-29T15:30:04.954590Z" - }, - { - "id": "ALPINE-CVE-2026-56407", - "modified": "2026-06-29T15:30:06.448330Z" - }, - { - "id": "ALPINE-CVE-2026-56408", - "modified": "2026-06-29T15:30:04.922465Z" - }, - { - "id": "ALPINE-CVE-2026-56409", - "modified": "2026-06-29T15:30:04.923913Z" - }, - { - "id": "ALPINE-CVE-2026-56410", - "modified": "2026-06-29T15:30:04.962352Z" - }, - { - "id": "ALPINE-CVE-2026-56411", - "modified": "2026-06-29T15:30:04.965868Z" - }, - { - "id": "ALPINE-CVE-2026-56412", - "modified": "2026-06-29T15:30:06.451950Z" } ] }, @@ -7805,23 +10146,27 @@ interactions: }, { "id": "ALPINE-CVE-2025-64506", - "modified": "2026-07-08T04:32:27.903394Z" + "modified": "2026-06-15T18:18:10.872647Z" }, { "id": "ALPINE-CVE-2025-64720", - "modified": "2026-07-08T04:32:27.945381Z" + "modified": "2026-06-15T18:18:10.873143Z" }, { "id": "ALPINE-CVE-2025-65018", - "modified": "2026-07-08T04:30:11.929041Z" + "modified": "2026-06-15T18:18:10.876130Z" }, { "id": "ALPINE-CVE-2025-66293", "modified": "2026-06-15T18:18:10.877635Z" }, + { + "id": "ALPINE-CVE-2026-22695", + "modified": "2026-06-15T18:18:11.003841Z" + }, { "id": "ALPINE-CVE-2026-22801", - "modified": "2026-07-08T04:32:29.119736Z" + "modified": "2026-06-15T18:18:11.007538Z" }, { "id": "ALPINE-CVE-2026-25646", @@ -7829,15 +10174,15 @@ interactions: }, { "id": "ALPINE-CVE-2026-33416", - "modified": "2026-07-08T04:32:29.121861Z" + "modified": "2026-06-15T18:18:11.088019Z" }, { "id": "ALPINE-CVE-2026-33636", - "modified": "2026-07-08T04:32:29.247323Z" + "modified": "2026-06-15T18:18:11.123880Z" }, { "id": "ALPINE-CVE-2026-34757", - "modified": "2026-07-08T04:31:57.961613Z" + "modified": "2026-06-15T18:18:11.210982Z" } ] }, @@ -7860,7 +10205,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2025-26519", - "modified": "2026-07-08T04:32:24.548042Z" + "modified": "2026-06-15T18:18:10.600004Z" }, { "id": "ALPINE-CVE-2026-40200", @@ -7996,11 +10341,11 @@ interactions: "vulns": [ { "id": "GHSA-2r2c-cx56-8933", - "modified": "2026-06-25T22:29:16.891915Z" + "modified": "2026-06-18T13:16:13.190648Z" }, { "id": "GHSA-47qp-hqvx-6r3f", - "modified": "2026-06-25T22:29:17.064782Z" + "modified": "2026-06-18T13:15:38.857601Z" } ] }, @@ -8010,26 +10355,15 @@ interactions: {}, {}, {}, - { - "vulns": [ - { - "id": "ALPINE-CVE-2026-2100", - "modified": "2026-06-25T10:30:05.031172Z" - } - ] - }, + {}, {}, {}, {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-35737", - "modified": "2026-07-08T04:31:20.295531Z" - }, { "id": "ALPINE-CVE-2025-29087", - "modified": "2026-07-08T04:31:54.511793Z" + "modified": "2026-06-15T18:27:20.198775Z" }, { "id": "ALPINE-CVE-2025-29088", @@ -8037,11 +10371,11 @@ interactions: }, { "id": "ALPINE-CVE-2025-3277", - "modified": "2026-07-08T04:32:24.444840Z" + "modified": "2026-06-15T18:26:20.400157Z" }, { "id": "ALPINE-CVE-2025-6965", - "modified": "2026-06-27T10:30:06.109296Z" + "modified": "2026-06-15T18:27:21.155416Z" } ] }, @@ -8056,7 +10390,7 @@ interactions: }, { "id": "ALPINE-CVE-2026-27171", - "modified": "2026-07-08T04:31:57.846862Z" + "modified": "2026-06-15T18:18:11.041363Z" } ] } @@ -8064,7 +10398,7 @@ interactions: } headers: Content-Length: - - "12548" + - "10676" Content-Type: - application/json status: 200 OK @@ -8582,7 +10916,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 2419 + content_length: 2085 body: | { "results": [ @@ -8720,7 +11054,7 @@ interactions: "vulns": [ { "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-07-07T17:57:29.434622Z" + "modified": "2026-03-24T01:43:53.135277Z" }, { "id": "GHSA-58qw-9mgm-455v", @@ -8728,7 +11062,7 @@ interactions: }, { "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-07-07T17:56:16.480954Z" + "modified": "2026-03-24T01:43:46.425088Z" }, { "id": "GHSA-jp4c-xjxw-mgf9", @@ -8738,25 +11072,13 @@ interactions: "id": "GHSA-mq26-g339-26xf", "modified": "2026-03-24T01:43:05.410801Z" }, - { - "id": "GHSA-wf93-45jw-7689", - "modified": "2026-07-08T21:26:17.521856Z" - }, { "id": "PYSEC-2023-228", "modified": "2026-06-10T17:01:27.606909Z" }, - { - "id": "PYSEC-2026-1795", - "modified": "2026-07-07T17:48:06.199964Z" - }, - { - "id": "PYSEC-2026-1796", - "modified": "2026-07-07T17:48:06.240646Z" - }, { "id": "PYSEC-2026-196", - "modified": "2026-07-08T21:26:17.521856Z" + "modified": "2026-06-05T12:45:14.124059Z" } ] }, @@ -8769,7 +11091,7 @@ interactions: }, { "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-07-07T17:57:13.326243Z" + "modified": "2026-02-04T03:54:02.259111Z" }, { "id": "GHSA-r9hx-vwmv-q579", @@ -8782,10 +11104,6 @@ interactions: { "id": "PYSEC-2025-49", "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "PYSEC-2026-1918", - "modified": "2026-07-07T17:57:13.326243Z" } ] }, @@ -8814,11 +11132,7 @@ interactions: "vulns": [ { "id": "GHSA-8rrh-rw8j-w5fx", - "modified": "2026-07-07T17:56:06.063831Z" - }, - { - "id": "PYSEC-2026-2047", - "modified": "2026-07-07T17:47:43.451695Z" + "modified": "2026-02-04T03:06:55.268134Z" } ] }, @@ -8827,7 +11141,7 @@ interactions: } headers: Content-Length: - - "2419" + - "2085" Content-Type: - application/json status: 200 OK @@ -9436,7 +11750,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 5776 + content_length: 4848 body: | { "results": [ @@ -9468,15 +11782,11 @@ interactions: }, { "id": "GHSA-rrqc-c2jx-6jgv", - "modified": "2026-07-07T17:57:34.018251Z" + "modified": "2024-10-30T19:23:59.139649Z" }, { "id": "PYSEC-2021-98", "modified": "2023-12-06T01:01:16.755410Z" - }, - { - "id": "PYSEC-2026-1297", - "modified": "2026-07-07T17:57:34.018251Z" } ] }, @@ -9522,11 +11832,7 @@ interactions: }, { "id": "GHSA-87hc-h4r5-73f7", - "modified": "2026-07-07T17:56:19.044748Z" - }, - { - "id": "PYSEC-2026-2044", - "modified": "2026-07-07T17:47:56.418445Z" + "modified": "2026-02-04T03:18:07.993642Z" } ] }, @@ -9573,7 +11879,7 @@ interactions: "vulns": [ { "id": "GHSA-65pc-fj4g-8rjx", - "modified": "2026-07-08T17:45:15.021597Z" + "modified": "2026-06-16T16:26:11.904403Z" }, { "id": "GHSA-jjg7-2v4v-x38h", @@ -9688,7 +11994,7 @@ interactions: "vulns": [ { "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-07-07T17:57:29.434622Z" + "modified": "2026-03-24T01:43:53.135277Z" }, { "id": "GHSA-58qw-9mgm-455v", @@ -9696,7 +12002,7 @@ interactions: }, { "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-07-07T17:56:16.480954Z" + "modified": "2026-03-24T01:43:46.425088Z" }, { "id": "GHSA-jp4c-xjxw-mgf9", @@ -9706,25 +12012,13 @@ interactions: "id": "GHSA-mq26-g339-26xf", "modified": "2026-03-24T01:43:05.410801Z" }, - { - "id": "GHSA-wf93-45jw-7689", - "modified": "2026-07-08T21:26:17.521856Z" - }, { "id": "PYSEC-2023-228", "modified": "2026-06-10T17:01:27.606909Z" }, - { - "id": "PYSEC-2026-1795", - "modified": "2026-07-07T17:48:06.199964Z" - }, - { - "id": "PYSEC-2026-1796", - "modified": "2026-07-07T17:48:06.240646Z" - }, { "id": "PYSEC-2026-196", - "modified": "2026-07-08T21:26:17.521856Z" + "modified": "2026-06-05T12:45:14.124059Z" } ] }, @@ -9733,11 +12027,11 @@ interactions: "vulns": [ { "id": "GHSA-9hjg-9r4m-mvj7", - "modified": "2026-07-07T17:56:56.234172Z" + "modified": "2026-02-04T03:44:00.676479Z" }, { "id": "GHSA-9wx4-h78v-vm56", - "modified": "2026-07-07T17:57:17.012984Z" + "modified": "2026-02-04T02:43:42.271895Z" }, { "id": "GHSA-gc5v-m9x4-r6x2", @@ -9750,14 +12044,6 @@ interactions: { "id": "PYSEC-2023-74", "modified": "2023-11-08T04:12:35.436175Z" - }, - { - "id": "PYSEC-2026-1872", - "modified": "2026-07-07T17:47:00.332079Z" - }, - { - "id": "PYSEC-2026-1873", - "modified": "2026-07-07T17:46:36.762141Z" } ] }, @@ -9770,7 +12056,7 @@ interactions: }, { "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-07-07T17:57:13.326243Z" + "modified": "2026-02-04T03:54:02.259111Z" }, { "id": "GHSA-r9hx-vwmv-q579", @@ -9783,10 +12069,6 @@ interactions: { "id": "PYSEC-2025-49", "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "PYSEC-2026-1918", - "modified": "2026-07-07T17:57:13.326243Z" } ] }, @@ -9815,15 +12097,15 @@ interactions: "vulns": [ { "id": "GHSA-2xpw-w6gg-jr37", - "modified": "2026-07-07T17:56:33.872074Z" + "modified": "2026-02-04T02:36:12.983430Z" }, { "id": "GHSA-34jh-p97f-mpxf", - "modified": "2026-07-07T17:56:53.715123Z" + "modified": "2026-02-04T03:37:44.850742Z" }, { "id": "GHSA-38jv-5279-wg99", - "modified": "2026-07-07T17:56:31.346111Z" + "modified": "2026-02-04T03:51:36.162029Z" }, { "id": "GHSA-g4mx-q9vg-27p4", @@ -9831,11 +12113,11 @@ interactions: }, { "id": "GHSA-gm62-xv2j-4w53", - "modified": "2026-07-07T17:57:28.931610Z" + "modified": "2026-02-04T03:37:15.919661Z" }, { "id": "GHSA-pq67-6m6q-mj2v", - "modified": "2026-07-07T17:56:41.872294Z" + "modified": "2026-02-04T04:38:01.163387Z" }, { "id": "GHSA-qccp-gfcp-xxvc", @@ -9864,26 +12146,6 @@ interactions: { "id": "PYSEC-2026-141", "modified": "2026-05-20T09:19:20.983812Z" - }, - { - "id": "PYSEC-2026-1994", - "modified": "2026-07-07T17:48:15.379954Z" - }, - { - "id": "PYSEC-2026-1995", - "modified": "2026-07-07T17:48:15.400192Z" - }, - { - "id": "PYSEC-2026-1996", - "modified": "2026-07-07T17:48:15.382053Z" - }, - { - "id": "PYSEC-2026-1998", - "modified": "2026-07-07T17:47:54.140852Z" - }, - { - "id": "PYSEC-2026-1999", - "modified": "2026-07-07T17:47:54.161376Z" } ] }, @@ -9891,11 +12153,7 @@ interactions: "vulns": [ { "id": "GHSA-8rrh-rw8j-w5fx", - "modified": "2026-07-07T17:56:06.063831Z" - }, - { - "id": "PYSEC-2026-2047", - "modified": "2026-07-07T17:47:43.451695Z" + "modified": "2026-02-04T03:06:55.268134Z" } ] }, @@ -9904,7 +12162,7 @@ interactions: } headers: Content-Length: - - "5776" + - "4848" Content-Type: - application/json status: 200 OK @@ -10030,7 +12288,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 5954 + content_length: 5475 body: | { "results": [ @@ -10039,10 +12297,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2024-58251", "modified": "2026-06-15T18:18:10.508036Z" @@ -10145,7 +12399,7 @@ interactions: }, { "id": "GO-2025-4014", - "modified": "2026-06-26T12:29:46.364453Z" + "modified": "2026-06-04T10:29:16.617520Z" }, { "id": "GO-2025-4015", @@ -10153,7 +12407,7 @@ interactions: }, { "id": "GO-2025-4155", - "modified": "2026-07-09T10:44:32.536665Z" + "modified": "2026-06-12T10:29:15.211985Z" }, { "id": "GO-2025-4175", @@ -10161,7 +12415,7 @@ interactions: }, { "id": "GO-2026-4337", - "modified": "2026-07-07T10:29:23.547454Z" + "modified": "2026-06-12T10:29:15.605437Z" }, { "id": "GO-2026-4340", @@ -10169,11 +12423,11 @@ interactions: }, { "id": "GO-2026-4341", - "modified": "2026-07-07T10:29:23.472772Z" + "modified": "2026-06-12T10:29:15.035295Z" }, { "id": "GO-2026-4342", - "modified": "2026-07-02T10:44:29.686144Z" + "modified": "2026-06-12T10:29:15.283039Z" }, { "id": "GO-2026-4403", @@ -10181,7 +12435,7 @@ interactions: }, { "id": "GO-2026-4601", - "modified": "2026-07-09T10:44:32.269952Z" + "modified": "2026-06-17T10:29:19.633057Z" }, { "id": "GO-2026-4602", @@ -10193,7 +12447,7 @@ interactions: }, { "id": "GO-2026-4864", - "modified": "2026-07-09T10:44:33.381720Z" + "modified": "2026-06-16T10:29:15.527117Z" }, { "id": "GO-2026-4865", @@ -10205,23 +12459,19 @@ interactions: }, { "id": "GO-2026-4870", - "modified": "2026-07-09T10:44:33.055212Z" + "modified": "2026-06-17T10:29:19.204036Z" }, { "id": "GO-2026-4918", - "modified": "2026-06-27T10:44:20.771417Z" + "modified": "2026-05-11T08:11:05.383192Z" }, { "id": "GO-2026-4946", - "modified": "2026-07-09T10:44:33.129570Z" + "modified": "2026-06-17T10:29:19.549582Z" }, { "id": "GO-2026-4947", - "modified": "2026-07-09T10:44:33.192298Z" - }, - { - "id": "GO-2026-4970", - "modified": "2026-07-08T20:29:26.853236Z" + "modified": "2026-06-17T10:29:19.948808Z" }, { "id": "GO-2026-4971", @@ -10229,7 +12479,7 @@ interactions: }, { "id": "GO-2026-4976", - "modified": "2026-06-27T10:44:21.221469Z" + "modified": "2026-05-11T08:11:26.883618Z" }, { "id": "GO-2026-4977", @@ -10241,11 +12491,11 @@ interactions: }, { "id": "GO-2026-4981", - "modified": "2026-07-09T10:44:32.677126Z" + "modified": "2026-06-09T10:29:17.671297Z" }, { "id": "GO-2026-4982", - "modified": "2026-06-27T10:44:21.066171Z" + "modified": "2026-05-11T08:11:21.041304Z" }, { "id": "GO-2026-4986", @@ -10253,7 +12503,7 @@ interactions: }, { "id": "GO-2026-5037", - "modified": "2026-07-09T10:44:33.680614Z" + "modified": "2026-06-05T07:56:06.303534Z" }, { "id": "GO-2026-5038", @@ -10261,32 +12511,12 @@ interactions: }, { "id": "GO-2026-5039", - "modified": "2026-06-27T10:44:21.143168Z" - }, - { - "id": "GO-2026-5856", - "modified": "2026-07-08T20:29:26.756890Z" + "modified": "2026-06-05T07:56:26.571479Z" } ] }, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-12797", "modified": "2026-06-15T18:18:10.256734Z" @@ -10301,7 +12531,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -10309,35 +12539,35 @@ interactions: }, { "id": "ALPINE-CVE-2025-15467", - "modified": "2026-07-08T04:31:54.237773Z" + "modified": "2026-06-15T18:18:10.574070Z" }, { "id": "ALPINE-CVE-2025-15468", - "modified": "2026-07-08T04:31:54.236044Z" + "modified": "2026-06-15T18:18:10.574416Z" }, { "id": "ALPINE-CVE-2025-66199", - "modified": "2026-07-08T04:30:11.899340Z" + "modified": "2026-06-15T18:18:10.877115Z" }, { "id": "ALPINE-CVE-2025-68160", - "modified": "2026-07-08T04:32:27.950152Z" + "modified": "2026-06-15T18:18:10.890200Z" }, { "id": "ALPINE-CVE-2025-69418", - "modified": "2026-07-08T04:31:55.406338Z" + "modified": "2026-06-15T18:18:10.901963Z" }, { "id": "ALPINE-CVE-2025-69419", - "modified": "2026-07-08T04:31:54.597659Z" + "modified": "2026-06-15T18:18:10.902306Z" }, { "id": "ALPINE-CVE-2025-69420", - "modified": "2026-07-08T04:31:55.393Z" + "modified": "2026-06-15T18:18:10.902344Z" }, { "id": "ALPINE-CVE-2025-69421", - "modified": "2026-07-08T04:30:11.908070Z" + "modified": "2026-06-15T18:18:10.907897Z" }, { "id": "ALPINE-CVE-2025-9230", @@ -10353,35 +12583,35 @@ interactions: }, { "id": "ALPINE-CVE-2026-22795", - "modified": "2026-07-08T04:32:28.331714Z" + "modified": "2026-06-15T18:18:11.004265Z" }, { "id": "ALPINE-CVE-2026-22796", - "modified": "2026-07-08T04:32:29.030190Z" + "modified": "2026-06-15T18:18:11.007022Z" }, { "id": "ALPINE-CVE-2026-28387", - "modified": "2026-07-08T04:32:29.167238Z" + "modified": "2026-06-15T18:18:11.052819Z" }, { "id": "ALPINE-CVE-2026-28388", - "modified": "2026-07-08T04:32:29.169509Z" + "modified": "2026-06-15T18:18:11.053496Z" }, { "id": "ALPINE-CVE-2026-28389", - "modified": "2026-07-08T04:31:56.091480Z" + "modified": "2026-06-15T18:18:11.053742Z" }, { "id": "ALPINE-CVE-2026-28390", - "modified": "2026-07-08T04:31:57.860412Z" + "modified": "2026-06-15T18:18:11.053815Z" }, { "id": "ALPINE-CVE-2026-31789", - "modified": "2026-07-08T04:30:12.004739Z" + "modified": "2026-06-15T18:18:11.056839Z" }, { "id": "ALPINE-CVE-2026-31790", - "modified": "2026-07-08T04:32:29.132271Z" + "modified": "2026-06-15T18:18:11.057167Z" } ] }, @@ -10389,7 +12619,7 @@ interactions: "vulns": [ { "id": "ALPINE-CVE-2025-26519", - "modified": "2026-07-08T04:32:24.548042Z" + "modified": "2026-06-15T18:18:10.600004Z" }, { "id": "ALPINE-CVE-2026-40200", @@ -10411,7 +12641,7 @@ interactions: }, { "id": "ALPINE-CVE-2026-27171", - "modified": "2026-07-08T04:31:57.846862Z" + "modified": "2026-06-15T18:18:11.041363Z" } ] } @@ -10419,7 +12649,7 @@ interactions: } headers: Content-Length: - - "5954" + - "5475" Content-Type: - application/json status: 200 OK @@ -11005,7 +13235,7 @@ interactions: "ecosystem": "Go", "name": "stdlib" }, - "version": "1.26.0" + "version": "1.25.7" }, { "package": { @@ -11017,16 +13247,16 @@ interactions: { "package": { "ecosystem": "Ubuntu:26.04", - "name": "golang-1.26-go" + "name": "golang-1.25-go" }, - "version": "1.26.0-1" + "version": "1.25.7-2" }, { "package": { "ecosystem": "Ubuntu:26.04", - "name": "golang-1.26-src" + "name": "golang-1.25-src" }, - "version": "1.26.0-1" + "version": "1.25.7-2" }, { "package": { @@ -11160,7 +13390,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1758 + content_length: 1443 body: | { "results": [ @@ -11179,17 +13409,9 @@ interactions: {}, { "vulns": [ - { - "id": "GO-2026-4599", - "modified": "2026-07-09T10:44:32.987177Z" - }, - { - "id": "GO-2026-4600", - "modified": "2026-05-15T10:59:23.758905Z" - }, { "id": "GO-2026-4601", - "modified": "2026-07-09T10:44:32.269952Z" + "modified": "2026-06-17T10:29:19.633057Z" }, { "id": "GO-2026-4602", @@ -11201,39 +13423,31 @@ interactions: }, { "id": "GO-2026-4864", - "modified": "2026-07-09T10:44:33.381720Z" + "modified": "2026-06-16T10:29:15.527117Z" }, { "id": "GO-2026-4865", "modified": "2026-05-15T10:59:24.648972Z" }, - { - "id": "GO-2026-4866", - "modified": "2026-07-09T10:44:32.922860Z" - }, { "id": "GO-2026-4869", "modified": "2026-05-15T10:59:23.054049Z" }, { "id": "GO-2026-4870", - "modified": "2026-07-09T10:44:33.055212Z" + "modified": "2026-06-17T10:29:19.204036Z" }, { "id": "GO-2026-4918", - "modified": "2026-06-27T10:44:20.771417Z" + "modified": "2026-05-11T08:11:05.383192Z" }, { "id": "GO-2026-4946", - "modified": "2026-07-09T10:44:33.129570Z" + "modified": "2026-06-17T10:29:19.549582Z" }, { "id": "GO-2026-4947", - "modified": "2026-07-09T10:44:33.192298Z" - }, - { - "id": "GO-2026-4970", - "modified": "2026-07-08T20:29:26.853236Z" + "modified": "2026-06-17T10:29:19.948808Z" }, { "id": "GO-2026-4971", @@ -11241,7 +13455,7 @@ interactions: }, { "id": "GO-2026-4976", - "modified": "2026-06-27T10:44:21.221469Z" + "modified": "2026-05-11T08:11:26.883618Z" }, { "id": "GO-2026-4977", @@ -11253,11 +13467,11 @@ interactions: }, { "id": "GO-2026-4981", - "modified": "2026-07-09T10:44:32.677126Z" + "modified": "2026-06-09T10:29:17.671297Z" }, { "id": "GO-2026-4982", - "modified": "2026-06-27T10:44:21.066171Z" + "modified": "2026-05-11T08:11:21.041304Z" }, { "id": "GO-2026-4986", @@ -11265,7 +13479,7 @@ interactions: }, { "id": "GO-2026-5037", - "modified": "2026-07-09T10:44:33.680614Z" + "modified": "2026-06-05T07:56:06.303534Z" }, { "id": "GO-2026-5038", @@ -11273,11 +13487,7 @@ interactions: }, { "id": "GO-2026-5039", - "modified": "2026-06-27T10:44:21.143168Z" - }, - { - "id": "GO-2026-5856", - "modified": "2026-07-08T20:29:26.756890Z" + "modified": "2026-06-05T07:56:26.571479Z" } ] }, @@ -11305,7 +13515,7 @@ interactions: } headers: Content-Length: - - "1758" + - "1443" Content-Type: - application/json status: 200 OK @@ -11410,7 +13620,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -11419,10 +13629,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11453,22 +13659,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -11491,7 +13681,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -11515,7 +13705,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -11641,7 +13831,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1729 + content_length: 1373 body: | { "results": [ @@ -11650,10 +13840,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11692,22 +13878,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -11730,7 +13900,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -11767,7 +13937,7 @@ interactions: } headers: Content-Length: - - "1729" + - "1373" Content-Type: - application/json status: 200 OK @@ -11872,7 +14042,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -11881,10 +14051,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -11915,22 +14081,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -11953,7 +14103,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -11977,7 +14127,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12082,7 +14232,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -12091,10 +14241,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -12125,22 +14271,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -12163,7 +14293,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -12187,7 +14317,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12292,7 +14422,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -12301,10 +14431,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -12335,22 +14461,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -12373,7 +14483,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -12397,7 +14507,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12502,7 +14612,7 @@ interactions: proto: HTTP/2.0 proto_major: 2 proto_minor: 0 - content_length: 1492 + content_length: 1136 body: | { "results": [ @@ -12511,10 +14621,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2021-42376", - "modified": "2026-07-08T04:32:12.032317Z" - }, { "id": "ALPINE-CVE-2023-42363", "modified": "2026-06-15T18:18:10.016406Z" @@ -12545,22 +14651,6 @@ interactions: {}, { "vulns": [ - { - "id": "ALPINE-CVE-2022-1292", - "modified": "2026-07-08T04:31:47.244657Z" - }, - { - "id": "ALPINE-CVE-2022-2068", - "modified": "2026-07-08T04:31:47.874039Z" - }, - { - "id": "ALPINE-CVE-2023-0466", - "modified": "2026-07-08T04:31:25.432482Z" - }, - { - "id": "ALPINE-CVE-2023-4807", - "modified": "2026-07-08T04:32:27.043928Z" - }, { "id": "ALPINE-CVE-2024-13176", "modified": "2026-06-15T18:18:10.257313Z" @@ -12583,7 +14673,7 @@ interactions: }, { "id": "ALPINE-CVE-2024-6119", - "modified": "2026-07-08T04:32:23.263115Z" + "modified": "2026-06-15T18:18:10.508459Z" }, { "id": "ALPINE-CVE-2024-9143", @@ -12607,7 +14697,7 @@ interactions: } headers: Content-Length: - - "1492" + - "1136" Content-Type: - application/json status: 200 OK @@ -12650,15 +14740,15 @@ interactions: "vulns": [ { "id": "CVE-2023-53154", - "modified": "2026-07-08T06:26:38.454222Z" + "modified": "2026-03-14T12:23:16.581554Z" }, { "id": "CVE-2024-31755", - "modified": "2026-07-08T07:33:43.941104Z" + "modified": "2026-04-16T04:31:52.195461Z" }, { "id": "CVE-2025-57052", - "modified": "2026-07-08T07:01:33.149073Z" + "modified": "2026-04-10T05:30:21.542728Z" } ] } diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index 19128145f0f..b64e77f150c 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -1078,136 +1078,6 @@ interactions: status: 200 OK code: 200 duration: 0s - - request: - proto: HTTP/1.1 - proto_major: 1 - proto_minor: 1 - content_length: 626 - host: api.osv.dev - body: | - { - "queries": [ - { - "package": { - "ecosystem": "PyPI", - "name": "gpg" - }, - "version": "1.15.1" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "libcomps" - }, - "version": "0.1.18" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "pip" - }, - "version": "21.2.3" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "rpm" - }, - "version": "4.16.1.3" - }, - { - "package": { - "ecosystem": "PyPI", - "name": "setuptools" - }, - "version": "53.0.0" - } - ] - } - headers: - Content-Type: - - application/json - X-Test-Name: - - TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image - url: https://api.osv.dev/v1/querybatch - method: POST - response: - proto: HTTP/2.0 - proto_major: 2 - proto_minor: 0 - content_length: 867 - body: | - { - "results": [ - {}, - {}, - { - "vulns": [ - { - "id": "GHSA-4xh5-x5gv-qwph", - "modified": "2026-03-24T01:43:53.135277Z" - }, - { - "id": "GHSA-58qw-9mgm-455v", - "modified": "2026-05-20T21:00:09.920997Z" - }, - { - "id": "GHSA-6vgw-5pg2-w6jp", - "modified": "2026-03-24T01:43:46.425088Z" - }, - { - "id": "GHSA-jp4c-xjxw-mgf9", - "modified": "2026-05-07T16:59:14.079020Z" - }, - { - "id": "GHSA-mq26-g339-26xf", - "modified": "2026-03-24T01:43:05.410801Z" - }, - { - "id": "PYSEC-2023-228", - "modified": "2026-03-24T01:42:37.905754Z" - }, - { - "id": "PYSEC-2026-196", - "modified": "2026-06-05T12:45:14.124059Z" - } - ] - }, - {}, - { - "vulns": [ - { - "id": "GHSA-5rjg-fvgr-3xxf", - "modified": "2026-05-11T00:26:34.671259Z" - }, - { - "id": "GHSA-cx63-2mw6-8hw5", - "modified": "2026-02-04T03:54:02.259111Z" - }, - { - "id": "GHSA-r9hx-vwmv-q579", - "modified": "2026-02-04T03:03:25.892107Z" - }, - { - "id": "PYSEC-2022-43012", - "modified": "2023-12-06T01:02:35.662444Z" - }, - { - "id": "PYSEC-2025-49", - "modified": "2026-05-11T00:26:34.671259Z" - } - ] - } - ] - } - headers: - Content-Length: - - "867" - Content-Type: - - application/json - status: 200 OK - code: 200 - duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/go.mod b/go.mod index bd251985178..c49d5032131 100644 --- a/go.mod +++ b/go.mod @@ -215,3 +215,4 @@ require ( www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 // indirect ) +replace github.com/google/osv-scalibr => github.com/herdiyana256/osv-scalibr v0.4.6-0.20260618122241-4aa61fbd095f diff --git a/go.sum b/go.sum index 011959e3f7e..f262310c99a 100644 --- a/go.sum +++ b/go.sum @@ -247,8 +247,6 @@ github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEE github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y= github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0= github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE= -github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e h1:cQTtydMwNMniteU1xth8JECOBS6vtw0FIjZVZUAqAJo= -github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -259,6 +257,8 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= +github.com/herdiyana256/osv-scalibr v0.4.6-0.20260618122241-4aa61fbd095f h1:xZgSQPL62/VQLrpgB1SPWB59nM3m38hVFdijhU7nK90= +github.com/herdiyana256/osv-scalibr v0.4.6-0.20260618122241-4aa61fbd095f/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg= github.com/ianlancetaylor/demangle v0.0.0-20260505044615-1ff4bf46051f h1:NW3E2QSchEk63/fjeEvWOa2cE02FSv9ox//VE/N4c8g= diff --git a/internal/scalibrplugin/presets.go b/internal/scalibrplugin/presets.go index 67c2b611603..1e05056bd40 100644 --- a/internal/scalibrplugin/presets.go +++ b/internal/scalibrplugin/presets.go @@ -52,6 +52,7 @@ import ( "github.com/google/osv-scalibr/extractor/filesystem/os/chisel" "github.com/google/osv-scalibr/extractor/filesystem/os/dpkg" "github.com/google/osv-scalibr/extractor/filesystem/os/homebrew" + "github.com/google/osv-scalibr/extractor/filesystem/os/rpm" "github.com/google/osv-scalibr/extractor/filesystem/sbom/cdx" "github.com/google/osv-scalibr/extractor/filesystem/sbom/spdx" "github.com/google/osv-scanner/v2/internal/scalibrextract/filesystem/vendored" @@ -166,6 +167,8 @@ var ExtractorPresets = map[string]extractors.InitMap{ chisel.Name: {chisel.New}, // Homebrew homebrew.Name: {homebrew.New}, + // RPM-based (AlmaLinux, RHEL, Rocky, CentOS, Fedora) + rpm.Name: {rpm.New}, }, } From 29d5b5f3a4ff9897bcea343db17664aebacf93a0 Mon Sep 17 00:00:00 2001 From: Herdiyan Adam Putra Date: Mon, 13 Jul 2026 20:00:23 +0700 Subject: [PATCH 3/4] fix: rebase onto main, drop fork replace, bump scalibr, update AlmaLinux snapshot - Rebase onto upstream/main (includes snapshot refresh #2920, #2921) - Drop go.mod replace directive: google/osv-scalibr#2250 (AlmaLinux VERSION_ID trim) is now merged upstream - Bump osv-scalibr to v0.4.6-0.20260713000915-500ad84f4ed1 (official upstream) - Regenerate TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image snapshot and cassette with updated scalibr --- .../image/__snapshots__/command_test.snap | 1236 +++++++- .../TestCommand_OCIImage_JSONFormat.yaml | 2707 +++++++++++++++++ go.mod | 4 +- go.sum | 4 +- 4 files changed, 3945 insertions(+), 6 deletions(-) diff --git a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap index ba119984276..5c4059cd2b5 100755 --- a/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/image/__snapshots__/command_test.snap @@ -2271,12 +2271,15 @@ Scanning local image tarball "./testdata/test-python-full.tar" "groups": 6, "vulnerabilities": [ "PYSEC-2023-228", + "PYSEC-2026-1795", + "PYSEC-2026-1796", "PYSEC-2026-196", "GHSA-4xh5-x5gv-qwph", "GHSA-58qw-9mgm-455v", "GHSA-6vgw-5pg2-w6jp", "GHSA-jp4c-xjxw-mgf9", - "GHSA-mq26-g339-26xf" + "GHSA-mq26-g339-26xf", + "GHSA-wf93-45jw-7689" ] } ] @@ -2300,12 +2303,1243 @@ Scanning local image tarball "./testdata/test-python-full.tar" "vulnerabilities": [ "PYSEC-2022-43012", "PYSEC-2025-49", + "PYSEC-2026-1918", "GHSA-5rjg-fvgr-3xxf", "GHSA-cx63-2mw6-8hw5", "GHSA-r9hx-vwmv-q579" ] } ] + }, + { + "source": { + "path": "/var/lib/rpm/rpmdb.sqlite", + "type": "os" + }, + "packages": [ + { + "package": { + "name": "bash", + "os_package_name": "bash", + "version": "5.1.8-4.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:0340" + ] + }, + { + "package": { + "name": "binutils", + "os_package_name": "binutils", + "version": "2.35.2-17.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:6593", + "ALSA-2025:23343" + ] + }, + { + "package": { + "name": "binutils-gold", + "os_package_name": "binutils-gold", + "version": "2.35.2-17.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:6593", + "ALSA-2025:23343" + ] + }, + { + "package": { + "name": "bzip2-libs", + "os_package_name": "bzip2-libs", + "version": "1.0.8-8.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:0925" + ] + }, + { + "package": { + "name": "coreutils-single", + "os_package_name": "coreutils-single", + "version": "8.32-31.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:28911" + ] + }, + { + "package": { + "name": "curl-minimal", + "os_package_name": "curl-minimal", + "version": "7.76.1-14.el9_0.5", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 12, + "vulnerabilities": [ + "ALSA-2022:8299", + "ALSA-2023:0333", + "ALSA-2023:1701", + "ALSA-2023:2478", + "ALSA-2023:2650", + "ALSA-2023:4354", + "ALSA-2023:5763", + "ALSA-2023:6679", + "ALSA-2023:6745", + "ALSA-2024:1129", + "ALSA-2024:5529", + "ALSA-2026:1350" + ] + }, + { + "package": { + "name": "dbus", + "os_package_name": "dbus", + "version": "1.12.20-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:0335", + "ALSA-2023:4569" + ] + }, + { + "package": { + "name": "dbus-common", + "os_package_name": "dbus-common", + "version": "1.12.20-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:0335", + "ALSA-2023:4569" + ] + }, + { + "package": { + "name": "expat", + "os_package_name": "expat", + "version": "2.2.10-12.el9_0.3", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:0337", + "ALSA-2024:1530", + "ALSA-2024:6754", + "ALSA-2024:9541", + "ALSA-2025:22175", + "ALSA-2025:3531", + "ALSA-2025:7444", + "ALSA-2026:23230" + ] + }, + { + "package": { + "name": "file-libs", + "os_package_name": "file-libs", + "version": "5.39-8.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:2512" + ] + }, + { + "package": { + "name": "glib2", + "os_package_name": "glib2", + "version": "2.68.4-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:6631", + "ALSA-2024:6464", + "ALSA-2025:11140", + "ALSA-2026:0936", + "ALSA-2026:15971", + "ALSA-2026:19361" + ] + }, + { + "package": { + "name": "glibc", + "os_package_name": "glibc", + "version": "2.34-28.el9_0.2", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:5453", + "ALSA-2024:3339", + "ALSA-2025:4244", + "ALSA-2025:8655", + "ALSA-2025:9877", + "ALSA-2026:20597", + "ALSA-2026:2786", + "ALSA-2026:33226" + ] + }, + { + "package": { + "name": "glibc-common", + "os_package_name": "glibc-common", + "version": "2.34-28.el9_0.2", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:5453", + "ALSA-2024:3339", + "ALSA-2025:4244", + "ALSA-2025:8655", + "ALSA-2025:9877", + "ALSA-2026:20597", + "ALSA-2026:2786", + "ALSA-2026:33226" + ] + }, + { + "package": { + "name": "glibc-minimal-langpack", + "os_package_name": "glibc-minimal-langpack", + "version": "2.34-28.el9_0.2", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:5453", + "ALSA-2024:3339", + "ALSA-2025:4244", + "ALSA-2025:8655", + "ALSA-2025:9877", + "ALSA-2026:20597", + "ALSA-2026:2786", + "ALSA-2026:33226" + ] + }, + { + "package": { + "name": "gmp", + "os_package_name": "gmp", + "version": "6.2.0-10.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6661" + ] + }, + { + "package": { + "name": "gnupg2", + "os_package_name": "gnupg2", + "version": "2.3.3-2.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:0719" + ] + }, + { + "package": { + "name": "gnutls", + "os_package_name": "gnutls", + "version": "3.7.6-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 8, + "vulnerabilities": [ + "ALSA-2023:1141", + "ALSA-2024:0533", + "ALSA-2024:1879", + "ALSA-2024:2570", + "ALSA-2025:16116", + "ALSA-2025:7076", + "ALSA-2026:20612", + "ALSA-2026:4188" + ] + }, + { + "package": { + "name": "iputils", + "os_package_name": "iputils", + "version": "20210202-7.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2025:17558", + "ALSA-2025:9432" + ] + }, + { + "package": { + "name": "krb5-libs", + "os_package_name": "krb5-libs", + "version": "1.19.1-15.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 9, + "vulnerabilities": [ + "ALSA-2022:8637", + "ALSA-2023:2570", + "ALSA-2023:6699", + "ALSA-2024:6166", + "ALSA-2024:9331", + "ALSA-2024:9474", + "ALSA-2025:7067", + "ALSA-2025:9430", + "ALSA-2026:19357" + ] + }, + { + "package": { + "name": "less", + "os_package_name": "less", + "version": "590-1.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:3725", + "ALSA-2024:1692", + "ALSA-2024:3513" + ] + }, + { + "package": { + "name": "libarchive", + "os_package_name": "libarchive", + "version": "3.5.3-2.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 5, + "vulnerabilities": [ + "ALSA-2023:2532", + "ALSA-2025:14130", + "ALSA-2025:9431", + "ALSA-2026:5080", + "ALSA-2026:8510" + ] + }, + { + "package": { + "name": "libblkid", + "os_package_name": "libblkid", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libcap", + "os_package_name": "libcap", + "version": "2.48-8.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:5071", + "ALSA-2026:12441", + "ALSA-2026:19346" + ] + }, + { + "package": { + "name": "libcom_err", + "os_package_name": "libcom_err", + "version": "1.46.5-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2022:8361" + ] + }, + { + "package": { + "name": "libcurl-minimal", + "os_package_name": "libcurl-minimal", + "version": "7.76.1-14.el9_0.5", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 12, + "vulnerabilities": [ + "ALSA-2022:8299", + "ALSA-2023:0333", + "ALSA-2023:1701", + "ALSA-2023:2478", + "ALSA-2023:2650", + "ALSA-2023:4354", + "ALSA-2023:5763", + "ALSA-2023:6679", + "ALSA-2023:6745", + "ALSA-2024:1129", + "ALSA-2024:5529", + "ALSA-2026:1350" + ] + }, + { + "package": { + "name": "libeconf", + "os_package_name": "libeconf", + "version": "0.4.1-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:4347" + ] + }, + { + "package": { + "name": "libfdisk", + "os_package_name": "libfdisk", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libgcc", + "os_package_name": "libgcc", + "version": "11.2.1-9.4.el9.alma", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:1346" + ] + }, + { + "package": { + "name": "libgcrypt", + "os_package_name": "libgcrypt", + "version": "1.10.0-5.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:9404" + ] + }, + { + "package": { + "name": "libgomp", + "os_package_name": "libgomp", + "version": "11.2.1-9.4.el9.alma", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:1346" + ] + }, + { + "package": { + "name": "libksba", + "os_package_name": "libksba", + "version": "1.5.1-5.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:0626" + ] + }, + { + "package": { + "name": "libmount", + "os_package_name": "libmount", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libnghttp2", + "os_package_name": "libnghttp2", + "version": "1.43.0-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 4, + "vulnerabilities": [ + "ALSA-2023:5838", + "ALSA-2023:6746", + "ALSA-2024:3501", + "ALSA-2026:7668" + ] + }, + { + "package": { + "name": "libsmartcols", + "os_package_name": "libsmartcols", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libstdc++", + "os_package_name": "libstdc++", + "version": "11.2.1-9.4.el9.alma", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2025:1346" + ] + }, + { + "package": { + "name": "libtasn1", + "os_package_name": "libtasn1", + "version": "4.16.0-7.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:0343", + "ALSA-2025:7077", + "ALSA-2026:28253" + ] + }, + { + "package": { + "name": "libuuid", + "os_package_name": "libuuid", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "libxml2", + "os_package_name": "libxml2", + "version": "2.9.13-1.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 11, + "vulnerabilities": [ + "ALSA-2023:0338", + "ALSA-2023:4349", + "ALSA-2023:7747", + "ALSA-2024:2679", + "ALSA-2025:10699", + "ALSA-2025:12447", + "ALSA-2025:13428", + "ALSA-2025:1350", + "ALSA-2025:22376", + "ALSA-2025:2679", + "ALSA-2026:28254" + ] + }, + { + "package": { + "name": "lua-libs", + "os_package_name": "lua-libs", + "version": "5.4.2-4.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2022:7329", + "ALSA-2023:0957", + "ALSA-2023:2582" + ] + }, + { + "package": { + "name": "ncurses-base", + "os_package_name": "ncurses-base", + "version": "6.2-8.20210508.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6698" + ] + }, + { + "package": { + "name": "ncurses-libs", + "os_package_name": "ncurses-libs", + "version": "6.2-8.20210508.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6698" + ] + }, + { + "package": { + "name": "openssl", + "os_package_name": "openssl", + "version": "3.0.1-43.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 15, + "vulnerabilities": [ + "ALSA-2022:6224", + "ALSA-2022:7288", + "ALSA-2023:0946", + "ALSA-2023:2523", + "ALSA-2023:3722", + "ALSA-2024:0310", + "ALSA-2024:2447", + "ALSA-2024:6783", + "ALSA-2024:9333", + "ALSA-2025:1330", + "ALSA-2025:21255", + "ALSA-2026:1473", + "ALSA-2026:19218", + "ALSA-2026:22312", + "ALSA-2026:25239" + ] + }, + { + "package": { + "name": "openssl-libs", + "os_package_name": "openssl-libs", + "version": "3.0.1-43.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 15, + "vulnerabilities": [ + "ALSA-2022:6224", + "ALSA-2022:7288", + "ALSA-2023:0946", + "ALSA-2023:2523", + "ALSA-2023:3722", + "ALSA-2024:0310", + "ALSA-2024:2447", + "ALSA-2024:6783", + "ALSA-2024:9333", + "ALSA-2025:1330", + "ALSA-2025:21255", + "ALSA-2026:1473", + "ALSA-2026:19218", + "ALSA-2026:22312", + "ALSA-2026:25239" + ] + }, + { + "package": { + "name": "p11-kit", + "os_package_name": "p11-kit", + "version": "0.24.1-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:18599" + ] + }, + { + "package": { + "name": "p11-kit-trust", + "os_package_name": "p11-kit-trust", + "version": "0.24.1-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:18599" + ] + }, + { + "package": { + "name": "pam", + "os_package_name": "pam", + "version": "1.5.1-9.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 5, + "vulnerabilities": [ + "ALSA-2024:10244", + "ALSA-2024:11250", + "ALSA-2024:2438", + "ALSA-2025:15099", + "ALSA-2025:9526" + ] + }, + { + "package": { + "name": "python3", + "os_package_name": "python3", + "version": "3.9.10-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 24, + "vulnerabilities": [ + "ALSA-2022:7323", + "ALSA-2022:8353", + "ALSA-2022:8493", + "ALSA-2023:0953", + "ALSA-2023:3595", + "ALSA-2023:5462", + "ALSA-2023:6659", + "ALSA-2024:0466", + "ALSA-2024:10983", + "ALSA-2024:4078", + "ALSA-2024:4779", + "ALSA-2024:6163", + "ALSA-2024:8446", + "ALSA-2024:9371", + "ALSA-2024:9468", + "ALSA-2025:10136", + "ALSA-2025:15019", + "ALSA-2025:23342", + "ALSA-2025:6977", + "ALSA-2026:10949", + "ALSA-2026:1478", + "ALSA-2026:19216", + "ALSA-2026:4168", + "ALSA-2026:6766" + ] + }, + { + "package": { + "name": "python3-libs", + "os_package_name": "python3-libs", + "version": "3.9.10-2.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 24, + "vulnerabilities": [ + "ALSA-2022:7323", + "ALSA-2022:8353", + "ALSA-2022:8493", + "ALSA-2023:0953", + "ALSA-2023:3595", + "ALSA-2023:5462", + "ALSA-2023:6659", + "ALSA-2024:0466", + "ALSA-2024:10983", + "ALSA-2024:4078", + "ALSA-2024:4779", + "ALSA-2024:6163", + "ALSA-2024:8446", + "ALSA-2024:9371", + "ALSA-2024:9468", + "ALSA-2025:10136", + "ALSA-2025:15019", + "ALSA-2025:23342", + "ALSA-2025:6977", + "ALSA-2026:10949", + "ALSA-2026:1478", + "ALSA-2026:19216", + "ALSA-2026:4168", + "ALSA-2026:6766" + ] + }, + { + "package": { + "name": "python3-pip-wheel", + "os_package_name": "python3-pip-wheel", + "version": "21.2.3-6.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6694" + ] + }, + { + "package": { + "name": "python3-rpm", + "os_package_name": "python3-rpm", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "python3-setuptools-wheel", + "os_package_name": "python3-setuptools-wheel", + "version": "53.0.0-10.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 3, + "vulnerabilities": [ + "ALSA-2023:0952", + "ALSA-2024:5534", + "ALSA-2025:10407" + ] + }, + { + "package": { + "name": "rpm", + "os_package_name": "rpm", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "rpm-build-libs", + "os_package_name": "rpm-build-libs", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "rpm-libs", + "os_package_name": "rpm-libs", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "rpm-sign-libs", + "os_package_name": "rpm-sign-libs", + "version": "4.16.1.3-12.el9_0", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2024:0463" + ] + }, + { + "package": { + "name": "shadow-utils", + "os_package_name": "shadow-utils", + "version": "4.9-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:6632", + "ALSA-2025:20559" + ] + }, + { + "package": { + "name": "sqlite-libs", + "os_package_name": "sqlite-libs", + "version": "3.34.1-5.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 4, + "vulnerabilities": [ + "ALSA-2023:0339", + "ALSA-2024:0465", + "ALSA-2025:11992", + "ALSA-2025:20936" + ] + }, + { + "package": { + "name": "systemd", + "os_package_name": "systemd", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "systemd-libs", + "os_package_name": "systemd-libs", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "systemd-pam", + "os_package_name": "systemd-pam", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "systemd-rpm-macros", + "os_package_name": "systemd-rpm-macros", + "version": "250-6.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 6, + "vulnerabilities": [ + "ALSA-2023:0336", + "ALSA-2023:0954", + "ALSA-2024:2463", + "ALSA-2025:22660", + "ALSA-2026:13677", + "ALSA-2026:19213" + ] + }, + { + "package": { + "name": "tar", + "os_package_name": "tar", + "version": "1.34-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 2, + "vulnerabilities": [ + "ALSA-2023:0959", + "ALSA-2026:0067" + ] + }, + { + "package": { + "name": "tpm2-tss", + "os_package_name": "tpm2-tss", + "version": "3.0.3-7.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2023:6685" + ] + }, + { + "package": { + "name": "util-linux", + "os_package_name": "util-linux", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "util-linux-core", + "os_package_name": "util-linux-core", + "version": "2.37.4-3.el9", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2026:1913" + ] + }, + { + "package": { + "name": "vim-minimal", + "os_package_name": "vim-minimal", + "version": "8.2.2637-16.el9_0.3", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 13, + "vulnerabilities": [ + "ALSA-2022:5242", + "ALSA-2022:5942", + "ALSA-2023:0958", + "ALSA-2024:9405", + "ALSA-2025:17742", + "ALSA-2025:20945", + "ALSA-2025:7440", + "ALSA-2026:11510", + "ALSA-2026:19224", + "ALSA-2026:22717", + "ALSA-2026:28209", + "ALSA-2026:5602", + "ALSA-2026:8259" + ] + }, + { + "package": { + "name": "zlib", + "os_package_name": "zlib", + "version": "1.2.11-31.el9_0.1", + "ecosystem": "AlmaLinux:9", + "image_origin_details": { + "index": 0 + } + }, + "groups": 1, + "vulnerabilities": [ + "ALSA-2022:7314" + ] + } + ] } ], "experimental_config": { diff --git a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml index b64e77f150c..f68398ba111 100644 --- a/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml +++ b/cmd/osv-scanner/scan/image/testdata/cassettes/TestCommand_OCIImage_JSONFormat.yaml @@ -1078,6 +1078,2713 @@ interactions: status: 200 OK code: 200 duration: 0s + - request: + proto: HTTP/1.1 + proto_major: 1 + proto_minor: 1 + content_length: 21849 + host: api.osv.dev + body: | + { + "queries": [ + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "acl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-gpg-keys" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-release" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "almalinux-repos" + }, + "version": "9.0-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "alternatives" + }, + "version": "1.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "audit-libs" + }, + "version": "3.0.7-101.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "basesystem" + }, + "version": "11-13.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bash" + }, + "version": "5.1.8-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "binutils-gold" + }, + "version": "2.35.2-17.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "bzip2-libs" + }, + "version": "1.0.8-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ca-certificates" + }, + "version": "2022.2.54-90.2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "coreutils-single" + }, + "version": "8.32-31.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cracklib-dicts" + }, + "version": "2.9.6-27.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "crypto-policies-scripts" + }, + "version": "20220223-1.git5203b41.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cryptsetup-libs" + }, + "version": "2.4.3-4.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "curl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "cyrus-sasl-lib" + }, + "version": "2.1.27-20.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-broker" + }, + "version": "28-5.1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dbus-common" + }, + "version": "1.12.20-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "device-mapper-libs" + }, + "version": "1.02.183-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "dnf-data" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-debuginfod-client" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-default-yama-scope" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libelf" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "elfutils-libs" + }, + "version": "0.186-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "expat" + }, + "version": "2.2.10-12.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "file-libs" + }, + "version": "5.39-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "filesystem" + }, + "version": "3.16-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "findutils" + }, + "version": "4.8.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gawk" + }, + "version": "5.1.0-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gdbm-libs" + }, + "version": "1.19-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glib2" + }, + "version": "2.68.4-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-common" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "glibc-minimal-langpack" + }, + "version": "2.34-28.el9_0.2" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gmp" + }, + "version": "6.2.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnupg2" + }, + "version": "2.3.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gnutls" + }, + "version": "3.7.6-12.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "gpg" + }, + "version": "1.15.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpg-pubkey" + }, + "version": "b86b3716-61e69f29" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gpgme" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "grep" + }, + "version": "3.6-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "gzip" + }, + "version": "1.10-9.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "hostname" + }, + "version": "3.23-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ima-evm-utils" + }, + "version": "1.4-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "iputils" + }, + "version": "20210202-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "json-c" + }, + "version": "0.14-11.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "keyutils-libs" + }, + "version": "1.6.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "kmod-libs" + }, + "version": "28-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "krb5-libs" + }, + "version": "1.19.1-15.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "less" + }, + "version": "590-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libacl" + }, + "version": "2.3.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libarchive" + }, + "version": "3.5.3-2.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libassuan" + }, + "version": "2.5.5-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libattr" + }, + "version": "2.5.1-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libblkid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap" + }, + "version": "2.48-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcap-ng" + }, + "version": "0.8.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcom_err" + }, + "version": "1.46.5-2.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "libcomps" + }, + "version": "0.1.18" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libcurl-minimal" + }, + "version": "7.76.1-14.el9_0.5" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdb" + }, + "version": "5.3.28-53.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libeconf" + }, + "version": "0.4.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libevent" + }, + "version": "2.1.12-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libfdisk" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libffi" + }, + "version": "3.4.2-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcc" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgcrypt" + }, + "version": "1.10.0-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgomp" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libgpg-error" + }, + "version": "1.42-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libidn2" + }, + "version": "2.3.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libksba" + }, + "version": "1.5.1-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmodulemd" + }, + "version": "2.13.0-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libmount" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libnghttp2" + }, + "version": "1.43.0-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libpwquality" + }, + "version": "1.4.4-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "librepo" + }, + "version": "1.14.2-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libreport-filesystem" + }, + "version": "2.15.2-6.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libseccomp" + }, + "version": "2.5.2-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libselinux" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsemanage" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsepol" + }, + "version": "3.3-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsigsegv" + }, + "version": "2.13-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsmartcols" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libsolv" + }, + "version": "0.7.20-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libstdc++" + }, + "version": "11.2.1-9.4.el9.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libtasn1" + }, + "version": "4.16.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libunistring" + }, + "version": "0.9.10-15.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libutempter" + }, + "version": "1.2.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libuuid" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libverto" + }, + "version": "0.3.2-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxcrypt" + }, + "version": "4.4.18-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libxml2" + }, + "version": "2.9.13-1.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libyaml" + }, + "version": "0.2.5-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "libzstd" + }, + "version": "1.5.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lua-libs" + }, + "version": "5.4.2-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "lz4-libs" + }, + "version": "1.9.3-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "mpfr" + }, + "version": "4.1.0-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-base" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "ncurses-libs" + }, + "version": "6.2-8.20210508.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "nettle" + }, + "version": "3.8-3.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "npth" + }, + "version": "1.6-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openldap-compat" + }, + "version": "2.6.2-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "openssl-libs" + }, + "version": "3.0.1-43.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "p11-kit-trust" + }, + "version": "0.24.1-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pam" + }, + "version": "1.5.1-9.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre" + }, + "version": "8.44-3.el9.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "pcre2-syntax" + }, + "version": "10.37-5.el9_0" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "pip" + }, + "version": "21.2.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "popt" + }, + "version": "1.18-8.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-dnf" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-gpg" + }, + "version": "1.15.1-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-hawkey" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libcomps" + }, + "version": "0.1.18-1.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libdnf" + }, + "version": "0.65.0-5.1.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-libs" + }, + "version": "3.9.10-2.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-pip-wheel" + }, + "version": "21.2.3-6.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "python3-setuptools-wheel" + }, + "version": "53.0.0-10.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "readline" + }, + "version": "8.1-4.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rootfiles" + }, + "version": "8.1-31.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "rpm" + }, + "version": "4.16.1.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-build-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "rpm-sign-libs" + }, + "version": "4.16.1.3-12.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sed" + }, + "version": "4.8-9.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "setup" + }, + "version": "2.13.7-6.el9" + }, + { + "package": { + "ecosystem": "PyPI", + "name": "setuptools" + }, + "version": "53.0.0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "shadow-utils" + }, + "version": "4.9-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "sqlite-libs" + }, + "version": "3.34.1-5.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-libs" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-pam" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "systemd-rpm-macros" + }, + "version": "250-6.el9_0.1" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tar" + }, + "version": "1.34-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tpm2-tss" + }, + "version": "3.0.3-7.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "tzdata" + }, + "version": "2022e-1.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "util-linux-core" + }, + "version": "2.37.4-3.el9" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "vim-minimal" + }, + "version": "8.2.2637-16.el9_0.3" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "xz-libs" + }, + "version": "5.2.5-8.el9_0" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "yum" + }, + "version": "4.10.0-5.el9_0.alma" + }, + { + "package": { + "ecosystem": "AlmaLinux:9", + "name": "zlib" + }, + "version": "1.2.11-31.el9_0.1" + } + ] + } + headers: + Content-Type: + - application/json + X-Test-Name: + - TestCommand_OCIImage_JSONFormat/scanning_almalinux_9_image + url: https://api.osv.dev/v1/querybatch + method: POST + response: + proto: HTTP/2.0 + proto_major: 2 + proto_minor: 0 + content_length: 20731 + body: | + { + "results": [ + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0340", + "modified": "2026-02-04T02:39:05.013813Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6593", + "modified": "2026-02-04T02:56:42.748728Z" + }, + { + "id": "ALSA-2025:23343", + "modified": "2026-02-04T03:10:06.598841Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:0925", + "modified": "2026-02-04T04:23:04.673700Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:28911", + "modified": "2026-06-25T14:45:05.932137Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0335", + "modified": "2026-02-04T02:43:39.771637Z" + }, + { + "id": "ALSA-2023:4569", + "modified": "2026-02-04T03:26:40.249723Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0337", + "modified": "2026-02-04T02:41:37.038356Z" + }, + { + "id": "ALSA-2024:1530", + "modified": "2026-02-04T03:35:33.402240Z" + }, + { + "id": "ALSA-2024:6754", + "modified": "2026-02-04T02:22:22.919987Z" + }, + { + "id": "ALSA-2024:9541", + "modified": "2026-02-04T03:35:28.908623Z" + }, + { + "id": "ALSA-2025:22175", + "modified": "2026-02-04T04:22:01.629753Z" + }, + { + "id": "ALSA-2025:3531", + "modified": "2026-02-04T04:35:39.307337Z" + }, + { + "id": "ALSA-2025:7444", + "modified": "2026-02-04T03:11:34.139518Z" + }, + { + "id": "ALSA-2026:23230", + "modified": "2026-06-11T16:00:04.147520Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:2512", + "modified": "2026-02-04T04:24:23.275314Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6631", + "modified": "2026-02-04T04:27:47.395873Z" + }, + { + "id": "ALSA-2024:6464", + "modified": "2026-02-04T03:27:15.983684Z" + }, + { + "id": "ALSA-2025:11140", + "modified": "2026-02-04T02:55:31.495927Z" + }, + { + "id": "ALSA-2026:0936", + "modified": "2026-02-04T02:25:08.416995Z" + }, + { + "id": "ALSA-2026:15971", + "modified": "2026-05-11T20:00:09.038847Z" + }, + { + "id": "ALSA-2026:19361", + "modified": "2026-05-26T16:00:28.465116Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:20597", + "modified": "2026-06-30T16:59:33.885701Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + }, + { + "id": "ALSA-2026:33226", + "modified": "2026-06-30T16:45:03.718056Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:20597", + "modified": "2026-06-30T16:59:33.885701Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + }, + { + "id": "ALSA-2026:33226", + "modified": "2026-06-30T16:45:03.718056Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5453", + "modified": "2026-02-04T03:26:19.807241Z" + }, + { + "id": "ALSA-2024:3339", + "modified": "2026-02-04T03:30:53.986917Z" + }, + { + "id": "ALSA-2025:4244", + "modified": "2026-02-04T04:07:40.504176Z" + }, + { + "id": "ALSA-2025:8655", + "modified": "2026-02-04T03:01:36.256559Z" + }, + { + "id": "ALSA-2025:9877", + "modified": "2026-02-04T04:14:28.182476Z" + }, + { + "id": "ALSA-2026:20597", + "modified": "2026-06-30T16:59:33.885701Z" + }, + { + "id": "ALSA-2026:2786", + "modified": "2026-02-24T21:44:00.377003Z" + }, + { + "id": "ALSA-2026:33226", + "modified": "2026-06-30T16:45:03.718056Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6661", + "modified": "2026-02-04T02:21:41.980408Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:0719", + "modified": "2026-02-04T04:34:34.329237Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:1141", + "modified": "2026-02-04T03:18:59.660613Z" + }, + { + "id": "ALSA-2024:0533", + "modified": "2026-02-04T03:48:34.100512Z" + }, + { + "id": "ALSA-2024:1879", + "modified": "2026-02-04T03:31:06.672839Z" + }, + { + "id": "ALSA-2024:2570", + "modified": "2026-02-04T04:01:53.202219Z" + }, + { + "id": "ALSA-2025:16116", + "modified": "2026-02-04T03:15:22.241525Z" + }, + { + "id": "ALSA-2025:7076", + "modified": "2026-02-04T04:25:27.782684Z" + }, + { + "id": "ALSA-2026:20612", + "modified": "2026-07-02T13:44:28.594241Z" + }, + { + "id": "ALSA-2026:4188", + "modified": "2026-03-16T08:43:59.018031Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:17558", + "modified": "2026-02-04T03:25:13.978615Z" + }, + { + "id": "ALSA-2025:9432", + "modified": "2026-02-04T02:18:41.302098Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8637", + "modified": "2026-02-04T04:01:02.274891Z" + }, + { + "id": "ALSA-2023:2570", + "modified": "2026-02-04T03:25:10.056435Z" + }, + { + "id": "ALSA-2023:6699", + "modified": "2026-02-04T03:59:17.349120Z" + }, + { + "id": "ALSA-2024:6166", + "modified": "2026-02-04T04:13:16.807291Z" + }, + { + "id": "ALSA-2024:9331", + "modified": "2026-02-04T02:40:52.136074Z" + }, + { + "id": "ALSA-2024:9474", + "modified": "2026-02-04T04:30:53.060846Z" + }, + { + "id": "ALSA-2025:7067", + "modified": "2026-02-04T02:48:22.293400Z" + }, + { + "id": "ALSA-2025:9430", + "modified": "2026-02-04T03:20:09.135780Z" + }, + { + "id": "ALSA-2026:19357", + "modified": "2026-05-26T16:14:26.075210Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:3725", + "modified": "2026-02-04T02:57:26.406617Z" + }, + { + "id": "ALSA-2024:1692", + "modified": "2026-02-04T03:07:17.609765Z" + }, + { + "id": "ALSA-2024:3513", + "modified": "2026-02-04T04:02:37.699304Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:2532", + "modified": "2026-02-04T03:30:59.962630Z" + }, + { + "id": "ALSA-2025:14130", + "modified": "2026-02-04T02:59:02.777670Z" + }, + { + "id": "ALSA-2025:9431", + "modified": "2026-02-04T04:26:59.474540Z" + }, + { + "id": "ALSA-2026:5080", + "modified": "2026-03-24T11:41:56.671370Z" + }, + { + "id": "ALSA-2026:8510", + "modified": "2026-04-17T13:19:53.082048Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5071", + "modified": "2026-02-04T03:18:20.022576Z" + }, + { + "id": "ALSA-2026:12441", + "modified": "2026-05-01T20:45:11.742990Z" + }, + { + "id": "ALSA-2026:19346", + "modified": "2026-05-26T16:00:23.989197Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8361", + "modified": "2026-02-04T04:00:37.440096Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:8299", + "modified": "2026-02-04T02:59:29.832450Z" + }, + { + "id": "ALSA-2023:0333", + "modified": "2026-02-04T03:11:09.993172Z" + }, + { + "id": "ALSA-2023:1701", + "modified": "2026-02-04T03:40:34.154961Z" + }, + { + "id": "ALSA-2023:2478", + "modified": "2026-02-04T03:01:23.945523Z" + }, + { + "id": "ALSA-2023:2650", + "modified": "2026-02-04T02:24:48.187396Z" + }, + { + "id": "ALSA-2023:4354", + "modified": "2026-02-04T02:39:53.202728Z" + }, + { + "id": "ALSA-2023:5763", + "modified": "2026-02-04T02:26:05.028011Z" + }, + { + "id": "ALSA-2023:6679", + "modified": "2026-02-04T02:19:52.904090Z" + }, + { + "id": "ALSA-2023:6745", + "modified": "2026-02-04T04:12:41.383421Z" + }, + { + "id": "ALSA-2024:1129", + "modified": "2026-02-04T02:19:53.688709Z" + }, + { + "id": "ALSA-2024:5529", + "modified": "2026-02-04T04:36:30.483834Z" + }, + { + "id": "ALSA-2026:1350", + "modified": "2026-02-04T04:20:42.080175Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:4347", + "modified": "2026-02-04T04:26:55.222844Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:9404", + "modified": "2026-02-04T04:39:46.445150Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0626", + "modified": "2026-02-04T03:37:23.910138Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:5838", + "modified": "2026-02-04T03:21:23.106321Z" + }, + { + "id": "ALSA-2023:6746", + "modified": "2026-02-04T02:52:20.689534Z" + }, + { + "id": "ALSA-2024:3501", + "modified": "2026-02-04T04:30:58.924693Z" + }, + { + "id": "ALSA-2026:7668", + "modified": "2026-04-17T13:19:22.946826Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2025:1346", + "modified": "2026-02-04T02:42:19.300480Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0343", + "modified": "2026-02-04T02:58:56.421179Z" + }, + { + "id": "ALSA-2025:7077", + "modified": "2026-02-04T02:57:21.340790Z" + }, + { + "id": "ALSA-2026:28253", + "modified": "2026-06-25T14:45:03.934430Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:0338", + "modified": "2026-02-04T04:15:50.026698Z" + }, + { + "id": "ALSA-2023:4349", + "modified": "2026-02-04T03:56:40.445151Z" + }, + { + "id": "ALSA-2023:7747", + "modified": "2026-02-04T02:47:05.174021Z" + }, + { + "id": "ALSA-2024:2679", + "modified": "2026-02-04T03:53:53.131809Z" + }, + { + "id": "ALSA-2025:10699", + "modified": "2026-02-04T03:45:10.417784Z" + }, + { + "id": "ALSA-2025:12447", + "modified": "2026-02-04T04:08:24.796808Z" + }, + { + "id": "ALSA-2025:13428", + "modified": "2026-02-04T03:51:53.872437Z" + }, + { + "id": "ALSA-2025:1350", + "modified": "2026-02-04T04:02:12.419510Z" + }, + { + "id": "ALSA-2025:22376", + "modified": "2026-02-04T04:03:23.679067Z" + }, + { + "id": "ALSA-2025:2679", + "modified": "2026-02-04T02:16:14.070103Z" + }, + { + "id": "ALSA-2026:28254", + "modified": "2026-06-25T14:45:05.928604Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7329", + "modified": "2026-02-04T02:28:25.713104Z" + }, + { + "id": "ALSA-2023:0957", + "modified": "2026-02-04T02:27:45.919035Z" + }, + { + "id": "ALSA-2023:2582", + "modified": "2026-02-04T03:10:44.508101Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6698", + "modified": "2026-02-04T02:56:09.576007Z" + } + ] + }, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:6224", + "modified": "2026-02-04T02:51:14.255262Z" + }, + { + "id": "ALSA-2022:7288", + "modified": "2026-02-04T03:59:27.389573Z" + }, + { + "id": "ALSA-2023:0946", + "modified": "2026-02-04T03:23:22.425826Z" + }, + { + "id": "ALSA-2023:2523", + "modified": "2026-02-04T02:26:35.380325Z" + }, + { + "id": "ALSA-2023:3722", + "modified": "2026-02-04T02:13:18.469496Z" + }, + { + "id": "ALSA-2024:0310", + "modified": "2026-02-04T02:42:39.967487Z" + }, + { + "id": "ALSA-2024:2447", + "modified": "2026-02-04T02:13:54.975229Z" + }, + { + "id": "ALSA-2024:6783", + "modified": "2026-02-04T03:31:16.933411Z" + }, + { + "id": "ALSA-2024:9333", + "modified": "2026-02-04T03:31:00.023073Z" + }, + { + "id": "ALSA-2025:1330", + "modified": "2026-02-04T04:15:39.208441Z" + }, + { + "id": "ALSA-2025:21255", + "modified": "2026-02-04T03:44:31.901825Z" + }, + { + "id": "ALSA-2026:1473", + "modified": "2026-02-04T02:57:39.180220Z" + }, + { + "id": "ALSA-2026:19218", + "modified": "2026-05-26T16:00:21.304009Z" + }, + { + "id": "ALSA-2026:22312", + "modified": "2026-06-03T14:30:04.577840Z" + }, + { + "id": "ALSA-2026:25239", + "modified": "2026-06-12T12:29:12.486131Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:18599", + "modified": "2026-05-26T16:00:16.791061Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:10244", + "modified": "2026-02-04T03:21:58.697081Z" + }, + { + "id": "ALSA-2024:11250", + "modified": "2026-02-04T03:37:50.674762Z" + }, + { + "id": "ALSA-2024:2438", + "modified": "2026-02-04T04:21:40.830719Z" + }, + { + "id": "ALSA-2025:15099", + "modified": "2026-02-04T03:59:03.032487Z" + }, + { + "id": "ALSA-2025:9526", + "modified": "2026-02-04T03:35:27.405905Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-4xh5-x5gv-qwph", + "modified": "2026-07-07T17:57:29.434622Z" + }, + { + "id": "GHSA-58qw-9mgm-455v", + "modified": "2026-05-20T21:00:09.920997Z" + }, + { + "id": "GHSA-6vgw-5pg2-w6jp", + "modified": "2026-07-07T17:56:16.480954Z" + }, + { + "id": "GHSA-jp4c-xjxw-mgf9", + "modified": "2026-05-07T16:59:14.079020Z" + }, + { + "id": "GHSA-mq26-g339-26xf", + "modified": "2026-03-24T01:43:05.410801Z" + }, + { + "id": "GHSA-wf93-45jw-7689", + "modified": "2026-07-10T12:45:24.283380Z" + }, + { + "id": "PYSEC-2023-228", + "modified": "2026-06-10T17:01:27.606909Z" + }, + { + "id": "PYSEC-2026-1795", + "modified": "2026-07-07T17:48:06.199964Z" + }, + { + "id": "PYSEC-2026-1796", + "modified": "2026-07-07T17:48:06.240646Z" + }, + { + "id": "PYSEC-2026-196", + "modified": "2026-07-08T21:26:17.521856Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + {}, + {}, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7323", + "modified": "2026-02-04T04:03:11.064433Z" + }, + { + "id": "ALSA-2022:8353", + "modified": "2026-02-04T03:04:32.610389Z" + }, + { + "id": "ALSA-2022:8493", + "modified": "2026-02-04T02:42:36.434701Z" + }, + { + "id": "ALSA-2023:0953", + "modified": "2026-02-04T03:15:58.943787Z" + }, + { + "id": "ALSA-2023:3595", + "modified": "2026-02-04T03:38:14.145750Z" + }, + { + "id": "ALSA-2023:5462", + "modified": "2026-02-04T03:02:52.364518Z" + }, + { + "id": "ALSA-2023:6659", + "modified": "2026-02-04T03:27:32.595876Z" + }, + { + "id": "ALSA-2024:0466", + "modified": "2026-02-04T03:07:57.616188Z" + }, + { + "id": "ALSA-2024:10983", + "modified": "2026-02-04T03:45:08.742373Z" + }, + { + "id": "ALSA-2024:4078", + "modified": "2026-02-04T02:42:46.311908Z" + }, + { + "id": "ALSA-2024:4779", + "modified": "2026-02-04T02:55:36.858364Z" + }, + { + "id": "ALSA-2024:6163", + "modified": "2026-02-04T04:21:08.554450Z" + }, + { + "id": "ALSA-2024:8446", + "modified": "2026-02-04T04:21:06.060988Z" + }, + { + "id": "ALSA-2024:9371", + "modified": "2026-02-04T03:29:13.713576Z" + }, + { + "id": "ALSA-2024:9468", + "modified": "2026-02-04T04:30:10.003749Z" + }, + { + "id": "ALSA-2025:10136", + "modified": "2026-02-04T02:36:14.764339Z" + }, + { + "id": "ALSA-2025:15019", + "modified": "2026-02-04T03:51:57.720222Z" + }, + { + "id": "ALSA-2025:23342", + "modified": "2026-02-04T03:02:34.328985Z" + }, + { + "id": "ALSA-2025:6977", + "modified": "2026-02-04T04:10:56.453210Z" + }, + { + "id": "ALSA-2026:10949", + "modified": "2026-04-30T14:44:32.588488Z" + }, + { + "id": "ALSA-2026:1478", + "modified": "2026-02-04T02:37:56.057268Z" + }, + { + "id": "ALSA-2026:19216", + "modified": "2026-05-26T16:14:18.052221Z" + }, + { + "id": "ALSA-2026:4168", + "modified": "2026-03-16T08:30:08.411931Z" + }, + { + "id": "ALSA-2026:6766", + "modified": "2026-04-17T13:20:11.098125Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6694", + "modified": "2026-02-04T02:39:28.003450Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0952", + "modified": "2026-02-04T02:32:42.835672Z" + }, + { + "id": "ALSA-2024:5534", + "modified": "2026-02-04T02:43:30.286669Z" + }, + { + "id": "ALSA-2025:10407", + "modified": "2026-02-04T03:52:34.406526Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2024:0463", + "modified": "2026-02-04T03:35:42.720266Z" + } + ] + }, + {}, + {}, + { + "vulns": [ + { + "id": "GHSA-5rjg-fvgr-3xxf", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "GHSA-cx63-2mw6-8hw5", + "modified": "2026-07-07T17:57:13.326243Z" + }, + { + "id": "GHSA-r9hx-vwmv-q579", + "modified": "2026-02-04T03:03:25.892107Z" + }, + { + "id": "PYSEC-2022-43012", + "modified": "2026-06-10T17:02:40.148961Z" + }, + { + "id": "PYSEC-2025-49", + "modified": "2026-05-11T00:26:34.671259Z" + }, + { + "id": "PYSEC-2026-1918", + "modified": "2026-07-07T17:57:13.326243Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6632", + "modified": "2026-02-04T04:16:01.058999Z" + }, + { + "id": "ALSA-2025:20559", + "modified": "2026-02-04T02:22:46.209033Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0339", + "modified": "2026-02-04T03:25:10.768446Z" + }, + { + "id": "ALSA-2024:0465", + "modified": "2026-02-04T02:44:43.937586Z" + }, + { + "id": "ALSA-2025:11992", + "modified": "2026-02-04T03:22:31.337630Z" + }, + { + "id": "ALSA-2025:20936", + "modified": "2026-02-04T04:26:46.773530Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0336", + "modified": "2026-02-04T03:07:15.229260Z" + }, + { + "id": "ALSA-2023:0954", + "modified": "2026-02-04T03:42:34.465389Z" + }, + { + "id": "ALSA-2024:2463", + "modified": "2026-02-04T03:50:31.414728Z" + }, + { + "id": "ALSA-2025:22660", + "modified": "2026-02-04T04:20:35.362485Z" + }, + { + "id": "ALSA-2026:13677", + "modified": "2026-05-06T07:31:02.807439Z" + }, + { + "id": "ALSA-2026:19213", + "modified": "2026-05-26T16:00:21.331376Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:0959", + "modified": "2026-02-04T03:24:09.816450Z" + }, + { + "id": "ALSA-2026:0067", + "modified": "2026-02-04T02:19:32.940449Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2023:6685", + "modified": "2026-02-04T04:02:01.414267Z" + } + ] + }, + {}, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2026:1913", + "modified": "2026-02-13T09:28:46.201785Z" + } + ] + }, + { + "vulns": [ + { + "id": "ALSA-2022:5242", + "modified": "2026-02-04T03:09:49.111890Z" + }, + { + "id": "ALSA-2022:5942", + "modified": "2026-02-04T04:29:25.863952Z" + }, + { + "id": "ALSA-2023:0958", + "modified": "2026-02-04T02:48:00.905849Z" + }, + { + "id": "ALSA-2024:9405", + "modified": "2026-02-04T03:08:35.008158Z" + }, + { + "id": "ALSA-2025:17742", + "modified": "2026-02-04T03:32:56.810406Z" + }, + { + "id": "ALSA-2025:20945", + "modified": "2026-02-04T04:32:36.215823Z" + }, + { + "id": "ALSA-2025:7440", + "modified": "2026-02-04T03:33:27.312996Z" + }, + { + "id": "ALSA-2026:11510", + "modified": "2026-04-30T14:30:20.381957Z" + }, + { + "id": "ALSA-2026:19224", + "modified": "2026-05-26T16:00:23.463648Z" + }, + { + "id": "ALSA-2026:22717", + "modified": "2026-06-04T11:15:04.513534Z" + }, + { + "id": "ALSA-2026:28209", + "modified": "2026-06-25T14:45:03.975900Z" + }, + { + "id": "ALSA-2026:5602", + "modified": "2026-03-27T09:01:15.379885Z" + }, + { + "id": "ALSA-2026:8259", + "modified": "2026-04-17T13:19:37.888342Z" + } + ] + }, + {}, + {}, + {}, + { + "vulns": [ + { + "id": "ALSA-2022:7314", + "modified": "2026-02-04T02:40:45.002131Z" + } + ] + } + ] + } + headers: + Content-Length: + - "20731" + Content-Type: + - application/json + status: 200 OK + code: 200 + duration: 0s - request: proto: HTTP/1.1 proto_major: 1 diff --git a/go.mod b/go.mod index c49d5032131..6fc3ef50525 100644 --- a/go.mod +++ b/go.mod @@ -13,7 +13,7 @@ require ( github.com/go-git/go-git/v5 v5.19.1 github.com/gobwas/glob v0.2.3 github.com/google/go-cmp v0.7.0 - github.com/google/osv-scalibr v0.4.6-0.20260612031204-164402d9140e + github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1 github.com/ianlancetaylor/demangle v0.0.0-20260505044615-1ff4bf46051f github.com/jedib0t/go-pretty/v6 v6.7.10 github.com/modelcontextprotocol/go-sdk v1.6.1 @@ -214,5 +214,3 @@ require ( www.velocidex.com/golang/go-ntfs v0.2.0 // indirect www.velocidex.com/golang/regparser v0.0.0-20250203141505-31e704a67ef7 // indirect ) - -replace github.com/google/osv-scalibr => github.com/herdiyana256/osv-scalibr v0.4.6-0.20260618122241-4aa61fbd095f diff --git a/go.sum b/go.sum index f262310c99a..333924428fd 100644 --- a/go.sum +++ b/go.sum @@ -247,6 +247,8 @@ github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932 h1:5/4TSDzpDnHQ8rKEE github.com/google/go-cpy v0.0.0-20211218193943-a9c933c06932/go.mod h1:cC6EdPbj/17GFCPDK39NRarlMI+kt+O60S12cNB5J9Y= github.com/google/jsonschema-go v0.4.3 h1:/DBOLZTfDow7pe2GmaJNhltueGTtDKICi8V8p+DQPd0= github.com/google/jsonschema-go v0.4.3/go.mod h1:r5quNTdLOYEz95Ru18zA0ydNbBuYoo9tgaYcxEYhJVE= +github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1 h1:yHo18phm3Xy56T1ngXgNqCMJR7uFWVWrnWyvTbzD+Ak= +github.com/google/osv-scalibr v0.4.6-0.20260713000915-500ad84f4ed1/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY= github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= @@ -257,8 +259,6 @@ github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 h1:HWRh5R2+9EifMyIHV7ZV+MIZqgz github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0/go.mod h1:JfhWUomR1baixubs02l85lZYYOm7LV6om4ceouMv45c= github.com/hashicorp/golang-lru/v2 v2.0.7 h1:a+bsQ5rvGLjzHuww6tVxozPZFVghXaHOwFs4luLUK2k= github.com/hashicorp/golang-lru/v2 v2.0.7/go.mod h1:QeFd9opnmA6QUJc5vARoKUSoFhyfM2/ZepoAG6RGpeM= -github.com/herdiyana256/osv-scalibr v0.4.6-0.20260618122241-4aa61fbd095f h1:xZgSQPL62/VQLrpgB1SPWB59nM3m38hVFdijhU7nK90= -github.com/herdiyana256/osv-scalibr v0.4.6-0.20260618122241-4aa61fbd095f/go.mod h1:7NVYCBa6Uu7S2GvVj/kacQ8Bib8KhdIxU6+cf3aIIVI= github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM= github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg= github.com/ianlancetaylor/demangle v0.0.0-20260505044615-1ff4bf46051f h1:NW3E2QSchEk63/fjeEvWOa2cE02FSv9ox//VE/N4c8g= From bd22c7f3d9f6c0e09c65302d331a122e325c0b7a Mon Sep 17 00:00:00 2001 From: herdiyana256 Date: Thu, 16 Jul 2026 21:03:24 +0700 Subject: [PATCH 4/4] test: update snapshots for os/rpm in artifact preset Add os/rpm (RPM-based distros: AlmaLinux, RHEL, Rocky, CentOS, Fedora) to the artifact extractor preset. Update all affected snapshot files and fix hardcoded want lists in resolve_test.go to include rpm.Name. --- .../source/__snapshots__/command_test.snap | 48 ++++++----- internal/output/__snapshots__/spdx_test.snap | 80 +++++++++---------- .../__snapshots__/resolve_test.snap | 4 + internal/scalibrplugin/resolve_test.go | 5 ++ .../__snapshots__/osvscanner_test.snap | 2 +- 5 files changed, 78 insertions(+), 61 deletions(-) diff --git a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap index f9a94027f2d..ae3a54eaba5 100755 --- a/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap +++ b/cmd/osv-scanner/scan/source/__snapshots__/command_test.snap @@ -1121,7 +1121,7 @@ Scanned /testdata/sbom-insecure/postgres-stretch.cdx.xml file and found Scanned /testdata/sbom-insecure/with-duplicates.cdx.xml file and found 17 packages Filtered 10 local/unscannable package/s from the scan. -Total 27 packages affected by 230 known vulnerabilities (26 Critical, 99 High, 71 Medium, 6 Low, 28 Unknown) from 5 ecosystems. +Total 27 packages affected by 230 known vulnerabilities (27 Critical, 98 High, 71 Medium, 6 Low, 28 Unknown) from 5 ecosystems. 22 vulnerabilities can be fixed. +---------------------------------------+------+--------------+--------------------------------+------------------------------------+-----------------------------------+---------------------------------------------------------------------+ @@ -1231,7 +1231,7 @@ Total 27 packages affected by 230 known vulnerabilities (26 Critical, 99 High, 7 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -2039,8 +2039,8 @@ Total 12 packages affected by 52 known vulnerabilities (5 Critical, 20 High, 22 ] }, { - "name": "league/flysystem", - "SPDXID": "SPDXRef-Package-league-flysystem-uuid-placeholder-4", + "name": "flysystem", + "SPDXID": "SPDXRef-Package-flysystem-uuid-placeholder-4", "versionInfo": "1.0.8", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -2052,7 +2052,7 @@ Total 12 packages affected by 52 known vulnerabilities (5 Critical, 20 High, 22 { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/league%2Fflysystem@1.0.8" + "referenceLocator": "pkg:composer/league/flysystem@1.0.8" } ] }, @@ -2121,11 +2121,11 @@ Total 12 packages affected by 52 known vulnerabilities (5 Critical, 20 High, 22 }, { "spdxElementId": "SPDXRef-Package-main-uuid-placeholder-1", - "relatedSpdxElement": "SPDXRef-Package-league-flysystem-uuid-placeholder-4", + "relatedSpdxElement": "SPDXRef-Package-flysystem-uuid-placeholder-4", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-league-flysystem-uuid-placeholder-4", + "spdxElementId": "SPDXRef-Package-flysystem-uuid-placeholder-4", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -2442,7 +2442,7 @@ Filtered 8 vulnerabilities from output testdata/osv-scanner-partial-ignores-config.toml has unused ignores: - CVE-2019-5188 -Total 25 packages affected by 224 known vulnerabilities (26 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 5 ecosystems. +Total 25 packages affected by 224 known vulnerabilities (27 Critical, 93 High, 70 Medium, 6 Low, 28 Unknown) from 5 ecosystems. 17 vulnerabilities can be fixed. +---------------------------------------+------+--------------+--------------------------------+------------------------------------+-----------------------------------+---------------------------------------------------------------------+ @@ -2544,7 +2544,7 @@ Total 25 packages affected by 224 known vulnerabilities (26 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -2722,7 +2722,7 @@ Filtered 6 vulnerabilities from output testdata/osv-scanner-partial-ignores-config.toml has unused ignores: - CVE-2019-5188 -Total 23 packages affected by 220 known vulnerabilities (24 Critical, 93 High, 69 Medium, 6 Low, 28 Unknown) from 3 ecosystems. +Total 23 packages affected by 220 known vulnerabilities (25 Critical, 92 High, 69 Medium, 6 Low, 28 Unknown) from 3 ecosystems. 13 vulnerabilities can be fixed. +---------------------------------------+------+--------------+--------------------------------+------------------------------------+-----------------------------------+-------------------------------------------------+ @@ -2820,7 +2820,7 @@ Total 23 packages affected by 220 known vulnerabilities (24 Critical, 93 High, 6 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5110,7 +5110,7 @@ Filtered 1 local/unscannable package/s from the scan. Loaded Debian local db from /osv-scanner/Debian/all.zip Loaded Go local db from /osv-scanner/Go/all.zip -Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. +Total 22 packages affected by 224 known vulnerabilities (26 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. 13 vulnerabilities can be fixed. +---------------------------------------+------+-----------+--------------------------------+------------------------------------+-----------------------------------+-------------------------------------------------+ @@ -5211,7 +5211,7 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5318,11 +5318,14 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2025-15649 | 5.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2025-40909 | 5.9 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-12087 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-13221 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42496 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42497 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48959 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48961 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48962 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57432 | 8.4 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57433 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7010 | 6.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7017 | 7.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-8376 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5382,7 +5385,7 @@ Filtered 1 local/unscannable package/s from the scan. Loaded Debian local db from /osv-scanner/Debian/all.zip Loaded Go local db from /osv-scanner/Go/all.zip -Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. +Total 22 packages affected by 224 known vulnerabilities (26 Critical, 94 High, 70 Medium, 6 Low, 28 Unknown) from 2 ecosystems. 13 vulnerabilities can be fixed. +---------------------------------------+------+-----------+--------------------------------+------------------------------------+-----------------------------------+-------------------------------------------------+ @@ -5483,7 +5486,7 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2026-0989 | 3.7 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0990 | 5.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-0992 | 2.9 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | -| https://osv.dev/DEBIAN-CVE-2026-6653 | 7.0 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-6653 | 9.8 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-6732 | 7.5 | Debian | libxml2 | 2.9.4+dfsg1-2.2+deb9u6 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-1 | 4.7 | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DSA-4539-3 | | Debian | openssl | 1.1.0l-1~deb9u5 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -5590,11 +5593,14 @@ Total 22 packages affected by 221 known vulnerabilities (23 Critical, 94 High, 7 | https://osv.dev/DEBIAN-CVE-2025-15649 | 5.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2025-40909 | 5.9 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-12087 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-13221 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42496 | 9.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-42497 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48959 | 7.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48961 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-48962 | 7.3 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57432 | 8.4 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | +| https://osv.dev/DEBIAN-CVE-2026-57433 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7010 | 6.5 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-7017 | 7.1 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | | https://osv.dev/DEBIAN-CVE-2026-8376 | 9.8 | Debian | perl | 5.24.1-3+deb9u7 | -- | testdata/sbom-insecure/postgres-stretch.cdx.xml | @@ -6033,13 +6039,13 @@ Total 2 packages affected by 2 known vulnerabilities (1 Critical, 1 High, 0 Medi [TestCommand_MoreLockfiles/Package.resolved_-_SwiftURL_ecosystem_vulnerabilities_detected - 1] Scanned /testdata/locks-scalibr/Package.resolved file and found 2 packages -Total 2 packages affected by 13 known vulnerabilities (5 Critical, 5 High, 2 Medium, 0 Low, 1 Unknown) from 1 ecosystem. +Total 2 packages affected by 13 known vulnerabilities (5 Critical, 5 High, 3 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 13 vulnerabilities can be fixed. +-------------------------------------+------+-----------+----------------------------------+---------+---------------+-----------------------------------------+ | OSV URL | CVSS | ECOSYSTEM | PACKAGE | VERSION | FIXED VERSION | SOURCE | +-------------------------------------+------+-----------+----------------------------------+---------+---------------+-----------------------------------------+ -| https://osv.dev/GHSA-4px2-pw77-vc85 | | SwiftURL | github.com/apple/swift-nio-http2 | 1.19.1 | 1.44.1 | testdata/locks-scalibr/Package.resolved | +| https://osv.dev/GHSA-4px2-pw77-vc85 | 5.3 | SwiftURL | github.com/apple/swift-nio-http2 | 1.19.1 | 1.44.0 | testdata/locks-scalibr/Package.resolved | | https://osv.dev/GHSA-ccw9-q5h2-8c2w | 7.5 | SwiftURL | github.com/apple/swift-nio-http2 | 1.19.1 | 1.19.2 | testdata/locks-scalibr/Package.resolved | | https://osv.dev/GHSA-pgfx-g6rc-8cjv | 7.5 | SwiftURL | github.com/apple/swift-nio-http2 | 1.19.1 | 1.19.2 | testdata/locks-scalibr/Package.resolved | | https://osv.dev/GHSA-q36x-r5x4-h4q6 | 7.5 | SwiftURL | github.com/apple/swift-nio-http2 | 1.19.1 | 1.20 | testdata/locks-scalibr/Package.resolved | @@ -6437,7 +6443,7 @@ Scanning dir ./testdata/locks-requirements/requirements.txt Scanned /testdata/locks-requirements/requirements.txt file and found 3 packages Loaded PyPI local db from /osv-scanner/PyPI/all.zip -Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 7 Medium, 1 Low, 0 Unknown) from 1 ecosystem. +Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 8 Medium, 0 Low, 0 Unknown) from 1 ecosystem. 13 vulnerabilities can be fixed. +-------------------------------------+------+-----------+----------+---------+---------------+----------------------------------------------+ @@ -6452,7 +6458,8 @@ Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 7 Med | https://osv.dev/GHSA-8x94-hmjh-97hq | 8.8 | PyPI | django | 1.11.29 | 3.2.15 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-frmv-pr5f-9mcr | 9.1 | PyPI | django | 1.11.29 | 4.2.26 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-qw25-v68c-qjf3 | 7.5 | PyPI | django | 1.11.29 | 4.2.26 | testdata/locks-requirements/requirements.txt | -| https://osv.dev/GHSA-68rp-wp8r-4726 | 2.3 | PyPI | flask | 1.0.0 | 3.1.3 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/PYSEC-2026-2151 | 4.3 | PyPI | flask | 1.0.0 | 3.1.3 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/GHSA-68rp-wp8r-4726 | | | | | | | | https://osv.dev/GHSA-m2qf-hxjv-5gpq | 8.7 | PyPI | flask | 1.0.0 | 2.2.5 | testdata/locks-requirements/requirements.txt | | https://osv.dev/PYSEC-2023-74 | 6.1 | PyPI | requests | 2.20.0 | 2.31.0 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-j8r2-6x86-q33q | | | | | | | @@ -6460,7 +6467,8 @@ Total 3 packages affected by 13 known vulnerabilities (1 Critical, 4 High, 7 Med | https://osv.dev/GHSA-9hjg-9r4m-mvj7 | | | | | | | | https://osv.dev/PYSEC-2026-1873 | 5.6 | PyPI | requests | 2.20.0 | 2.32.0 | testdata/locks-requirements/requirements.txt | | https://osv.dev/GHSA-9wx4-h78v-vm56 | | | | | | | -| https://osv.dev/GHSA-gc5v-m9x4-r6x2 | 4.4 | PyPI | requests | 2.20.0 | 2.33.0 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/PYSEC-2026-2275 | 5.5 | PyPI | requests | 2.20.0 | 2.33.0 | testdata/locks-requirements/requirements.txt | +| https://osv.dev/GHSA-gc5v-m9x4-r6x2 | | | | | | | +-------------------------------------+------+-----------+----------+---------+---------------+----------------------------------------------+ --- diff --git a/internal/output/__snapshots__/spdx_test.snap b/internal/output/__snapshots__/spdx_test.snap index bc664f1d739..bcf9eba441a 100755 --- a/internal/output/__snapshots__/spdx_test.snap +++ b/internal/output/__snapshots__/spdx_test.snap @@ -544,8 +544,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -557,7 +557,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -616,8 +616,8 @@ ] }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -629,7 +629,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] } @@ -642,11 +642,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -682,11 +682,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } @@ -3262,8 +3262,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3275,7 +3275,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -3316,8 +3316,8 @@ ] }, { - "name": "author3/mine3", - "SPDXID": "SPDXRef-Package-author3-mine3-", + "name": "mine3", + "SPDXID": "SPDXRef-Package-mine3-", "versionInfo": "0.4.1", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3329,7 +3329,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author3%2Fmine3@0.4.1" + "referenceLocator": "pkg:composer/author3/mine3@0.4.1" } ] } @@ -3342,11 +3342,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -3372,11 +3372,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author3-mine3-", + "relatedSpdxElement": "SPDXRef-Package-mine3-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author3-mine3-", + "spdxElementId": "SPDXRef-Package-mine3-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } @@ -3408,8 +3408,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3421,7 +3421,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -3462,8 +3462,8 @@ ] }, { - "name": "author3/mine3", - "SPDXID": "SPDXRef-Package-author3-mine3-", + "name": "mine3", + "SPDXID": "SPDXRef-Package-mine3-", "versionInfo": "0.4.1", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3475,7 +3475,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author3%2Fmine3@0.4.1" + "referenceLocator": "pkg:composer/author3/mine3@0.4.1" } ] } @@ -3488,11 +3488,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -3518,11 +3518,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author3-mine3-", + "relatedSpdxElement": "SPDXRef-Package-mine3-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author3-mine3-", + "spdxElementId": "SPDXRef-Package-mine3-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } @@ -3554,8 +3554,8 @@ "filesAnalyzed": false }, { - "name": "author1/mine1", - "SPDXID": "SPDXRef-Package-author1-mine1-", + "name": "mine1", + "SPDXID": "SPDXRef-Package-mine1-", "versionInfo": "1.2.3", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3567,7 +3567,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author1%2Fmine1@1.2.3" + "referenceLocator": "pkg:composer/author1/mine1@1.2.3" } ] }, @@ -3590,8 +3590,8 @@ ] }, { - "name": "author3/mine3", - "SPDXID": "SPDXRef-Package-author3-mine3-", + "name": "mine3", + "SPDXID": "SPDXRef-Package-mine3-", "versionInfo": "0.4.1", "supplier": "NOASSERTION", "downloadLocation": "NOASSERTION", @@ -3603,7 +3603,7 @@ { "referenceCategory": "PACKAGE-MANAGER", "referenceType": "purl", - "referenceLocator": "pkg:composer/author3%2Fmine3@0.4.1" + "referenceLocator": "pkg:composer/author3/mine3@0.4.1" } ] } @@ -3616,11 +3616,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author1-mine1-", + "relatedSpdxElement": "SPDXRef-Package-mine1-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author1-mine1-", + "spdxElementId": "SPDXRef-Package-mine1-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" }, @@ -3636,11 +3636,11 @@ }, { "spdxElementId": "SPDXRef-Package-main-", - "relatedSpdxElement": "SPDXRef-Package-author3-mine3-", + "relatedSpdxElement": "SPDXRef-Package-mine3-", "relationshipType": "CONTAINS" }, { - "spdxElementId": "SPDXRef-Package-author3-mine3-", + "spdxElementId": "SPDXRef-Package-mine3-", "relatedSpdxElement": "NOASSERTION", "relationshipType": "CONTAINS" } diff --git a/internal/scalibrplugin/__snapshots__/resolve_test.snap b/internal/scalibrplugin/__snapshots__/resolve_test.snap index fe2f748353b..1974b5cbad4 100755 --- a/internal/scalibrplugin/__snapshots__/resolve_test.snap +++ b/internal/scalibrplugin/__snapshots__/resolve_test.snap @@ -37,6 +37,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm osv/osvscannerjson php/composerlock python/pdmlock @@ -76,6 +77,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm python/wheelegg rust/cargoauditable vex/os-duplicate/apk @@ -116,6 +118,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm python/wheelegg rust/cargoauditable vex/os-duplicate/apk @@ -145,6 +148,7 @@ os/apk os/chisel os/dpkg os/homebrew +os/rpm python/wheelegg rust/cargoauditable vex/os-duplicate/apk diff --git a/internal/scalibrplugin/resolve_test.go b/internal/scalibrplugin/resolve_test.go index 78e276e80b6..636b231a750 100644 --- a/internal/scalibrplugin/resolve_test.go +++ b/internal/scalibrplugin/resolve_test.go @@ -32,6 +32,7 @@ import ( "github.com/google/osv-scalibr/extractor/filesystem/os/chisel" "github.com/google/osv-scalibr/extractor/filesystem/os/dpkg" "github.com/google/osv-scalibr/extractor/filesystem/os/homebrew" + "github.com/google/osv-scalibr/extractor/filesystem/os/rpm" "github.com/google/osv-scalibr/extractor/filesystem/sbom/cdx" "github.com/google/osv-scalibr/extractor/filesystem/sbom/spdx" "github.com/google/osv-scanner/v2/internal/scalibrextract/filesystem/vendored" @@ -521,6 +522,7 @@ func TestResolve_Extractors(t *testing.T) { dpkg.Name, chisel.Name, homebrew.Name, + rpm.Name, gobinary.Name, nodemodules.Name, wheelegg.Name, @@ -543,6 +545,7 @@ func TestResolve_Extractors(t *testing.T) { dpkg.Name, chisel.Name, homebrew.Name, + rpm.Name, gobinary.Name, nodemodules.Name, wheelegg.Name, @@ -572,6 +575,7 @@ func TestResolve_Extractors(t *testing.T) { chisel.Name, gobinary.Name, homebrew.Name, + rpm.Name, nodemodules.Name, apkanno.Name, dpkganno.Name, @@ -593,6 +597,7 @@ func TestResolve_Extractors(t *testing.T) { dpkg.Name, chisel.Name, homebrew.Name, + rpm.Name, gitrepo.Name, gobinary.Name, nodemodules.Name, diff --git a/pkg/osvscanner/__snapshots__/osvscanner_test.snap b/pkg/osvscanner/__snapshots__/osvscanner_test.snap index 6597a0b8b5e..284eee8bff7 100755 --- a/pkg/osvscanner/__snapshots__/osvscanner_test.snap +++ b/pkg/osvscanner/__snapshots__/osvscanner_test.snap @@ -90,7 +90,7 @@ }, "details": "cryptidy through 1.2.4 allows code execution via untrusted data because pickle.loads is used. This occurs in aes_decrypt_message in symmetric_encryption.py.", "id": "CVE-2025-63675", - "modified": "2026-07-08T07:32:10.770698370Z", + "modified": "2026-07-15T01:48:52.277713523Z", "published": "2025-10-31T00:00:00Z", "references": [ {