Script 'mail_helper' called by obssrc Hello community, here is the log from the commit of package grype for openSUSE:Factory checked in at 2026-08-11 17:15:45 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Comparing /work/SRC/openSUSE:Factory/grype (Old) and /work/SRC/openSUSE:Factory/.grype.new.17972 (New) ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
Package is "grype" Tue Aug 11 17:15:45 2026 rev:127 rq:1370619 version:0.117.0 Changes: -------- --- /work/SRC/openSUSE:Factory/grype/grype.changes 2026-07-29 19:00:35.856435182 +0200 +++ /work/SRC/openSUSE:Factory/.grype.new.17972/grype.changes 2026-08-11 17:17:00.285713067 +0200 @@ -1,0 +2,29 @@ +Tue Aug 11 06:31:52 UTC 2026 - Johannes Kastl <[email protected]> + +- Update to version 0.117.0: + * Added Features + - Include vulnerable ranges in CycloneDX output format [Issue + #3512] [PR #3519 @somaz94] + * Bug Fixes + - honor match.rust.using-cpes configuration [PR #3611 @Dashtid] + * Dependencies + 11 dependency changes (11 updated). 2 vulnerabilities + remediated. + - Remediated (2) + - GHSA-hc8v-wwc9-vgxm (High) — github.com/go-git/go-git/v5 + - GHSA-qgq7-7hm3-q39j (Medium) — github.com/go-git/go-git/v5 + - Updated (11 packages) + - github.com/anchore/syft v1.50.0 → v1.51.0 + - github.com/diskfs/go-diskfs v1.9.3 → v1.9.4 + - github.com/gabriel-vasile/mimetype v1.4.13 → v1.4.15 + - github.com/go-git/go-billy/v5 v5.9.0 → v5.9.1 + - github.com/go-git/go-git/v5 v5.19.1 → v5.19.2 + (remediated GHSA-hc8v-wwc9-vgxm, GHSA-qgq7-7hm3-q39j) + - github.com/klauspost/compress v1.19.0 → v1.19.1 + - github.com/magiconair/properties v1.8.10 → v1.18.11 + - github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 → v6.0.3 + - github.com/ulikunitz/xz v0.5.15 → v0.5.16 + - go.yaml.in/yaml/v3 v3.0.4 → v3.0.5 + - modernc.org/sqlite v1.54.0 → v1.55.0 + +------------------------------------------------------------------- Old: ---- grype-0.116.1.obscpio New: ---- grype-0.117.0.obscpio ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++ Other differences: ------------------ ++++++ grype.spec ++++++ --- /var/tmp/diff_new_pack.tAdBEJ/_old 2026-08-11 17:17:05.081916309 +0200 +++ /var/tmp/diff_new_pack.tAdBEJ/_new 2026-08-11 17:17:05.085916478 +0200 @@ -17,7 +17,7 @@ Name: grype -Version: 0.116.1 +Version: 0.117.0 Release: 0 Summary: A vulnerability scanner for container images and filesystems License: Apache-2.0 ++++++ _service ++++++ --- /var/tmp/diff_new_pack.tAdBEJ/_old 2026-08-11 17:17:05.129918343 +0200 +++ /var/tmp/diff_new_pack.tAdBEJ/_new 2026-08-11 17:17:05.133918512 +0200 @@ -3,7 +3,7 @@ <param name="url">https://github.com/anchore/grype.git</param> <param name="scm">git</param> <param name="exclude">.git</param> - <param name="revision">refs/tags/v0.116.1</param> + <param name="revision">refs/tags/v0.117.0</param> <param name="match-tag">v*</param> <param name="versionformat">@PARENT_TAG@</param> <param name="versionrewrite-pattern">v(.*)</param> ++++++ _servicedata ++++++ --- /var/tmp/diff_new_pack.tAdBEJ/_old 2026-08-11 17:17:05.161919698 +0200 +++ /var/tmp/diff_new_pack.tAdBEJ/_new 2026-08-11 17:17:05.169920037 +0200 @@ -3,6 +3,6 @@ <param name="url">https://github.com/anchore/grype</param> <param name="changesrevision">fa8b7e2a528cf1f8b098123f256c61db9e5df69c</param></service><service name="tar_scm"> <param name="url">https://github.com/anchore/grype.git</param> - <param name="changesrevision">30394f177175da63ae36b35cdd809c248eb4de7f</param></service></servicedata> + <param name="changesrevision">b5fa92bbcbef655497e3be840a2f718380e2cdd3</param></service></servicedata> (No newline at EOF) ++++++ grype-0.116.1.obscpio -> grype-0.117.0.obscpio ++++++ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/.binny.yaml new/grype-0.117.0/.binny.yaml --- old/grype-0.116.1/.binny.yaml 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/.binny.yaml 2026-08-10 18:05:15.000000000 +0200 @@ -7,7 +7,7 @@ # used for integration tests - name: skopeo version: - want: v1.23.0 + want: v1.24.0 method: go-install with: module: github.com/containers/skopeo diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/.make/main.go new/grype-0.117.0/.make/main.go --- old/grype-0.116.1/.make/main.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/.make/main.go 2026-08-10 18:05:15.000000000 +0200 @@ -147,6 +147,7 @@ "generate:db-schema", "generate:codename-data", "generate:osv-model", + "generate:rhel-versions", ), Tasks: []Task{ { @@ -182,6 +183,14 @@ Run("go generate ./grype/db/internal/provider/unmarshal/osvmodel/...") }, }, + { + Name: "generate:rhel-versions", + Description: "regenerate the RHEL minor-version span from Red Hat's product " + + "life-cycle API", + Run: func() { + Run("go generate ./grype/db/v6/build/transformers/os/...") + }, + }, }, } } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/cmd/grype/cli/commands/root.go new/grype-0.117.0/cmd/grype/cli/commands/root.go --- old/grype-0.116.1/cmd/grype/cli/commands/root.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/cmd/grype/cli/commands/root.go 2026-08-10 18:05:15.000000000 +0200 @@ -28,6 +28,7 @@ "github.com/anchore/grype/grype/matcher/python" "github.com/anchore/grype/grype/matcher/rpm" "github.com/anchore/grype/grype/matcher/ruby" + "github.com/anchore/grype/grype/matcher/rust" "github.com/anchore/grype/grype/matcher/stock" "github.com/anchore/grype/grype/pkg" "github.com/anchore/grype/grype/presenter/models" @@ -382,6 +383,7 @@ AlwaysUseCPEForStdlib: opts.Match.Golang.AlwaysUseCPEForStdlib, AllowMainModulePseudoVersionComparison: opts.Match.Golang.AllowMainModulePseudoVersionComparison, }, + Rust: rust.MatcherConfig(opts.Match.Rust), Hex: hex.MatcherConfig(opts.Match.Hex), Stock: stock.MatcherConfig(opts.Match.Stock), Dpkg: dpkg.MatcherConfig{ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/cmd/grype/cli/commands/root_test.go new/grype-0.117.0/cmd/grype/cli/commands/root_test.go --- old/grype-0.116.1/cmd/grype/cli/commands/root_test.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/cmd/grype/cli/commands/root_test.go 2026-08-10 18:05:15.000000000 +0200 @@ -23,6 +23,7 @@ "github.com/anchore/grype/grype/matcher/python" "github.com/anchore/grype/grype/matcher/rpm" "github.com/anchore/grype/grype/matcher/ruby" + "github.com/anchore/grype/grype/matcher/rust" "github.com/anchore/grype/grype/matcher/stock" "github.com/anchore/grype/grype/pkg" "github.com/anchore/grype/grype/version" @@ -206,6 +207,42 @@ }, }, }, + { + name: "rust using-cpes enabled", + opts: func() *options.Grype { + opts := options.DefaultGrype(clio.Identification{Name: "test", Version: "1.0"}) + opts.Match.Rust.UseCPEs = true + return opts + }(), + want: matcher.Config{ + Java: java.MatcherConfig{ + ExternalSearchConfig: java.ExternalSearchConfig{ + SearchMavenUpstream: false, + MavenBaseURL: "https://search.maven.org/solrsearch/select";, + MavenRateLimit: 300000000, + }, + UseCPEs: false, + }, + Ruby: ruby.MatcherConfig{}, + Python: python.MatcherConfig{}, + Dotnet: dotnet.MatcherConfig{}, + Javascript: javascript.MatcherConfig{}, + Golang: golang.MatcherConfig{ + UseCPEs: false, + AlwaysUseCPEForStdlib: false, + AllowMainModulePseudoVersionComparison: false, + }, + Rust: rust.MatcherConfig{UseCPEs: true}, + Hex: hex.MatcherConfig{}, + Stock: stock.MatcherConfig{UseCPEs: true}, + Rpm: rpm.MatcherConfig{ + MissingEpochStrategy: "auto", + }, + Dpkg: dpkg.MatcherConfig{ + MissingEpochStrategy: "zero", + }, + }, + }, } for _, tt := range tests { t.Run(tt.name, func(t *testing.T) { diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/go.mod new/grype-0.117.0/go.mod --- old/grype-0.116.1/go.mod 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/go.mod 2026-08-10 18:05:15.000000000 +0200 @@ -28,7 +28,7 @@ github.com/docker/docker v28.5.2+incompatible github.com/dustin/go-humanize v1.0.1 github.com/facebookincubator/nvdtools v0.1.5 - github.com/gabriel-vasile/mimetype v1.4.13 + github.com/gabriel-vasile/mimetype v1.4.15 github.com/gkampitakis/go-snaps v0.5.23 github.com/glebarez/sqlite v1.11.0 github.com/go-test/deep v1.1.1 @@ -47,7 +47,7 @@ github.com/iancoleman/strcase v0.3.0 github.com/invopop/jsonschema v0.14.0 github.com/jinzhu/copier v0.4.0 - github.com/klauspost/compress v1.19.0 + github.com/klauspost/compress v1.19.1 github.com/knqyf263/go-apk-version v0.0.0-20200609155635-041fdbb8563f github.com/knqyf263/go-deb-version v0.0.0-20241115132648-6f4aee6ccd23 github.com/masahiro331/go-mvn-version v0.0.0-20250131095131-f4974fa13b8a @@ -63,7 +63,7 @@ github.com/spf13/afero v1.15.0 github.com/spf13/cobra v1.10.2 github.com/stretchr/testify v1.11.1 - github.com/ulikunitz/xz v0.5.15 + github.com/ulikunitz/xz v0.5.16 github.com/umisama/go-cpe v0.0.0-20190323060751-cdd6c3c28a23 github.com/wagoodman/go-partybus v0.0.0-20230516145632-8ccac152c651 github.com/wagoodman/go-presenter v0.0.0-20211015174752-f9c01afc824b @@ -78,9 +78,9 @@ ) require ( - github.com/anchore/syft v1.50.0 + github.com/anchore/syft v1.51.0 github.com/bmatcuk/doublestar/v4 v4.10.0 - github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 + github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 ) require ( @@ -169,7 +169,7 @@ github.com/cyphar/filepath-securejoin v0.6.1 // indirect github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb // indirect - github.com/diskfs/go-diskfs v1.9.3 // indirect + github.com/diskfs/go-diskfs v1.9.4 // indirect github.com/distribution/reference v0.6.0 // indirect github.com/docker/cli v29.6.1+incompatible // indirect github.com/docker/docker-credential-helpers v0.9.5 // indirect @@ -189,8 +189,8 @@ github.com/gkampitakis/ciinfo v0.3.4 // indirect github.com/glebarez/go-sqlite v1.22.0 // indirect github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect - github.com/go-git/go-billy/v5 v5.9.0 // indirect - github.com/go-git/go-git/v5 v5.19.1 // indirect + github.com/go-git/go-billy/v5 v5.9.1 // indirect + github.com/go-git/go-git/v5 v5.19.2 // indirect github.com/go-jose/go-jose/v4 v4.1.4 // indirect github.com/go-logr/logr v1.4.3 // indirect github.com/go-logr/stdr v1.2.2 // indirect @@ -320,7 +320,7 @@ go.opentelemetry.io/otel/sdk v1.43.0 // indirect go.opentelemetry.io/otel/sdk/metric v1.43.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect - go.yaml.in/yaml/v3 v3.0.4 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect go.yaml.in/yaml/v4 v4.0.0-rc.2 // indirect go4.org v0.0.0-20230225012048-214862532bf5 // indirect golang.org/x/crypto v0.54.0 // indirect @@ -343,5 +343,5 @@ modernc.org/libc v1.74.1 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.11.0 // indirect - modernc.org/sqlite v1.54.0 // indirect + modernc.org/sqlite v1.55.0 // indirect ) diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/go.sum new/grype-0.117.0/go.sum --- old/grype-0.116.1/go.sum 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/go.sum 2026-08-10 18:05:15.000000000 +0200 @@ -154,8 +154,8 @@ github.com/anchore/packageurl-go v0.2.0/go.mod h1:2JCgOQMIsqZ7TmliXG4PnUthPJAKE3mWQbsW2XHjAOE= github.com/anchore/stereoscope v0.3.0 h1:6mGGRxm4zRKj/jNiSM7g6XGwWihrnkQRJj11hcULDqY= github.com/anchore/stereoscope v0.3.0/go.mod h1:QIBWxa5WCrjtBqXH0+RIuECATrffcbaNdMWquZ83+OI= -github.com/anchore/syft v1.50.0 h1:kSQ4oshw6dwHxcYhrH1jUZl/M05kiCfyPoGJgvXe61s= -github.com/anchore/syft v1.50.0/go.mod h1:wxudLuDHN12O/Ihw9loABNg0u2r2qFh0Zx0p4PEvGQ8= +github.com/anchore/syft v1.51.0 h1:0AZveyFLkCK96uk/ykoRo1ScJ7qJ+/SgNbv7XRmJcGU= +github.com/anchore/syft v1.51.0/go.mod h1:UJzSbbwUHvFZ+E8YeAfbG4t0NA4nPRdQPaXI+I/eIXs= github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883/go.mod h1:rCTlJbsFo29Kk6CurOXKm700vrz8f0KW0JNfpkRJY/8= github.com/andybalholm/brotli v1.2.0 h1:ukwgCxwYrmACq68yiUqwIWnGY0cTPox/M94sVwToPjQ= github.com/andybalholm/brotli v1.2.0/go.mod h1:rzTDkvFWvIrjDXZHkuS16NPggd91W3kUSvPlQ1pLaKY= @@ -342,8 +342,8 @@ github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb h1:4W/2rQ3wzEimF5s+J6OY3ODiQtJZ5W1sForSgogVXkY= github.com/deitch/magic v0.0.0-20240306090643-c67ab88f10cb/go.mod h1:B3tI9iGHi4imdLi4Asdha1Sc6feLMTfPLXh9IUYmysk= github.com/dgrijalva/jwt-go/v4 v4.0.0-preview1/go.mod h1:+hnT3ywWDTAFrW5aE+u2Sa/wT555ZqwoCS+pk3p6ry4= -github.com/diskfs/go-diskfs v1.9.3 h1:cLciNCeZ4QAXVxyPJDr1ZJ9N9CCG3rQlQ/z/Cs/cNDM= -github.com/diskfs/go-diskfs v1.9.3/go.mod h1:TePJORO83Adh5pb2SqsxAwaP0fofFxKLkxctiS/9OQc= +github.com/diskfs/go-diskfs v1.9.4 h1:0j2d7eG4IjyxL6+ChWbDPocdBCF6HQ4HBWU2WDYWVnc= +github.com/diskfs/go-diskfs v1.9.4/go.mod h1:TePJORO83Adh5pb2SqsxAwaP0fofFxKLkxctiS/9OQc= github.com/distribution/reference v0.6.0 h1:0IXCQ5g4/QMHHkarYzh5l+u8T3t73zM5QvfrDyIgxBk= github.com/distribution/reference v0.6.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E= github.com/djherbis/times v1.6.0 h1:w2ctJ92J8fBvWPxugmXIv7Nz7Q3iDMKNx9v5ocVH20c= @@ -416,8 +416,8 @@ github.com/fsnotify/fsnotify v1.5.1/go.mod h1:T3375wBYaZdLLcVNkcVbzGHY7f1l/uK5T5Ai1i3InKU= github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k= github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0= -github.com/gabriel-vasile/mimetype v1.4.13 h1:46nXokslUBsAJE/wMsp5gtO500a4F3Nkz9Ufpk2AcUM= -github.com/gabriel-vasile/mimetype v1.4.13/go.mod h1:d+9Oxyo1wTzWdyVUPMmXFvp4F9tea18J8ufA774AB3s= +github.com/gabriel-vasile/mimetype v1.4.15 h1:05iP/CYtZ/w455R/KZM6rZ5ieAdh99UPtd+d3YzLmaI= +github.com/gabriel-vasile/mimetype v1.4.15/go.mod h1:azpTcoLcDZRNgFou5j+APrqQx9HqVPWa6ijYQIIVswQ= github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04= github.com/github/go-spdx/v2 v2.7.0 h1:GzfXx4wFdlilARxmFRXW/mgUy3A4vSqZocCMFV6XFdQ= github.com/github/go-spdx/v2 v2.7.0/go.mod h1:Ftc45YYG1WzpzwEPKRVm9Jv8vDqOrN4gWoCkK+bHer0= @@ -433,12 +433,12 @@ github.com/gliderlabs/ssh v0.3.8/go.mod h1:xYoytBv1sV0aL3CavoDuJIQNURXkkfPA/wxQ1pL1fAU= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 h1:+zs/tPmkDkHx3U66DAb0lQFJrpS6731Oaa12ikc+DiI= github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376/go.mod h1:an3vInlBmSxCcxctByoQdvwPiA7DTK7jaaFDBTtu0ic= -github.com/go-git/go-billy/v5 v5.9.0 h1:jItGXszUDRtR/AlferWPTMN4j38BQ88XnXKbilmmBPA= -github.com/go-git/go-billy/v5 v5.9.0/go.mod h1:jCnQMLj9eUgGU7+ludSTYoZL/GGmii14RxKFj7ROgHw= +github.com/go-git/go-billy/v5 v5.9.1 h1:8U73XiOTfINdItHVa6z4Gv7ToObcZ6grkqQbLryLCdA= +github.com/go-git/go-billy/v5 v5.9.1/go.mod h1:ExsU+jcGwXTBOnyilvAnEM1wug1IxHr4yP2ZXsNRtV0= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399 h1:eMje31YglSBqCdIqdhKBW8lokaMrL3uTkpGYlE2OOT4= github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399/go.mod h1:1OCfN199q1Jm3HZlxleg+Dw/mwps2Wbk9frAWm+4FII= -github.com/go-git/go-git/v5 v5.19.1 h1:nX27AnaU43/K5bKktKwgBmR9lawoYVe1Ckg0rgzzN00= -github.com/go-git/go-git/v5 v5.19.1/go.mod h1:Pb1v0c7/g8aGQJwx9Us09W85yGoyvSwuhEGMH7zjDKQ= +github.com/go-git/go-git/v5 v5.19.2 h1:wkfn7vOlUBu8ivAWKBWisTiwJK4jYHzTF8Ndv1LyGqY= +github.com/go-git/go-git/v5 v5.19.2/go.mod h1:QqCBE1EFN5ddFmrliLQ3/ntRCUjZU3EJuwuB/jWEHjk= github.com/go-gl/glfw v0.0.0-20190409004039-e6da0acd62b1/go.mod h1:vR7hzQXu2zJy9AVAgeJqvqgH9Q5CA+iKCZ2gyEVpxRU= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20191125211704-12ad95a8df72/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= github.com/go-gl/glfw/v3.3/glfw v0.0.0-20200222043503-6f7a984d4dc4/go.mod h1:tQ2UAYgL5IevRw8kRxooKSPJfGvJ9fJQFa0TUsXzTg8= @@ -674,8 +674,8 @@ github.com/kisielk/errcheck v1.5.0/go.mod h1:pFxgyoBC7bSaBwPgfKdkLd5X25qrDl4LWUI2bnpBCr8= github.com/kisielk/gotool v1.0.0/go.mod h1:XhKaO+MFFWcvkIS/tQcRk01m1F5IRFswLeQ+oQHNcck= github.com/klauspost/compress v1.4.1/go.mod h1:RyIbtBH6LamlWaDj8nUwkbUhJ87Yi3uG0guNDohfE1A= -github.com/klauspost/compress v1.19.0 h1:sXLILfc9jV2QYWkzFOPWStmcUVH2RHEB1JCdY2oVvCQ= -github.com/klauspost/compress v1.19.0/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= +github.com/klauspost/compress v1.19.1 h1:VsB4HPswih7mmZ8WleSFQ75c/Ui1M4trX5oAsJnhSlk= +github.com/klauspost/compress v1.19.1/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ= github.com/klauspost/cpuid v1.2.0/go.mod h1:Pj4uuM528wm8OyEC2QMXAi2YiTZ96dNQPGgoMS4s3ek= github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y= github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0= @@ -701,8 +701,8 @@ github.com/lucasb-eyer/go-colorful v1.3.0/go.mod h1:R4dSotOR9KMtayYi1e77YzuveK+i7ruzyGqttikkLy0= github.com/lyft/protoc-gen-star v0.5.3/go.mod h1:V0xaHgaf5oCCqmcxYcWiDfTiKsZsRc87/1qhoTACD8w= github.com/magiconair/properties v1.8.5/go.mod h1:y3VJvCyxH9uVvJTWEGAELF3aiYNyPKd5NZ3oSwXrF60= -github.com/magiconair/properties v1.8.10 h1:s31yESBquKXCV9a/ScB3ESkOjUYYv+X0rg8SYxI99mE= -github.com/magiconair/properties v1.8.10/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= +github.com/magiconair/properties v1.18.11 h1:j5ozYZl0zCjG7ahMDH0GWIobOvvUzT0BdAguG0ViKy0= +github.com/magiconair/properties v1.18.11/go.mod h1:Dhd985XPs7jluiymwWYZ0G4Z61jb3vdS329zhj2hYo0= github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc= github.com/maruel/natural v1.3.0 h1:VsmCsBmEyrR46RomtgHs5hbKADGRVtliHTyCOLFBpsg= github.com/maruel/natural v1.3.0/go.mod h1:v+Rfd79xlw1AgVBjbO0BEQmptqb5HvL/k9GRHB7ZKEg= @@ -901,8 +901,8 @@ github.com/saintfish/chardet v0.0.0-20230101081208-5e3ef4b5456d/go.mod h1:uugorj2VCxiV1x+LzaIdVa9b4S4qGAcH6cbhh4qVxOU= github.com/sanity-io/litter v1.5.8 h1:uM/2lKrWdGbRXDrIq08Lh9XtVYoeGtcQxk9rtQ7+rYg= github.com/sanity-io/litter v1.5.8/go.mod h1:9gzJgR2i4ZpjZHsKvUXIRQVk7P+yM3e+jAF7bU2UI5U= -github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 h1:KRzFb2m7YtdldCEkzs6KqmJw4nqEVZGK7IN2kJkjTuQ= -github.com/santhosh-tekuri/jsonschema/v6 v6.0.2/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3 h1:1EYB5IzjZawrrnELUi78f9fPu57HuXjmddZPjrls/28= +github.com/santhosh-tekuri/jsonschema/v6 v6.0.3/go.mod h1:JXeL+ps8p7/KNMjDQk3TCwPpBy0wYklyWTfbkIzdIFU= github.com/sassoftware/go-rpmutils v0.4.0 h1:ojND82NYBxgwrV+mX1CWsd5QJvvEZTKddtCdFLPWhpg= github.com/sassoftware/go-rpmutils v0.4.0/go.mod h1:3goNWi7PGAT3/dlql2lv3+MSN5jNYPjT5mVcQcIsYzI= github.com/scylladb/go-set v1.0.3-0.20200225121959-cc7b2070d91e h1:7q6NSFZDeGfvvtIRwBrU/aegEYJYmvev0cHAwo17zZQ= @@ -999,8 +999,8 @@ github.com/tidwall/sjson v1.2.5/go.mod h1:Fvgq9kS/6ociJEDnK0Fk1cpYF4FIW6ZF7LAe+6jwd28= github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926/go.mod h1:9ESjWnEqriFuLhtthL60Sar/7RFoluCcXsuvEwTV5KM= github.com/ulikunitz/xz v0.5.8/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= -github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY= -github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14= +github.com/ulikunitz/xz v0.5.16 h1:ld6NyySjx5lowVKwJvMRLnW5nxKX/xnpSiFYZ/Lxur0= +github.com/ulikunitz/xz v0.5.16/go.mod h1:H9Rt/W6/Qj27PGauhQc6nfCDy7vHpzsOThBSaYDoEhw= github.com/umisama/go-cpe v0.0.0-20190323060751-cdd6c3c28a23 h1:+168JmE638t0OxroPRx7BUbkB91hF3GWS1OkvITgdT0= github.com/umisama/go-cpe v0.0.0-20190323060751-cdd6c3c28a23/go.mod h1:Jv/KoYWD3+46wW8r3pEwISwtgv5Q8NTfFto2wFRKvoA= github.com/vbatts/go-mtree v0.7.0 h1:ytmOc3MTRidZiBi9VBCyZ2BHe4fZS47L5v7BVXDWW4E= @@ -1088,8 +1088,9 @@ go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE= go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.uber.org/zap v1.17.0/go.mod h1:MXVU+bhUf/A7Xi2HNOnopQOrmycQ5Ih87HtOu4q5SSo= -go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc= go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg= +go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= +go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= go.yaml.in/yaml/v4 v4.0.0-rc.2 h1:/FrI8D64VSr4HtGIlUtlFMGsm7H7pWTbj6vOLVZcA6s= go.yaml.in/yaml/v4 v4.0.0-rc.2/go.mod h1:aZqd9kCMsGL7AuUv/m/PvWLdg5sjJsZ4oHDEnfPPfY0= go4.org v0.0.0-20230225012048-214862532bf5 h1:nifaUDeh+rPaBCMPMQHZmvJf+QdpLFnuQPwx+LxVmtc= @@ -1610,8 +1611,8 @@ modernc.org/opt v0.2.0/go.mod h1:03fq9lsNfvkYSfxrfUhZCWPk1lm4cq4N+Bh//bEtgns= modernc.org/sortutil v1.2.1 h1:+xyoGf15mM3NMlPDnFqrteY07klSFxLElE2PVuWIJ7w= modernc.org/sortutil v1.2.1/go.mod h1:7ZI3a3REbai7gzCLcotuw9AC4VZVpYMjDzETGsSMqJE= -modernc.org/sqlite v1.54.0 h1:JCxR4qwkJvOaqAoYcgDoO25Nc+ROg6EJ2LfBVzdrgog= -modernc.org/sqlite v1.54.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw= +modernc.org/sqlite v1.55.0 h1:hIFh0MCH0rGinQ/4KYb5/UbCkRkb+UP+OkLCVWa5MTM= +modernc.org/sqlite v1.55.0/go.mod h1:4ntCLuNmnH8+GNqjka1wNg7KJd5/Hi5FYp8K+XQ7GZw= modernc.org/strutil v1.2.1 h1:UneZBkQA+DX2Rp35KcM69cSsNES9ly8mQWD71HKlOA0= modernc.org/strutil v1.2.1/go.mod h1:EHkiggD70koQxjVdSBM3JKM7k6L0FbGE5eymy9i3B9A= modernc.org/token v1.1.0 h1:Xl7Ap9dKaEs5kLoOQeQmPWevfnk/DM5qcLcYlA8ys6Y= diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.json new/grype-0.117.0/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.json --- old/grype-0.116.1/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.json 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.json 2026-08-10 18:05:15.000000000 +0200 @@ -419,6 +419,7 @@ "Go", "Hackage", "Hex", + "Homebrew", "Julia", "Kubernetes", "Linux", @@ -445,7 +446,8 @@ "Ubuntu", "vcpkg", "VSCode", - "Wolfi" + "Wolfi", + "WordPress" ] }, "ecosystemSuffix": { @@ -456,13 +458,13 @@ "type": "string", "title": "Currently supported ecosystems", "description": "These ecosystems are also documented at https://ossf.github.io/osv-schema/#affectedpackage-field";, - "pattern": "^(AlmaLinux|Alpaquita|Alpine|Android|Azure Linux|BellSoft Hardened Containers|Bioconductor|Bitnami|Chainguard|CleanStart|ConanCenter|CRAN|crates\\.io|Debian|Docker Hardened Images|Echo|FreeBSD|GHC|GitHub Actions|Go|Hackage|Hex|Julia|Kubernetes|Linux|Mageia|Maven|MinimOS|npm|NuGet|opam|openEuler|openSUSE|OSS-Fuzz|Packagist|Photon OS|Pub|PyPI|Red Hat|Rocky Linux|Root|RubyGems|SUSE|SwiftURL|TuxCare|Ubuntu|vcpkg|VSCode|Wolfi|GIT)(:.+)?$" + "pattern": "^(AlmaLinux|Alpaquita|Alpine|Android|Azure Linux|BellSoft Hardened Containers|Bioconductor|Bitnami|Chainguard|CleanStart|ConanCenter|CRAN|crates\\.io|Debian|Docker Hardened Images|Echo|FreeBSD|GHC|GitHub Actions|Go|Hackage|Hex|Homebrew|Julia|Kubernetes|Linux|Mageia|Maven|MinimOS|npm|NuGet|opam|openEuler|openSUSE|OSS-Fuzz|Packagist|Photon OS|Pub|PyPI|Red Hat|Rocky Linux|Root|RubyGems|SUSE|SwiftURL|TuxCare|Ubuntu|vcpkg|VSCode|Wolfi|WordPress|GIT)(:.+)?$" }, "prefix": { "type": "string", "title": "Currently supported home database identifier prefixes", "description": "These home databases are also documented at https://ossf.github.io/osv-schema/#id-modified-fields";, - "pattern": "^(x_|(ASB-A|PUB-A|ALPINE|ALSA|ALBA|ALEA|AZL|BELL|BIT|CGA|CLEANSTART|CLSA|CURL|CVE|DEBIAN|DHI|DRUPAL|DSA|DLA|ELA|DTSA|ECHO|EEF|FreeBSD|GHSA|GO|GSD|HSEC|JLSEC|KUBE|LBSEC|LSN|MAL|MINI|MGASA|OESA|OSEC|OSV|openSUSE-SU|PHSA|PSF|PYSEC|RHBA|RHEA|RHSA|RLSA|RXSA|RSEC|ROOT|RUSTSEC|SUSE-[SRFO]U|UBUNTU|USN|V8|VCPKG)-)" + "pattern": "^(x_|(ASB-A|PUB-A|ALPINE|ALSA|ALBA|ALEA|AZL|BELL|BIT|BREW|CGA|CLEANSTART|CLSA|CURL|CVE|DEBIAN|DHI|DRUPAL|DSA|DLA|ELA|DTSA|ECHO|EEF|FreeBSD|GHSA|GO|GSD|HSEC|JLSEC|KUBE|LBSEC|LSN|MAL|MINI|MGASA|OESA|OSEC|OSV|openSUSE-SU|PHSA|PSF|PYSEC|RHBA|RHEA|RHSA|RLSA|RXSA|RSEC|ROOT|RUSTSEC|SUSE-[SRFO]U|UBUNTU|USN|V8|VCPKG)-)" }, "severity": { "type": [ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.tag new/grype-0.117.0/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.tag --- old/grype-0.116.1/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.tag 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/db/internal/provider/unmarshal/osvmodel/schema-v1.tag 2026-08-10 18:05:15.000000000 +0200 @@ -1 +1 @@ -v1.8.0 +v1.9.0 diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/db/internal/provider/unmarshal/osvmodel/vulnerability_generated.go new/grype-0.117.0/grype/db/internal/provider/unmarshal/osvmodel/vulnerability_generated.go --- old/grype-0.116.1/grype/db/internal/provider/unmarshal/osvmodel/vulnerability_generated.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/db/internal/provider/unmarshal/osvmodel/vulnerability_generated.go 2026-08-10 18:05:15.000000000 +0200 @@ -1,6 +1,6 @@ -// Code generated by ./generate/main.go from osv-schema v1.8.0. DO NOT EDIT. +// Code generated by ./generate/main.go from osv-schema v1.9.0. DO NOT EDIT. // Regenerate via: make generate:osv-model -// Source: github.com/ossf/[email protected] (validation/schema.json) +// Source: github.com/ossf/[email protected] (validation/schema.json) // // Package osvmodel is grype's representation of an OSV record. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/db/v6/build/transformers/os/generate.go new/grype-0.117.0/grype/db/v6/build/transformers/os/generate.go --- old/grype-0.116.1/grype/db/v6/build/transformers/os/generate.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/db/v6/build/transformers/os/generate.go 2026-08-10 18:05:15.000000000 +0200 @@ -2,6 +2,6 @@ // rhelMinorSpan (rhel_minor_span_generated.go) is generated from Red Hat's official // product life-cycle API; see generate/main.go. Values change only when Red Hat -// announces a new major (or retires one), so regeneration is an infrequent, -// reviewed event rather than a scheduled chore. +// announces a new major (or retires one), so most runs are a no-op. oss-release runs +// `make generate:rhel-versions` weekly and opens a PR when the data does move. //go:generate go run ./generate diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterDir.golden new/grype-0.117.0/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterDir.golden --- old/grype-0.116.1/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterDir.golden 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterDir.golden 2026-08-10 18:05:15.000000000 +0200 @@ -2,10 +2,10 @@ "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json";, "bomFormat": "CycloneDX", "specVersion": "1.7", - "serialNumber": "urn:uuid:802d9c0b-716e-4050-a832-9a697dc0d796", + "serialNumber": "urn:uuid:1a47c243-8435-4e85-9e38-4cf505792d43", "version": 1, "metadata": { - "timestamp": "2026-03-19T11:34:26-04:00", + "timestamp": "2026-07-07T16:57:37+09:00", "tools": { "components": [ { @@ -19,7 +19,7 @@ "component": { "bom-ref": "163686ac6e30c752", "type": "file", - "name": "/var/folders/09/zjmdnk0n4496cmzrdkxbw1tr0000gn/T/TestCycloneDxPresenterDir688002288/001" + "name": "/var/folders/tp/5p77wf0n4m35dw400_lxxmph0000gn/T/TestCycloneDxPresenterDir2862837514/001" } }, "components": [ @@ -89,7 +89,7 @@ ], "vulnerabilities": [ { - "bom-ref": "urn:uuid:a73ee074-a643-466a-82ba-1669a7fa5c1d", + "bom-ref": "urn:uuid:5bd5ef96-ee87-4ee1-a5d3-752ff944802b", "id": "CVE-1999-0001", "source": {}, "references": [ @@ -116,12 +116,30 @@ ], "affects": [ { - "ref": "a246fd2054833c93" + "ref": "a246fd2054833c93", + "versions": [ + { + "version": "1.1.1", + "status": "affected" + }, + { + "range": "vers:generic/>=1.2.1", + "status": "unaffected" + }, + { + "range": "vers:generic/>=2.1.3", + "status": "unaffected" + }, + { + "range": "vers:generic/>=3.4.0", + "status": "unaffected" + } + ] } ] }, { - "bom-ref": "urn:uuid:7324150f-e4ab-4d68-8dd8-b9721b4a0eed", + "bom-ref": "urn:uuid:b961c261-a5da-4f5a-9829-d385b44b5123", "id": "CVE-1999-0002", "source": {}, "references": [ @@ -157,7 +175,13 @@ ], "affects": [ { - "ref": "pkg:deb/[email protected]?package-id=74378afe15713625" + "ref": "pkg:deb/[email protected]?package-id=74378afe15713625", + "versions": [ + { + "version": "2.2.2", + "status": "affected" + } + ] } ] } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterImage.golden new/grype-0.117.0/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterImage.golden --- old/grype-0.116.1/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterImage.golden 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/presenter/cyclonedx/testdata/snapshot/TestCycloneDxPresenterImage.golden 2026-08-10 18:05:15.000000000 +0200 @@ -2,10 +2,10 @@ "$schema": "http://cyclonedx.org/schema/bom-1.7.schema.json";, "bomFormat": "CycloneDX", "specVersion": "1.7", - "serialNumber": "urn:uuid:491fc8dc-9384-4f3d-a729-d2c5a83791d8", + "serialNumber": "urn:uuid:553dd7b9-6d15-4824-bfa6-816d02a29b67", "version": 1, "metadata": { - "timestamp": "2026-03-19T11:34:26-04:00", + "timestamp": "2026-07-07T16:57:37+09:00", "tools": { "components": [ { @@ -90,7 +90,7 @@ ], "vulnerabilities": [ { - "bom-ref": "urn:uuid:8f52aaa6-907a-43e7-8b48-836453a51bbf", + "bom-ref": "urn:uuid:1ab17948-c716-4578-8576-7321790968ca", "id": "CVE-1999-0001", "source": {}, "references": [ @@ -117,12 +117,30 @@ ], "affects": [ { - "ref": "a246fd2054833c93" + "ref": "a246fd2054833c93", + "versions": [ + { + "version": "1.1.1", + "status": "affected" + }, + { + "range": "vers:generic/>=1.2.1", + "status": "unaffected" + }, + { + "range": "vers:generic/>=2.1.3", + "status": "unaffected" + }, + { + "range": "vers:generic/>=3.4.0", + "status": "unaffected" + } + ] } ] }, { - "bom-ref": "urn:uuid:166daf49-c343-460e-b66a-c22247147678", + "bom-ref": "urn:uuid:6d45f9fc-91ad-48ff-905a-0df90643f49f", "id": "CVE-1999-0002", "source": {}, "references": [ @@ -158,7 +176,13 @@ ], "affects": [ { - "ref": "pkg:deb/[email protected]?package-id=74378afe15713625" + "ref": "pkg:deb/[email protected]?package-id=74378afe15713625", + "versions": [ + { + "version": "2.2.2", + "status": "affected" + } + ] } ] } diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/presenter/cyclonedx/vulnerability.go new/grype-0.117.0/grype/presenter/cyclonedx/vulnerability.go --- old/grype-0.116.1/grype/presenter/cyclonedx/vulnerability.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/presenter/cyclonedx/vulnerability.go 2026-08-10 18:05:15.000000000 +0200 @@ -1,6 +1,7 @@ package cyclonedx import ( + "fmt" "strconv" "strings" @@ -8,6 +9,7 @@ "github.com/google/uuid" "github.com/anchore/grype/grype/presenter/models" + "github.com/anchore/grype/grype/vulnerability" "github.com/anchore/packageurl-go" ) @@ -56,7 +58,8 @@ Advisories: advisories, Affects: &[]cyclonedx.Affects{ { - Ref: deriveBomRef(m.Artifact), + Ref: deriveBomRef(m.Artifact), + Range: generateAffectedVersions(m), }, }, // Data source creation @@ -183,6 +186,50 @@ } } +// generateAffectedVersions builds the CycloneDX affected-version records for a match. The matched +// package version is always reported as affected; when the vulnerability has known fixed-in +// versions, each fix is reported as an unaffected `vers`-syntax range so consumers can tell whether +// a patch is available and automate remediation. Returns nil when neither is known, preserving the +// prior behavior of omitting the `versions` array. +func generateAffectedVersions(m models.Match) *[]cyclonedx.AffectedVersions { + var versions []cyclonedx.AffectedVersions + + if m.Artifact.Version != "" { + versions = append(versions, cyclonedx.AffectedVersions{ + Version: m.Artifact.Version, + Status: cyclonedx.VulnerabilityStatusAffected, + }) + } + + if m.Vulnerability.Fix.State == string(vulnerability.FixStateFixed) { + scheme := versScheme(m.Artifact) + for _, fixedVersion := range m.Vulnerability.Fix.Versions { + if fixedVersion == "" { + continue + } + versions = append(versions, cyclonedx.AffectedVersions{ + // vers (Package URL version range) syntax: https://www.packageurl.org/docs/vers/how-to-parse + Range: fmt.Sprintf("vers:%s/>=%s", scheme, fixedVersion), + Status: cyclonedx.VulnerabilityStatusNotAffected, + }) + } + } + + if len(versions) == 0 { + return nil + } + return &versions +} + +// versScheme returns the vers versioning scheme for a package, derived from its PURL type (the vers +// scheme namespace aligns with PURL types). Falls back to "generic" when no valid PURL is present. +func versScheme(p models.Package) string { + if parsed, err := packageurl.FromString(p.PURL); err == nil && parsed.Type != "" { + return parsed.Type + } + return "generic" +} + func deriveBomRef(p models.Package) string { // try and parse the PURL if possible and append syft id to it, to make // the purl unique in the BOM. diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/grype/presenter/cyclonedx/vulnerability_test.go new/grype-0.117.0/grype/presenter/cyclonedx/vulnerability_test.go --- old/grype-0.116.1/grype/presenter/cyclonedx/vulnerability_test.go 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/grype/presenter/cyclonedx/vulnerability_test.go 2026-08-10 18:05:15.000000000 +0200 @@ -146,6 +146,111 @@ } } +var affectedVersionsTests = []struct { + name string + match models.Match + expected []cyclonedx.AffectedVersions +}{ + { + name: "matched version with a fix reports affected version and unaffected vers range", + match: models.Match{ + Vulnerability: models.Vulnerability{ + Fix: models.Fix{ + State: string(vulnerability.FixStateFixed), + Versions: []string{"1.14.3-8.fc23"}, + }, + }, + Artifact: models.Package{ + Version: "1.14.1-6.fc23", + PURL: "pkg:rpm/fedora/[email protected]", + }, + }, + expected: []cyclonedx.AffectedVersions{ + {Version: "1.14.1-6.fc23", Status: cyclonedx.VulnerabilityStatusAffected}, + {Range: "vers:rpm/>=1.14.3-8.fc23", Status: cyclonedx.VulnerabilityStatusNotAffected}, + }, + }, + { + name: "multiple fixed versions each produce a vers range", + match: models.Match{ + Vulnerability: models.Vulnerability{ + Fix: models.Fix{ + State: string(vulnerability.FixStateFixed), + Versions: []string{"1.14.3-8.fc23", "1.14.3-4.fc23"}, + }, + }, + Artifact: models.Package{ + Version: "1.14.2-1.fc23", + PURL: "pkg:rpm/fedora/[email protected]", + }, + }, + expected: []cyclonedx.AffectedVersions{ + {Version: "1.14.2-1.fc23", Status: cyclonedx.VulnerabilityStatusAffected}, + {Range: "vers:rpm/>=1.14.3-8.fc23", Status: cyclonedx.VulnerabilityStatusNotAffected}, + {Range: "vers:rpm/>=1.14.3-4.fc23", Status: cyclonedx.VulnerabilityStatusNotAffected}, + }, + }, + { + name: "not-fixed state reports only the affected version", + match: models.Match{ + Vulnerability: models.Vulnerability{ + Fix: models.Fix{ + State: string(vulnerability.FixStateNotFixed), + }, + }, + Artifact: models.Package{ + Version: "2.4.0", + PURL: "pkg:golang/github.com/example/[email protected]", + }, + }, + expected: []cyclonedx.AffectedVersions{ + {Version: "2.4.0", Status: cyclonedx.VulnerabilityStatusAffected}, + }, + }, + { + name: "missing PURL falls back to the generic vers scheme", + match: models.Match{ + Vulnerability: models.Vulnerability{ + Fix: models.Fix{ + State: string(vulnerability.FixStateFixed), + Versions: []string{"3.0.0"}, + }, + }, + Artifact: models.Package{ + Version: "1.0.0", + }, + }, + expected: []cyclonedx.AffectedVersions{ + {Version: "1.0.0", Status: cyclonedx.VulnerabilityStatusAffected}, + {Range: "vers:generic/>=3.0.0", Status: cyclonedx.VulnerabilityStatusNotAffected}, + }, + }, + { + name: "no version and no fix omits the versions array", + match: models.Match{}, + expected: nil, + }, +} + +func TestNewVulnerability_AffectedVersions(t *testing.T) { + for _, test := range affectedVersionsTests { + t.Run(test.name, func(t *testing.T) { + actual, err := NewVulnerability(test.match) + require.NoError(t, err) + require.NotNil(t, actual.Affects) + require.Len(t, *actual.Affects, 1) + + ranges := (*actual.Affects)[0].Range + if test.expected == nil { + assert.Nil(t, ranges) + return + } + require.NotNil(t, ranges) + assert.Equal(t, test.expected, *ranges) + }) + } +} + func TestNewVulnerability_IncludesEPSSAndKEV(t *testing.T) { match := models.Match{ Vulnerability: models.Vulnerability{ diff -urN '--exclude=CVS' '--exclude=.cvsignore' '--exclude=.svn' '--exclude=.svnignore' old/grype-0.116.1/test/quality/test-db new/grype-0.117.0/test/quality/test-db --- old/grype-0.116.1/test/quality/test-db 2026-07-28 20:49:32.000000000 +0200 +++ new/grype-0.117.0/test/quality/test-db 2026-08-10 18:05:15.000000000 +0200 @@ -1 +1 @@ -https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.7_2026-07-01T00:54:38Z_1782911969.tar.zst +https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.9_2026-08-01T00:38:20Z_1785567576.tar.zst ++++++ grype.obsinfo ++++++ --- /var/tmp/diff_new_pack.tAdBEJ/_old 2026-08-11 17:17:23.674704188 +0200 +++ /var/tmp/diff_new_pack.tAdBEJ/_new 2026-08-11 17:17:23.682704527 +0200 @@ -1,5 +1,5 @@ name: grype -version: 0.116.1 -mtime: 1785264572 -commit: 30394f177175da63ae36b35cdd809c248eb4de7f +version: 0.117.0 +mtime: 1786377915 +commit: b5fa92bbcbef655497e3be840a2f718380e2cdd3 ++++++ vendor.tar.gz ++++++ /work/SRC/openSUSE:Factory/grype/vendor.tar.gz /work/SRC/openSUSE:Factory/.grype.new.17972/vendor.tar.gz differ: char 34, line 1
