Anchore Open Source Weekly Report - Week 15, 2025

General
1

Anchore Open Source Weekly Report

This report covers the community activity in Anchore Open Source Projects from April 9, 2025 to April 11, 2025.

Executive Summary

The Anchore Open Source team had a productive week closing 23 issues and pull requests, with significant database improvements in Grype, including support for matching distributions without versions and importing databases directly from URLs. Community engagement remained strong with 8 community-originated issues and PRs closed, notably progress on the SARIF format support which enhances vulnerability reporting in CI/CD pipelines.

Weekly Metrics

Metric Community Staff Total
Issues Closed 6 2 8
Pull Requests Merged 2 13 15
Bug Fixes 5 5 10
Enhancements 3 7 10
Documentation Updates 0 0 0
Other 0 3 3

Key Achievements

1. SARIF Result Level Support

PR #2571 from community contributor Borja Domínguez adds the SARIF result level field to Grype’s output. This enhancement improves compliance with the SARIF specification, making it easier to integrate Grype’s results with other tools that consume SARIF format. The implementation maps Grype’s severity levels (Unknown, Negligible, Low, Medium, High, Critical) to appropriate SARIF levels (note, warning, error), providing better classification of vulnerabilities in CI/CD pipelines.

2. Grype Database Improvements

Several significant improvements were made to Grype’s database functionality:

  • PR #2591 added support for specifying distributions without versions, improving vulnerability matching capabilities
  • PR #2590 implemented recovery from panics within matchers, increasing resilience
  • PR #2589 fixed the severity field in db search vuln command

3. Fixed Daily Database Update Issue

Issue #2593 regarding a missing Grype DB update was promptly identified and resolved. Community member Philip Roche reported that the daily vulnerability database update was missing, and the team quickly investigated and fixed the issue with PR #556, ensuring timely vulnerability data updates.

4. Resolved False Positives and Negatives

Multiple long-standing false positive and false negative issues were resolved, improving scanning accuracy:

  • Issue #1693 regarding System.Data.SqlClient vulnerability detection was fixed
  • Issue #1559 addressing CVE-2023-4863 detection in Ubuntu images was resolved
  • Issue #1543 related to false positives in Guava package was fixed
  • Issue #1405 concerning false positives for the Ruby gem webrick was addressed

5. Consistency Improvement for File Operations

Community contributor Joe Ton submitted PR #2579 to replace os.ReadDir with afero.ReadDir for consistency across the codebase. This improvement aims to standardize the file system operations used throughout the Anchore ecosystem, with the contributor offering to extend this change to other repositories where needed.

Note: This report is based on issues and pull requests closed during April 9-11, 2025. Additional work is ongoing in open issues and pull requests not covered in this report.

Want to get involved? Visit anchore.com/opensource to learn how you can contribute to Anchore’s open source projects!