No Vulnerability DB Updates

Grype
1

Hey there,

it seems grype doesn’t have a new DB listed on: https://grype.anchore.io/databases/v6/latest.json
is everything alright with the pipeline as normally you built a new db every day

2

Over the weekend the v5 DB builds started to use too much memory and were being killed. This prevented both the v5 and v6 DBs from being published. In the past (before v6) this was a blocker since the listing file was a shared concern, however, with v6 this is no longer a concern.

We have a fix to unblock the v5 builds that was just released in grype; I’ll be republishing the DBs after they are incorporated into grype-db (expect a new DB within a couple hours). We’ll also followup fix once DBs are publishing again to decouple these pipelines further so v5 can’t block v6 from publishing.

3

@henrysachs you should see newly published DBs :tada:

1 Like
4

Yeah i just received an update. Thanks a lot!
But just for my understanding you wrote that v6 doesnt have this issue but they are still coupled because later in the text you state that you do a follow up fix am i right?

5

Hey :slight_smile: it appears as if the database is outdated again: 6.1.3_2025-11-27T00:25:44Z_1764228132

Is there any chance to trigger it again?

Kind regards, Florian

6

hi @floric thanks for the ping! We are working on this now.

1 Like
7

Hey @floric just wanted to let you know that the new database is published:

$ grype db update
$ grype db status | grep ^Built
Built:     2025-12-01T16:28:25Z
1 Like
8

thanks a lot :slight_smile:

Unfortunately it seems to have failed today again:

9

Hi @floric are you on a recent version of grype?

❯ grype db update
...
Vulnerability database updated to latest version!

❯ grype db status | grep ^Built
Built:     2025-12-04T08:18:20Z

That job failed at the last step, publishing the listing file, but the listing file is only used to distribute the v5 schema of the grype database, which is only relevant to very old grype versions at this point.

Does grype db update succeed for you?

10

you are absolutely right. I just checked and the db is updated.

I was just waiting for this update for a CVE and had a look on the job.

Please excuse my confusion and thanks for your fast response.

11

No problem! We will definitely take a look at why pushing the listing file failed, but people using recent versions of grype are luckily not affected. Thanks!

1 Like