forkless/strix
1
0
Fork 0
mirror of https://github.com/usestrix/strix.git synced 2026-08-23 19:32:37 +02:00
Code Issues Packages Projects Releases Wiki Activity

feat(report): keep dependency findings from distinct manifests separate in dedupe

Browse Source
This commit is contained in:
Ahmed Allam
2026-08-06 02:20:46 +03:00
committed by Ahmed Allam
parent 72cb15a20a
commit b69af37cb2
3 changed files with 90 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
strix/skills/custom/dependency_cve_scanning.md
+4 -2
View File
@@ -77,8 +77,10 @@ For each entry under `.Results[].Vulnerabilities[]` in `trivy-sca.json`, collect
- `CVSS` — the published advisory base score
- `PrimaryURL` / references — to verify the advisory
Deduplicate by `(CVE, PkgName, InstalledVersion)`. File one
`create_dependency_report` per CVE — do not batch multiple CVEs into one report.
Deduplicate by `(CVE, PkgName, Target)` — the same CVE/package observed in two
different manifests (e.g. two workspaces of a monorepo) is two findings, one
per manifest. File one `create_dependency_report` per CVE — do not batch
multiple CVEs into one report.
### Attribute transitive CVEs to the direct dependency