google / google/osv.dev

Import container/helm vulnerabilities from ArtifactHub.io

Open
#2,666 1 comment 0 reactions 0 assignees View on GitHub
backlog datasource enhancement
Dominant language
Go
Stars
2.9k
Forks
369
Avg merge
1d 17h
Merged PRs (30d)
149

Description

**Is your feature request related to a problem? Please describe.**
Currently, osv.dev doesn't have much information about container image vulnerabilities.

At the same time Artifacthub.io runs trivy to scan container images[^1], would be great to be able to see vulnerability information collected by Artifacthub in osv.dev.

[^1]: https://artifacthub.io/docs/topics/security_report/

**Describe the solution you'd like**
Integrate Artifacthub as datasource for vulnerabilities using Security Report API[^2]

[^2]: https://artifacthub.io/docs/api/#/Packages/getPackageSecurityReport

**Describe alternatives you've considered**
Fetching vulnerability information directly form ArtifactHub API[^2]

**Additional context**
- https://github.com/artifacthub/hub/issues/4052

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.