microsoft / microsoft/security-devops-azdevops
Trivy version is very out of date
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
This tool uses a very old version of trivy (v0.19.2), which causes issues because apps using package-lock.json lockfileVersion: 3 , are not supported and vulnerabilities aren't found.
When is this going to be updated? Having such a old version makes the tool hard to justify to use.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue identifies Trivy v0.19.2 and its failure to support package-lock.json lockfileVersion 3. Start by locating where the Trivy version is declared and how the extension runs its vulnerability scan. Done means the updated tool handles lockfileVersion 3 applications and finds their vulnerabilities.
Written by the indexing model from the issue text.
Assessment
- Domain
- devops, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 32/100