Grype links component inventories with known vulnerability information. A match still requires an assessment of whether the application is affected.
Evaluation approach
Analyze component data from an SBOM or another supported target. Matching quality depends on accurate package identity and versions.
Application example
Attach the security report for your mobile build image to the release record, keeping application-package analysis separate.
Limits and considerations
A listed component does not prove that its vulnerable function can be used in the application.
Interpreting an SBOM match
Findings may depend on component identity and version matching. Incorrect or incomplete inventories produce unreliable results. Record the package source and vulnerability database date.
Document technical reasons for an unaffected decision rather than suppressing all warnings broadly. Reassess when a release or database update changes the evidence. RASP does not automatically neutralize dependency vulnerabilities.
Checks and decisions
- Verify package identity
- Review CVE context
- Test the fixed version
Prioritize Grype results through reachability and business impact.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.