
2/16/2022 · Mark Art
What this post added
Launched a community-driven advisory database for dependencies, a time-delayed clone of the internal GitLab Advisory Database. This database is open-source and allows community contributions. It details how to contribute advisories, use CWE and CVSS, and integrate with tools like Trivy. The `community-sync` flag was introduced for faster synchronization of community contributions. Certain critical vulnerabilities, like log4Shell, are prioritized for immediate release to the open-source version.