FIPS Package Dependency Management
Community-driven advisory database for dependencies launched

Community-driven advisory database for dependencies launched

2/16/2022 · Mark Art

What this post added

Launched a community-driven advisory database for dependencies, a time-delayed clone of the internal GitLab Advisory Database. This database is open-source and allows community contributions. It details how to contribute advisories, use CWE and CVSS, and integrate with tools like Trivy. The `community-sync` flag was introduced for faster synchronization of community contributions. Certain critical vulnerabilities, like log4Shell, are prioritized for immediate release to the open-source version.

Read the original post ↗