What happened: Using grype as usual with a php (composer) project: grype dir:. produces an empty list of vulnerabilities.
What you expected to happen: A list of vulnerabilities.
How to reproduce it (as minimally and precisely as possible): I tried with this project, which is a composer project, and grype found no vulnerabilities. Even checking out tags of older versions.
Not finding vulnerabilities in php (composer) #797
What happened: Using grype as usual with a php (composer) project:
grype dir:.
produces an empty list of vulnerabilities.What you expected to happen: A list of vulnerabilities.
How to reproduce it (as minimally and precisely as possible): I tried with this project, which is a composer project, and grype found no vulnerabilities. Even checking out tags of older versions.
Environment:
grype version
:cat /etc/os-release
or similar):