Grype: the fixed version is not what is installed

The installed version is the one that matched

The package and version on the row are what the scan, or the SBOM it read, contained. That is the version the advisory was compared with. It is the version you can cite as present for that scan.

A different image, or a rebuild you have not scanned, is not this row. Do not move the version onto a name that only sounds similar.

The fix version is the advisory’s statement

When the row includes a fixed version, that string is what the advisory data said would address the match. It is not a version your build has produced. Seeing it in the report does not mean the package was upgraded.

If the row has no fixed version, write “no fix version on this row.” Do not borrow one from a web page you did not record.

What to file

File the package name, the installed version, the advisory id, and the fix version if it is present. File the scan or SBOM name those fields came from. A sentence that says “patched” needs a later row whose installed version is the fix, or another record you cite.

Worked case: 1.2.4 written as if it were installed

A lab SBOM scan names package lab-widget, installed 1.2.3, advisory LAB-2026-0099, fix version 1.2.4. A draft says the image now runs 1.2.4 because the report mentioned the fix.

The note says 1.2.3 is the version in that SBOM and 1.2.4 is the advisory’s fix version. The image is not described as upgraded. A rebuild would be a new scan with its own installed version.

sbom: lab-widget.cdx.json
package: lab-widget
installed: 1.2.3
advisory: LAB-2026-0099
fix version: 1.2.4
write: 1.2.3 present, 1.2.4 is the advisory’s fix
not: the image runs 1.2.4