Skip to content

Conversation

@manuel-sommer
Copy link
Contributor

@manuel-sommer manuel-sommer commented Jan 21, 2026

Copy link

@DeD1rk DeD1rk left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not too familiar with defectdojo and trivy internals but this seems rigth to me :)

@valentijnscholten
Copy link
Member

This affects deduplication, but there's not much we can do about it.

  • Future imports/findings will have better deduplication
  • Existing findings might not be matched in future imports because the currently existing finding do not have the extra vulnerability_id / file_path values.
    Put a not in the upgrade notes to make users aware?

@valentijnscholten valentijnscholten added this to the 2.54.3 milestone Jan 21, 2026
@mtesauro
Copy link
Contributor

This affects deduplication, but there's not much we can do about it.

* Future imports/findings will have _better_ deduplication

* Existing findings might not be matched in future imports because the currently existing finding do not have the extra vulnerability_id / file_path values.
  Put a not in the upgrade notes to make users aware?

Yeah, that's probably the best we can do. I do agree that this is better for future imports / dedups.

Copy link
Contributor

@mtesauro mtesauro left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Approved

@github-actions github-actions bot added the docs label Jan 22, 2026
@manuel-sommer
Copy link
Contributor Author

Done, added release notes @valentijnscholten

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Trivy parser doesn't parse vulnerability_ids and file_path for misconfigurations

5 participants