Fix CVE-less SCA violations dropped under a Watch - #835
Draft
Jordanh1996 wants to merge 1 commit into
Draft
Conversation
convertToCveViolations only converted entries in violation.Cves, and Xray returns a CveDetails entry with an empty cve id (CVSS/CWE still populated) for native XRAY-XXXXX vulnerabilities that have no assigned CVE. Every such entry hit the empty-id guard and the whole violation was dropped, regardless of severity or policy match. Fall back to violation.IssueId when no Cves entry has a usable id, mirroring the same fallback already used when building the SBOM (ExtractIssuesInfoForCdx). Verified live against a real local Xray: a real Watch + Security policy bound to a real indexed NuGet artifact with a real High-severity CVE-less vulnerability (XRAY-1034038, OpenTelemetry.Resources.Host). Before this fix the violation was silently dropped; after, it is returned with full severity/policy/component/fix-version data. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
attiasas
reviewed
Aug 6, 2026
attiasas
left a comment
attiasas
left a comment
Collaborator
There was a problem hiding this comment.
This will have the CLI shows violation that there are no vulnerabilities related to them that returned from the scan
i.e if you run the same scan without watches it will not show the XRAY-... vulnerabilities
until Catalog will also return those
FYI
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Any Xray SCA "Security" violation for a vulnerability that has no assigned CVE (only a native
XRAY-XXXXXissue ID) is silently dropped when a Watch is used — with Frogbot V3 /jf audit --static-sca, the vulnerability never shows up in output, regardless of severity or policy match.convertToCveViolationsonly builds output for entries inviolation.Cves. Xray still returns aCveDetailsentry for these vulnerabilities (CVSS/CWE populated), but with an emptycvefield — which hits thecve.Id == ""guard and skips the violation entirely, with no fallback to the violation's ownIssueId.This is not a regression — the CVE-only assumption has been present since this converter was introduced (#543, 2025-11-23); CVE-less SCA vulnerabilities have never worked under a Watch.
Fix
Fall back to
violation.IssueIdwhen noCvesentry has a usable ID, mirroring the same fallback already used when building the SBOM (ExtractIssuesInfoForCdx) — so the pattern is already precedented elsewhere in this codebase, just not applied here.Verification
Verified live against a real local Xray (not a unit test): a real Watch + Security policy (min severity Low) bound to a real indexed NuGet artifact carrying a real High-severity CVE-less vulnerability (
XRAY-1034038,OpenTelemetry.Resources.Host).Before this fix, calling the unmodified
GenerateViolationsagainst the real persisted violation:After the fix, same real Xray, same real violation:
with correct severity (
High), matched policy/watch, resolved impacted component, and fix version.🤖 Generated with Claude Code