{
  "schema_version": 1,
  "_meta": {
    "description": "Lab-side grype scan of published lane digests (non-gating, ADR 0002)",
    "generated_at": "2026-08-31T04:22:15Z",
    "status": "live"
  },
  "rows": [
    {
      "id": "bluefin-stable",
      "lane": "bluefin-stable",
      "image_ref": "ghcr.io/projectbluefin/bluefin:stable",
      "digest": "sha256:383f523982a84cd23b40a8d252b50d6c4a65b013b03bfb70e74e0708fd8e082f",
      "scanner": "grype",
      "scanner_version": "0.118.0",
      "severity_counts": {
        "critical": 18,
        "high": 167,
        "low": 8,
        "medium": 131,
        "negligible": 0,
        "unknown": 7
      },
      "fixable": 231,
      "total": 331,
      "top_cves": [
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "5.10.261",
          "id": "CVE-2026-64268",
          "installed": "7.1.3-201.fc44.x86_64",
          "package": "linux-kernel",
          "severity": "Critical"
        }
      ],
      "source_url": "http://192.168.1.102:32746/workflows/argo/nightly-cve-scan-1788147000",
      "collected_at": "2026-08-31T04:22:15Z",
      "derivation": "grype scan of digest in ephemeral workflow pod",
      "state": "available",
      "state_reason": null
    },
    {
      "id": "bluefin-testing",
      "lane": "bluefin-testing",
      "image_ref": "ghcr.io/projectbluefin/bluefin:testing",
      "digest": "sha256:bf615b200faefc44b50232ecc8a3eb21490e88dd9316b528b27f54472122611d",
      "scanner": "grype",
      "scanner_version": "0.118.0",
      "severity_counts": {
        "critical": 12,
        "high": 135,
        "low": 9,
        "medium": 107,
        "negligible": 0,
        "unknown": 7
      },
      "fixable": 170,
      "total": 270,
      "top_cves": [
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "0.52.0",
          "id": "CVE-2026-39832",
          "installed": "v0.43.0",
          "package": "golang.org/x/crypto",
          "severity": "Critical"
        }
      ],
      "source_url": "http://192.168.1.102:32746/workflows/argo/nightly-cve-scan-1788147000",
      "collected_at": "2026-08-31T04:22:15Z",
      "derivation": "grype scan of digest in ephemeral workflow pod",
      "state": "available",
      "state_reason": null
    },
    {
      "id": "bluefin-lts-stable",
      "lane": "bluefin-lts-stable",
      "image_ref": "ghcr.io/projectbluefin/bluefin-lts:stable",
      "digest": "sha256:c78380f20b7d8d5cd3ba4a4abbecbce4f35a2a067b115b5a8d73078df7f7162f",
      "scanner": "grype",
      "scanner_version": "0.118.0",
      "severity_counts": {
        "critical": 5,
        "high": 2423,
        "low": 10270,
        "medium": 29237,
        "negligible": 32,
        "unknown": 171
      },
      "fixable": 466,
      "total": 42138,
      "top_cves": [
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.78.0",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.78.0",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.78.0",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.24.13",
          "id": "CVE-2025-68121",
          "installed": "go1.23.1",
          "package": "stdlib",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.23.8",
          "id": "CVE-2025-22871",
          "installed": "go1.23.1",
          "package": "stdlib",
          "severity": "Critical"
        }
      ],
      "source_url": "http://192.168.1.102:32746/workflows/argo/nightly-cve-scan-1788147000",
      "collected_at": "2026-08-31T04:22:15Z",
      "derivation": "grype scan of digest in ephemeral workflow pod",
      "state": "available",
      "state_reason": null
    },
    {
      "id": "bluefin-lts-testing",
      "lane": "bluefin-lts-testing",
      "image_ref": "ghcr.io/projectbluefin/bluefin-lts:testing",
      "digest": "sha256:c78380f20b7d8d5cd3ba4a4abbecbce4f35a2a067b115b5a8d73078df7f7162f",
      "scanner": "grype",
      "scanner_version": "0.118.0",
      "severity_counts": {
        "critical": 5,
        "high": 2423,
        "low": 10270,
        "medium": 29237,
        "negligible": 32,
        "unknown": 171
      },
      "fixable": 466,
      "total": 42138,
      "top_cves": [
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.78.0",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.78.0",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.78.0",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.24.13",
          "id": "CVE-2025-68121",
          "installed": "go1.23.1",
          "package": "stdlib",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.23.8",
          "id": "CVE-2025-22871",
          "installed": "go1.23.1",
          "package": "stdlib",
          "severity": "Critical"
        }
      ],
      "source_url": "http://192.168.1.102:32746/workflows/argo/nightly-cve-scan-1788147000",
      "collected_at": "2026-08-31T04:22:15Z",
      "derivation": "grype scan of digest in ephemeral workflow pod",
      "state": "available",
      "state_reason": null
    },
    {
      "id": "dakota-testing",
      "lane": "dakota-testing",
      "image_ref": "ghcr.io/projectbluefin/dakota:testing",
      "digest": "sha256:685afce4b88e89396ab868ef866fd496f5cb5cf985f21b371b06bebf2b53bb2f",
      "scanner": "grype",
      "scanner_version": "0.118.0",
      "severity_counts": {
        "critical": 21,
        "high": 168,
        "low": 8,
        "medium": 123,
        "negligible": 0,
        "unknown": 6
      },
      "fixable": 219,
      "total": 326,
      "top_cves": [
        {
          "fixed_in": "0.52.0",
          "id": "CVE-2026-42508",
          "installed": "v0.47.0",
          "package": "golang.org/x/crypto",
          "severity": "Critical"
        },
        {
          "fixed_in": "0.52.0",
          "id": "CVE-2026-42508",
          "installed": "v0.47.0",
          "package": "golang.org/x/crypto",
          "severity": "Critical"
        },
        {
          "fixed_in": "0.52.0",
          "id": "CVE-2026-42508",
          "installed": "v0.51.0",
          "package": "golang.org/x/crypto",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        },
        {
          "fixed_in": "1.79.3",
          "id": "CVE-2026-33186",
          "installed": "v1.72.2",
          "package": "google.golang.org/grpc",
          "severity": "Critical"
        }
      ],
      "source_url": "http://192.168.1.102:32746/workflows/argo/nightly-cve-scan-1788147000",
      "collected_at": "2026-08-31T04:22:15Z",
      "derivation": "grype scan of digest in ephemeral workflow pod",
      "state": "available",
      "state_reason": null
    }
  ]
}