| Feed | URL | Notes |
|---|---|---|
| Images OSV v2 (current) | https://advisories.cgr.dev/chainguard/v2/osv/all.json | per-record: .../v2/osv/<CGA-ID>.json |
| Images OSV v3 (newest) | https://advisories.cgr.dev/chainguard/v3/osv/all.json | one file per advisory (same data as v2) |
| Images OSV v1 (legacy) | https://packages.cgr.dev/chainguard/osv/all.json | will be archived |
| SecDB (deprecated format) | https://packages.cgr.dev/chainguard/security.json | use OSV instead |
| Libraries OpenVEX | https://libraries.cgr.dev/openvex/v1/all.json |
all.json is an index; the vulnerability detail, including the fixed version events, lives in the per-advisory record files. The v2 feed groups all advisories for a given upstream alias into one OSV file, while v3 stores each advisory in its own file (the data is otherwise the same). The Images OSV index is refreshed hourly, so poll it at least once an hour and re-fetch records whose modified timestamp has changed. The Libraries OpenVEX feed has no publicly documented refresh cadence; it updates as CVE status changes. New integrations can use v2 or v3 on advisories.cgr.dev; the v1 feed, the SecDB format, and the legacy packages.cgr.dev domain are deprecated for new integrations.
Comments
0 comments
Article is closed for comments.