Why your scanner still shows a CVE Chainguard has fixed

Work through these causes in order.

1. Scanning an older image: re-pull the current tag and scan again.
2. Stale scanner database: update the feed (for example, grype db update).
3. Advisory ingestion lag: feeds update several times a day, so a very recent fix may not appear yet.
4. Package versus subpackage: a parent package can show "not fixed" while the affected subpackage is fixed. Check the per-package advisory at images.chainguard.dev/security.
5. Your scanner does not consume Chainguard VEX or false-positive data: see "Understanding vulnerability scanner discrepancies".

For authoritative status, check the advisory page, or the OSV feed (index at https://advisories.cgr.dev/chainguard/v2/osv/all.json). The per-advisory record files (.../v2/osv/<CGA-ID>.json) carry the fixed version in affected[].ranges[].events[].fixed, so you can confirm when and where a CVE was remediated.