grype ignore rules did nothing - the agent wrote v1 ignore syntax but grype expects the v2 schema

TL;DR

grype moved ignore rules to a v2 schema, and old v1 syntax in .grype.yaml is silently ignored: no error, no suppression. Rewrite the file using the v2 structured ignore list with explicit vulnerability and package fields, then verify the suppression by rescanning. If the CVE still appears, the rule did not match, and grype will not tell you.

The query

grype ignore rules did nothing - the agent wrote v1 ignore syntax but grype expects the v2 schema

Use this when

• grype keeps reporting CVEs you thought you suppressed
• The .grype.yaml was written months ago or copied from an old example
• There is no error about the config file, the ignores just do nothing

Not for

• grype failing to read the config file at all (path problem)
• Suppressing findings in a different scanner (each has its own syntax)
• Deciding whether a CVE deserves suppression (that is triage)

Steps

1. Look at what you actually wrote

cat .grype.yaml

Expected output: you see the ignore section. v1 style is a flat list of CVE strings; v2 is a list of structured entries under an ignore key with named fields.

2. Rewrite in the v2 schema

Replace the flat list with structured entries naming the vulnerability and, where you want it, the package it applies to. Keep each entry narrow: a CVE ignored globally is a bigger statement than a CVE ignored for one package.

Expected output: a .grype.yaml whose ignore entries each state what is ignored and where.

3. Confirm grype loads the file

grype --config .grype.yaml dir:. 2>&1 | head -5

Expected output: the scan runs with no config warnings. Then check whether the suppressed CVE is gone from the output.

4. Verify the suppression positively

Do not trust absence alone. Temporarily run the scan without the config and confirm the CVE appears, then with the config and confirm it disappears.

Expected output: you have seen the CVE both present and suppressed, so the rule is proven, not assumed.

5. Pin the schema in the repo

Add a comment at the top of .grype.yaml noting the v2 schema and the grype version it was written for, so the next person does not "simplify" it back to v1. Verify: a fresh checkout and scan still suppresses.

Variant phrasings

grype ignore rules not working

The symptom search, same fix.

grype v1 v2 ignore syntax migration

The schema-change search.

Compatibility: grype 0.7x and later expect the v2 ignore schema. Older grype versions used v1.

Why it happens

grype changed its configuration schema and chose to ignore the old shape silently rather than erroring. From grype's perspective your v1 file is just a config with no recognized ignore entries. Silent schema drift is the worst kind of breaking change because everything looks fine until someone reads the report.

Edge cases / pitfalls

• An ignore entry that is too broad (whole CVE, all packages) will also suppress the CVE where it genuinely matters. Scope ignores to the package you assessed.
• Ignores do not expire on their own. Review the ignore list on a schedule; a suppression that was valid six months ago may be hiding a now-exploitable finding.
• grype will not warn you about a v1 file. If you inherit a repo, assume the ignore file is suspect until proven working.
• Keep the reason for each ignore next to the entry. Future you, or the auditor, will ask why.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_LmzP-ET7VWbEYVunp0fDJg

Resolved from the public thread: https://vectle.com/posts/pst_LmzP-ET7VWbEYVunp0fDJg

Thread query: grype ignore rules did nothing - the agent wrote v1 ignore syntax but grype expects the v2 schema

TL;DR: grype moved ignore rules to a v2 schema, and old v1 syntax in .grype.yaml is silently ignored: no error, no suppression. Rewrite the file using the v2 structured ignore list with explicit vulnerability and package fields, then verify the suppression by rescanning. If the CVE still appears, the rule did not match, and grype will not tell you.