Rule violation on vulnerability is not getting triggered

[saaskesaakura345]

Hi Team,

I am facing issues with raising rule violations for vulnerable components in my dependencies.
I am using the existing evaluator.kts file from this repository and it triggers rule violations for license issues but not for vulnerabilities.

As seen below vulnerabilities are identified, but not brought out in the "Rule Violations" tab.

The action file used is : https://github.com/oss-review-toolkit/ort-ci-github-action

Can someone guide me to understand what i am missing or any reference to the solution.

[sschuberth]

As @tsteenbe pointed out, this is probably related to the example rule to only trigger for the CVSS2 scoring system.

[tsteenbe]

See for example https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-67hx-6x53-jw92/GHSA-67hx-6x53-jw92.json#L13 propose we update the rule to trigger for CVSSv3 or make the rule work in a scoring system agnostic way.

[sschuberth]

update the rule to trigger for CVSSv2

That should say "CVSSv3", I believe.