grype library vulnerability matching supports context cancellation
Introduced 2026-02-03 · score 0.90
HOW TO USE IT
When integrating Grype’s Go library and matching may need to stop early, call `FindMatchesContext` with a `context.Context`; it checks cancellation before each matcher call and returns on a context error.
ctx := context.Background() // replace with the workflow's cancellable context
remainingMatches, ignoredMatches, err := vulnMatcher.FindMatchesContext(ctx, pkgs, pkgContext)WHY THIS HELPS
Stop long-running vulnerability matching early when integrating Grype into a Go coding workflow.
BEFORE THIS CHANGE
Call `FindMatches(pkgs, pkgContext)`; it uses `context.Background()` and does not support context cancellation.
REQUIREMENTS AND LIMITATIONS
- Version: v0.107.1
- ctx (required): `context.Context`; checked for errors before each matcher call for a package. A non-nil error returns immediately.
- pkgs (required): Packages to match.
- pkgContext (required): Package context used for matching and subsequent VEX matching.
FIRST-PARTY EVIDENCE
- https://github.com/anchore/grype/releases/tag/v0.107.1
- https://github.com/anchore/grype/pull/3200
- https://raw.githubusercontent.com/anchore/grype/v0.107.1/grype/vulnerability_matcher.go
Check the installed version and the source before using it. Entry JSON