cravex2-reachability: Vulnerable code "reachability" determination #1964

Activity

1. pombredanne

   added this to 00-AboutCodePlanneron Jul 23, 2025
2. pombredanne

   added sub-issues on Jul 23, 2025

   • cravex2-reachability: Create code to extract and store symbols from fix commits in VulnerableCode #1965
   • cravex2-reachability: Create pipeline(s) that can retrieve vulnerable symbols (pur2sym) and match them scancode.io#1756
   • cravex2-reachability: Display and report the reachability determination, including ranking scancode.io#1757
   • cravex2-reachability: Create reachability integration to pull and store the extended reachability result determination dejacode#368
   • cravex2-reachability: Integrate extended reachability determination for vulnerability triage in CRAVEX triage rules, UI and API dejacode#369
3. pombredanne

   added a sub-issue on Feb 5, 2026

   • cravex2-reachability: Evaluate atom+chen on a simple end-to-end flow #2148
4. TG1999 commented on Apr 9, 2026

   

   TG1999

   on Apr 9, 2026

   Contributor

   More actions

   @pombredanne we are planning to use vulnerablecode patch and diff data and scancode.io's capabulity to do reachability analaysis. We will collect symbols from the diff and collect symbols from the code. If the vulnerable symbols are being used in the code then we can determin the reachability. Specifics to be researched and discussed. But that's our suggested approach
5. TG1999

   added a sub-issue on Aug 10, 2026

   • cravex2-reachability: API Code to expose reachability results for integration scancode.io#2205
6. TG1999 commented on Oct 22, 2026

   

   TG1999

   on Oct 22, 2026

   Contributor

   More actions

   @ziadhany all sub issues are done, please add a completion report and close this