Where Does Grype Store Its Vulnerability Database?
Grype caches its vulnerability database in a db folder under its config directory. Stale caches silently miss new CVEs.
Last updated
Grype downloads a built vulnerability database on first run and refreshes it on a schedule, storing each build in a db folder under its user config directory. Scans read that local copy, which means results are only as fresh as the last update. CI runners with cold caches download the whole database every time.
The practical failure is staleness, not absence. A month old cache reports clean on freshly disclosed CVEs. Pin a regular update in pipelines and check the database age when a scan surprises you. The cache directory also accepts a custom path flag for shared runners with small disks.
Where Grype stores this, by platform
%USERPROFILE%\.grype\db
Versioned vulnerability database builds. Delete to force a fresh download. Check build age when scans miss known CVEs. Custom path flag exists for shared runners.
~/.grype/db
Same db folder layout as other platforms. Scheduled updates keep it fresh; cold CI caches pay the full download each run.
~/.grype/db
Identical to macOS. Point shared or ephemeral runners at a persistent path to skip repeated full downloads.
Frequently asked questions
Grype reports database errors. How do I reset it?
Delete the db folder and run a fresh database update. Corrupted downloads wedge the updater in ways retries do not fix. The next scan redownloads the current build automatically.
Can I ignore specific vulnerabilities?
Yes with the ignore rules file in the same directory. Document each exception with an expiry comment, since permanent ignores accumulate into blind spots nobody revisits.
Notice an outdated path? Let us know.