Severity and filtering
How Vulnetix severities map to editor diagnostic levels, and the settings that hide low findings or demote them to hints.
AvailableIn the current release.
The mapping matches the CLI’s SARIF levels, so an Error in the editor is what vulnetix scan reports as error.
| Vulnetix severity | CLI label | SARIF level | Editor level | Problems panel |
|---|---|---|---|---|
critical |
Dangerous | error |
Error | Yes |
high |
Risky | error |
Error | Yes |
medium |
Quality | warning |
Warning | Yes |
low |
Style | note |
Information, or Hint | Yes, or no for Hint |
info and unscored |
Tentative | note |
Information, or Hint | Yes, or no for Hint |
A dependency finding takes the severity of its worst advisory.
Settings
| Setting | Values | Default | Effect |
|---|---|---|---|
vulnetix.diagnostics.minimumSeverity |
critical, high, medium, low, info |
low |
Findings below this level are not published. Applied to the editor level, see below. |
vulnetix.diagnostics.mapLowTo |
information, hint |
information |
hint renders low and info findings as a faint underline with no Problems panel entry |
vulnetix.diagnostics.showSuppressed |
boolean | false |
Publish suppressed findings as Hints instead of dropping them |
The floor is compared with the editor level a finding was given, not its original label, so it has three effective settings:
minimumSeverity |
Shown |
|---|---|
critical or high |
Errors only. A high finding is an Error like a critical one, so critical does not hide it. |
medium |
Errors and Warnings |
low (default) or info |
Everything, including info and unscored findings |
Changes apply at once: the server republishes every open file from its cache without rescanning.
Status bar counts
The status bar counts Errors and Warnings, with Information and Hint findings in the tooltip as notes. Findings filtered out by minimumSeverity, and suppressed findings that are not shown, are not counted.