This app has uses a vulnerable version of gunicorn (Pip-installed dependency), and pip.

pack build pip-sample --buildpack paketo-buildpacks/python --sbom-output-dir sbom-content

docker scan pip-sample

Locates OS-based vulnerabilities, but no Pip-related vulnerabilities.

grype pip-sample

Locates OS-level vulnerabilities AND high-severity gunicorn vulnerability

grype sbom:sbom-content/build/paketo-buildpacks_pip/pip/sbom.syft.json
grype sbom:sbom-content/launch/paketo-buildpacks_pip-install/packages/sbom.syft.json

Locates high-severity gunicorn vulnerability AND high-severity pip vulnerability