Another update: the socket.dev folks fixed this on their end almost immediately but this has now also been fixed upstream in `grype` too: https://github.com/anchore/grype/issues/1701

@chrisw_b