Prisma Cloud Compute function scan on Azure does not detect change in package.json dependency

[JensWegar]

Prisma Cloud newbie here. I'm trying to figure out why the vulnerability scan for functions in Prisma Cloud does not detect changes to a CVE that was fixed in a dependency of an Azure function app in our environment. It does detect the Azure function in question, so the connection to Azure seems to be in order. The function is written in javascript, so I assume prisma cloud should be scanning the package.json/package-lock.json files to determine dependencies. But the only way I get Prisma Cloud to detect a change to the status of the CVE is by removing and re-adding the Azure scope of the function scan.

steps I've tried:

1. Add our Azure account to the function scan scope under Prisma cloud->Compute->Defend->Vulnerabilities->Functions. Prisma cloud starts a scan, finds the function and detects a CVE in one of the dependencies.
2. I updated the dependency to a version where CVE was fixed and pushed the update to Azure (release happens through a pipeline, so this part is not changing between tests)
3. Once new function code has been released, I click scan under Prisma Cloud->Compute->Monitor->Vulnerabilities. Prisma Cloud does the scan but once it's finished (refresh button has a red dot indicating new data), the CVE is still there. If I check the Package info for the function, it's still listing the old version of the dependency.
4. I remove the Azure account from the function scan scope, click save, then add it back again and click save again. Prisma cloud starts another scan.
5. I then go back to Monitor->Vulnerabilities, and now the function app shows green, the CVE has been fixed, and if I check the package info the correct version of the dependency is listed.

I can repeat this with the same result always. If I make a code change so that the CVE is either introduced or removed, the only way I can get prisma cloud to detect it is if I remove the Azure account scope and add it back again. I make no changes in Azure itself (other than re-publishing the code). I've also tried waiting the 24h default scan interval according to docs, but the result is the same.

So what am I missing? Something fundamental about how vulnerability scanning works? Currently I have the sense that there is some bug in the way Prisma Cloud determines that a change has happened in an Azure function, or there is some caching going on which isn't cleared properly when a new scan starts, or there is something about the logic of scans which I don't understand...

ps. we're using an pay-as-you-go license bought through AWS for our testing atm., not sure if that might affect something...

[AKing9]

Greetings JensWegar,

I hope that this note finds you well! I know that it has been a while since you had posted this question but I wanted to see if you still potentially needed any help. Thank you for your time and I hope that you have a good remainder of your day.

Kind Regards,

J. Avery King