The async decoder has a soft validate to differentiate different report types.
Grype recently changed the CLI information and for some reason, descriptor information is no longer included.
The decode function for grype checks for grype in the descriptor to actually identify it as a grype file.
This needs to be updated to check a different required field.