anchore / grype

A vulnerability scanner for container images and filesystems
Apache License 2.0
8.7k stars 569 forks source link

Skip matching on packages with missing version info #2182

Closed wagoodman closed 2 weeks ago

wagoodman commented 2 weeks ago

As discussed on discourse, grype should not be searching for packages that are missing version information as these will always yield incorrect results.

Additionally while working on this it was found that searched CPE versions were not always being raised accurately (when being overridden) -- this PR additionally fixes this behavior.