anchore / syft

CLI tool and library for generating a Software Bill of Materials from container images and filesystems
Apache License 2.0
5.98k stars 551 forks source link

fix: stop panicking on "devel" version go stdlib #3043

Closed willmurphyscode closed 1 month ago

willmurphyscode commented 1 month ago

Previously, if a Go binary was cataloged with build info indicating that the go compiler version used was "deve", syft would panic on a nil pointer dereference. Instead, skip creating a Go stdlib reference and relationship for such a package.

Fixes #3037