fix: update semver regular expression constraint to allow for 1.20rc1 cases no '-' #1434
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
Related to anchore/grype-db#145
Grype was seeing issues where semantic versions like
1.20rc1
would fall into the fuzzy matcher and not use the correctSatisfied
method. This PR updates the regex so that cases without the dash will be considered by the semantic version matcher while still preserving the openssl fuzzy matcher gate of checking cases like1.20.0a-rc0
Note - should these cases NOT use the semantic matcher there is a chance the fuzzy matcher is behaving incorrectly:
https://github.com/anchore/grype/blob/main/grype/version/fuzzy_constraint_test.go needs an extra look in a separate PR to account for cases that are not valid semver.
TOOO: