fix: main mod pseudo version default off (#1894)

Signed-off-by: Dan Luhring <[email protected]>
anchore · May 30, 2024 · 316c0e9 · 316c0e9
1 parent 4686568
commit 316c0e9
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 2 deletions.
diff --git a/README.md b/README.md
@@ -855,7 +855,8 @@ match:
     using-cpes: false
     # even if CPE matching is disabled, make an exception when scanning for "stdlib".
     always-use-cpe-for-stdlib: true
-    allow-main-module-pseudo-version-comparison: true
+    # allow main module pseudo versions, which may have only been "guessed at" by Syft, to be used in vulnerability matching
+    allow-main-module-pseudo-version-comparison: false
   stock:
     using-cpes: true
 ```

diff --git a/cmd/grype/cli/options/match.go b/cmd/grype/cli/options/match.go
@@ -34,7 +34,7 @@ func defaultGolangConfig() golangConfig {
 			UseCPEs: false,
 		},
 		AlwaysUseCPEForStdlib:                  true,
-		AllowMainModulePseudoVersionComparison: true,
+		AllowMainModulePseudoVersionComparison: false,
 	}
 }