grype db search does not properly parse golang PURL
Author: gnyahayCreated Jun 16, 2026Updated Aug 30, 2026
Labelsbug
The following:
grype db search -vvvv --pkg "pkg:golang/github.com/gin-gonic/[email protected]"
[0000] WARN ignoring version and qualifiers for package URL "pkg:golang/github.com/gin-gonic/[email protected]"
[0000] INFO grype version: 0.114.0
[0000] DEBUG config:
log:
quiet: false
level: trace
file: ""
dev:
profile: ""
db:
cache-dir: /home/greg-nyahay/.cache/grype/db
update-url: https://grype.anchore.io/databases
ca-cert: ""
auto-update: true
validate-by-hash-on-start: true
validate-age: true
max-allowed-built-age: 120h0m0s
require-update-check: true
update-available-timeout: 30s
update-download-timeout: 5m0s
max-update-check-frequency: 2h0m0s
exp: {}
dev:
db:
debug: false
[0000] TRACE DB rehydration not needed clientHydrationVersion=v6.1.7 currentClientVersion=v6.1.7 currentDBVersion=v6.1.7
[0000] DEBUG searching for affected packages os=any pkg=package(name=gin, ecosystem=golang) vuln=any
[0000] TRACE fetched package record distro=any duration=1.168916ms pkg=package(name=gin, ecosystem=go-module) records=0 vulns=any
[0000] DEBUG searching for affected packages cpe=package(cpe=cpe:2.3:a:*:gin:*:*:*:*:*:golang:*:*) vuln=any
[0000] TRACE fetched CPE record cpe=cpe:2.3:a:*:gin:*:*:*:*:*:golang:*:* duration=477.313µs records=0
[0000] TRACE worker stopped component=eventloop
[0000] TRACE signal exit component=eventloop
No results foundSeems to be finding a package name of gin whereas it should be github.com/gin-gonic/gin
I have the latest Syft (in this moment):
syft version
Application: syft
Version: 1.43.0
BuildDate: 2026-04-22T15:55:12Z
GitCommit: 390cf6cce0463d44c20270dea637bcb3833eee02
GitDescription: v1.43.0
Platform: linux/amd64
GoVersion: go1.26.2
Compiler: gc
SchemaVersion: 16.1.3K Thx Bye!
Source: anchore/grype