internal/vulncheck: exclude dev go versions from ancient check

When checking if a go version is ancient, exclude invalid go versions such as "devel 12343...." This are considered earlier than go1.18. Change-Id: Ifbd7bd2834284b8e7fd109ec34fa4a2b9c297e24 Reviewed-on: https://go-review.googlesource.com/c/vuln/+/598716 LUCI-TryBot-Result: Go LUCI <[email protected]> Auto-Submit: Zvonimir Pavlinovic <[email protected]> Reviewed-by: Maceo Thompson <[email protected]>
golang · Jul 17, 2024 · 0a7cb13 · 0a7cb13
1 parent 4ea4418
commit 0a7cb13
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/internal/vulncheck/binary.go b/internal/vulncheck/binary.go
@@ -67,7 +67,7 @@ func binary(ctx context.Context, handler govulncheck.Handler, bin *Bin, cfg *gov
 
 	// Emit warning message for ancient Go binaries, defined as binaries
 	// built with Go version without support for debug.BuildInfo (< go1.18).
-	if semver.Less(bin.GoVersion, "go1.18") {
+	if semver.Valid(bin.GoVersion) && semver.Less(bin.GoVersion, "go1.18") {
 		p := &govulncheck.Progress{Message: fmt.Sprintf("warning: binary built with Go version %s, only standard library vulnerabilities will be checked", bin.GoVersion)}
 		if err := handler.Progress(p); err != nil {
 			return nil, err