mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
drupal's generator meta only exposes a bare major, so the extracted version is "10"/"9". versionAffected only matched when the affected entry was a component-prefix of the version, never the reverse, so a bare major never matched a dotted affected entry and every drupal cve was silently missed. match on dotted boundaries in either direction.