grype adds a Hex matcher for Erlang and Elixir packages

Introduced 2026-01-29 · score 0.91

HOW TO USE IT

When scanning an image with Erlang or Elixir packages, run Grype to use its Hex matcher for GHSA data. To enable CPE matching for this ecosystem, set `match.hex.using-cpes` to `true`; it is `false` by default.

WHY THIS HELPS

Scan an image containing Erlang or Elixir packages for vulnerabilities.

BEFORE THIS CHANGE

CPE matching was enabled by default for this ecosystem.

REQUIREMENTS AND LIMITATIONS

• Version: v0.107.0
• <image> (required): Image reference to scan.
• match.hex.using-cpes: Boolean that enables CPE matching for the Hex matcher; defaults to `false`.
• Prerequisite: Grype must be installed; the README documents installation using `curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin`.
• CPE matching for this ecosystem is turned off by default.

FIRST-PARTY EVIDENCE

• https://github.com/anchore/grype/releases/tag/v0.107.0
• https://github.com/anchore/grype/pull/3194
• https://github.com/anchore/grype/blob/v0.107.0/README.md
• https://github.com/anchore/grype/blob/v0.107.0/cmd/grype/cli/options/match.go

Check the installed version and the source before using it. Entry JSON

Report a problem with this card