{
  "slug": "grype-adds-a-hex-matcher-for-erlang-and-elixir-packages-b0c8b5cd02cc",
  "title": "grype adds a Hex matcher for Erlang and Elixir packages",
  "tools": [
    "grype"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-01-29T22:24:48.000Z",
  "announced_at": "2026-01-29T22:24:48.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When scanning an image with Erlang or Elixir packages, run Grype to use its Hex matcher for GHSA data. To enable CPE matching for this ecosystem, set `match.hex.using-cpes` to `true`; it is `false` by default.",
    "examples": [
      "grype <image>",
      "match:\n  hex:\n    using-cpes: true"
    ],
    "gotchas": [
      "Version: v0.107.0",
      "<image> (required): Image reference to scan.",
      "match.hex.using-cpes: Boolean that enables CPE matching for the Hex matcher; defaults to `false`.",
      "Prerequisite: Grype must be installed; the README documents installation using `curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin`.",
      "CPE matching for this ecosystem is turned off by default."
    ]
  },
  "why_it_matters": "Scan an image containing Erlang or Elixir packages for vulnerabilities.",
  "before": "CPE matching was enabled by default for this ecosystem.",
  "sources": [
    "https://github.com/anchore/grype/releases/tag/v0.107.0",
    "https://github.com/anchore/grype/pull/3194",
    "https://github.com/anchore/grype/blob/v0.107.0/README.md",
    "https://github.com/anchore/grype/blob/v0.107.0/cmd/grype/cli/options/match.go"
  ],
  "rank": 0.91028,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave1-20261014",
    "verdict_id": "wave1-20261014:wave1-20261014-6e0a08f429baf1d2-1:gate",
    "evidence_hash": "4de2ab5540efd8bb570d22e87e457afe6b11207aa59994da8f266da24f868384"
  },
  "review": {
    "draft_hash": "cbf393127c3b119478950a0f0321995461af38ebc259f727754dc0bd9e1ea79b",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "wave1-20261014:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.91 >= 0.9; 2 needed) and Jev gave 0.70 (>= 0.6 needed)."
  }
}