version: add golang 1.24 version fixup

go1.24.0 stamps versions with `+incompatible+dirty` which is an
invalid SemVer version. Add a fixup to correct this to SemVer
compliant buildinfo version of `+incompatible.dirty` with a test case.

Related:
- golang/go#71971
- anchore#2482

Author: xnox

grype/version/golang_version.go

@@ -48,9 +48,21 @@ func newGolangVersion(v string) (*golangVersion, error) {
 	if v == "(devel)" {
 		return nil, ErrUnsupportedVersion
 	}
+
+	// Invalid Semver fix ups
+
 	// go stdlib is reported by syft as a go package with version like "go1.24.1"
 	// other versions have "v" as a prefix, which the semver lib handles automatically
-	semver, err := hashiVer.NewSemver(strings.TrimPrefix(v, "go"))
+	fixedUp := strings.TrimPrefix(v, "go")
+
+	// go1.24 creates non-dot separated build metadata fields, e.g. +incompatible+dirty
+	// Fix up as per semver spec
+	before, after, found := strings.Cut(fixedUp, "+")
+	if found {
+		fixedUp = before + "+" + strings.ReplaceAll(after, "+", ".")
+	}
+
+	semver, err := hashiVer.NewSemver(fixedUp)
 	if err != nil {
 		return nil, err
 	}

grype/version/golang_version_test.go

@@ -40,6 +40,14 @@ func TestNewGolangVersion(t *testing.T) {
 				semVer: hashiVer.Must(hashiVer.NewSemver("v24.0.7+incompatible")),
 			},
 		},
+		{
+			name:  "semver with +incompatible+dirty",
+			input: "v24.0.7+incompatible+dirty",
+			expected: golangVersion{
+				raw:    "v24.0.7+incompatible+dirty",
+				semVer: hashiVer.Must(hashiVer.NewSemver("v24.0.7+incompatible.dirty")),
+			},
+		},
 		{
 			name:  "standard library",
 			input: "go1.21.4",
@@ -71,6 +79,7 @@ func TestNewGolangVersion(t *testing.T) {
 				require.Error(t, err)
 				return
 			}
+			assert.Nil(t, err)
 			assert.Equal(t, tc.expected, *v)
 		})
 	}