Fix version remediation in CDX mapping

utils/xray/remediation/cdxremediation.go

@@ -2,6 +2,7 @@ package remediation
 
 import (
 	"fmt"
+	"strings"
 
 	"github.com/CycloneDX/cyclonedx-go"
 
@@ -58,6 +59,10 @@ func matchVulnerabilityToRemediationOptions(bom *cyclonedx.BOM, vulnerability *c
 	}
 }
 
+func normalizeVersion(version string) string {
+	return strings.TrimPrefix(version, "v")
+}
+
 func getAffectComponentCveRemediationStepsByFixedVersion(cve string, component cyclonedx.Component, cveRemediationOptions []utils.Option, strategy utils.FixStrategy) (steps []utils.OptionStep) {
 	for _, cveRemediationOption := range cveRemediationOptions {
 		if cveRemediationOption.Type != utils.InLock {
@@ -78,7 +83,7 @@ func getAffectComponentCveRemediationStepsByFixedVersion(cve string, component c
 				continue
 			}
 			// We only want FixVersion step type
-			if step.StepType == utils.FixVersion && step.PkgVersion.Name == component.Name && step.PkgVersion.Version == component.Version {
+			if step.StepType == utils.FixVersion && step.PkgVersion.Name == component.Name && normalizeVersion(step.PkgVersion.Version) == normalizeVersion(component.Version) {
 				steps = append(steps, step)
 			}
 		}

utils/xray/remediation/cdxremediation_test.go

@@ -441,6 +441,54 @@ func TestMatchVulnerabilityToRemediationOptions(t *testing.T) {
 			expectedAffectedVersions: nil,
 			description:              "Should ignore remediation steps when component name doesn't match",
 		},
+		{
+			name: "Go component with v-prefix version mismatch between API and BOM",
+			bom: &cyclonedx.BOM{
+				Components: &[]cyclonedx.Component{
+					{
+						BOMRef:  "golang-component-ref",
+						Name:    "golang.org/x/crypto",
+						Version: "0.33.0",
+					},
+				},
+			},
+			vulnerability: &cyclonedx.Vulnerability{
+				ID: "CVE-2023-1234",
+				Affects: &[]cyclonedx.Affects{
+					{
+						Ref: "golang-component-ref",
+					},
+				},
+			},
+			remediationOptions: utils.CveRemediationResponse{
+				"CVE-2023-1234": []utils.Option{
+					{
+						Type: utils.InLock,
+						Steps: map[utils.FixStrategy][]utils.OptionStep{
+							utils.QuickestFixStrategy: {
+								{
+									StepType: utils.FixVersion,
+									PkgVersion: utils.PackageVersionKey{
+										Name:    "golang.org/x/crypto",
+										Version: "v0.33.0",
+									},
+									UpgradeTo: utils.PackageVersionKey{
+										Version: "v0.40.0",
+									},
+								},
+							},
+						},
+					},
+				},
+			},
+			expectedAffectedVersions: []cyclonedx.AffectedVersions{
+				{
+					Version: "v0.40.0",
+					Status:  cyclonedx.VulnerabilityStatusNotAffected,
+				},
+			},
+			description: "Should match Go component when API returns v-prefixed version but BOM stores without prefix",
+		},
 		{
 			name: "Component version mismatch should be ignored",
 			bom: &cyclonedx.BOM{