Echo detector uses the package Version field instead of SrcVersion for detecting vulnerabilities

[orizerah]

Description

Echo detector uses the package Version field instead of SrcVersion for detecting vulnerabilities. So for special cases of versions like: 2:2.4.3+samba4.22.4+dfsg-1~deb13u1, there are false positives.

Desired Behavior

Use SrcVersion for detection

Actual Behavior

Using Version for detection

Reproduction Steps

1. Create a Dockerfile with the following content:

FROM ghcr.io/buildecho/scanner-test:clean
RUN apt update
RUN apt install libtalloc2

2. docker build -t test .
3. trivy image test

### Target

None

### Scanner

None

### Output Format

None

### Mode

None

### Debug Output

```bash
no need

Operating System

macOS

Version

Version: 0.66.0
Vulnerability DB:
  Version: 2
  UpdatedAt: 2025-09-30 08:23:58.009979293 +0000 UTC
  NextUpdate: 2025-10-01 08:23:58.009979073 +0000 UTC
  DownloadedAt: 2025-09-30 08:36:49.830986 +0000 UTC

Checklist

• Run trivy clean --all
• Read the troubleshooting

[knqyf263]

#9552