luhring / syft

Vollständig aufgelöster Abhängigkeitssatz aus dem GitHub-Abhängigkeitsgraphen: 0 direkte und 0 indirekte (transitive) Pakete. Die transitive Hülle ist vollständig, wenn das Repository eine Lockfile eincheckt.

Der Advisory-Abgleich konnte für diesen Bericht nicht ausgeführt werden: No resolved dependencies to assess

{
  "data": {
    "repo": {
      "topics": [],
      "is_fork": true,
      "size_kb": 17593,
      "has_wiki": true,
      "homepage": null,
      "languages": {
        "C": 107,
        "Go": 1761309,
        "HTML": 132,
        "Java": 6170,
        "Roff": 193,
        "Ruby": 9083,
        "Shell": 45628,
        "Elixir": 9158,
        "Erlang": 3512,
        "Python": 32629,
        "Makefile": 23303,
        "Dockerfile": 7745,
        "Vim Script": 35
      },
      "pushed_at": "2025-05-23T17:57:27Z",
      "created_at": "2021-09-26T21:50:46Z",
      "owner_type": "User",
      "updated_at": "2021-11-24T12:00:18Z",
      "description": "CLI tool and library for generating a Software Bill of Materials from container images and filesystems",
      "is_archived": false,
      "is_disabled": false,
      "license_spdx": "Apache-2.0",
      "default_branch": "main",
      "license_spdx_raw": "Apache-2.0",
      "primary_language": "Go",
      "significant_languages": [
        "Go"
      ]
    },
    "owner": {
      "blog": null,
      "name": "Dan Luhring",
      "type": "User",
      "login": "luhring",
      "company": "Docker",
      "location": "Alexandria, VA",
      "followers": 105,
      "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4",
      "created_at": "2013-08-09T18:29:55Z",
      "is_verified": null,
      "public_repos": 97,
      "account_age_days": 4732
    },
    "license": {
      "state": "standard",
      "spdx_id": "Apache-2.0",
      "raw_spdx": "Apache-2.0",
      "file_present": true,
      "scorecard_found": true,
      "profile_has_license": false
    },
    "activity": {
      "releases": [
        {
          "tag": "v0.24.0",
          "kind": "minor",
          "published_at": "2021-09-23T00:55:03Z"
        },
        {
          "tag": "v0.23.0",
          "kind": "minor",
          "published_at": "2021-09-13T17:06:23Z"
        },
        {
          "tag": "v0.22.0",
          "kind": "minor",
          "published_at": "2021-09-03T21:29:34Z"
        },
        {
          "tag": "v0.21.0",
          "kind": "minor",
          "published_at": "2021-08-20T17:50:28Z"
        },
        {
          "tag": "v0.20.0",
          "kind": "minor",
          "published_at": "2021-08-18T15:00:49Z"
        },
        {
          "tag": "v0.19.1",
          "kind": "patch",
          "published_at": "2021-06-30T17:10:00Z"
        },
        {
          "tag": "v0.19.0",
          "kind": "minor",
          "published_at": "2021-06-29T22:16:32Z"
        },
        {
          "tag": "v0.18.0",
          "kind": "minor",
          "published_at": "2021-06-29T18:28:09Z"
        },
        {
          "tag": "v0.17.1",
          "kind": "patch",
          "published_at": "2021-06-19T18:32:13Z"
        },
        {
          "tag": "v0.17.0",
          "kind": "minor",
          "published_at": "2021-06-04T16:50:22Z"
        },
        {
          "tag": "v0.16.1",
          "kind": "patch",
          "published_at": "2021-05-25T21:13:58Z"
        },
        {
          "tag": "v0.16.0",
          "kind": "minor",
          "published_at": "2021-05-25T19:01:02Z"
        },
        {
          "tag": "v0.15.2",
          "kind": "patch",
          "published_at": "2021-05-12T21:28:52Z"
        },
        {
          "tag": "v0.15.1",
          "kind": "patch",
          "published_at": "2021-04-22T20:38:09Z"
        },
        {
          "tag": "v0.15.0",
          "kind": "minor",
          "published_at": "2021-04-22T19:56:18Z"
        },
        {
          "tag": "v0.14.0",
          "kind": "minor",
          "published_at": "2021-03-20T16:23:57Z"
        },
        {
          "tag": "v0.13.1",
          "kind": "patch",
          "published_at": "2021-02-26T20:59:49Z"
        },
        {
          "tag": "v0.13.0",
          "kind": "minor",
          "published_at": "2021-02-25T18:47:13Z"
        },
        {
          "tag": "v0.12.7",
          "kind": "patch",
          "published_at": "2021-02-17T13:14:18Z"
        },
        {
          "tag": "v0.12.6",
          "kind": "patch",
          "published_at": "2021-02-05T16:26:40Z"
        },
        {
          "tag": "v0.12.5",
          "kind": "patch",
          "published_at": "2021-02-01T17:03:28Z"
        },
        {
          "tag": "v0.12.4",
          "kind": "patch",
          "published_at": "2021-01-27T16:51:40Z"
        },
        {
          "tag": "v0.12.3",
          "kind": "patch",
          "published_at": "2021-01-22T21:10:06Z"
        },
        {
          "tag": "v0.12.2",
          "kind": "patch",
          "published_at": "2021-01-06T02:32:24Z"
        },
        {
          "tag": "v0.12.1",
          "kind": "patch",
          "published_at": "2021-01-05T00:45:03Z"
        },
        {
          "tag": "v0.12.0",
          "kind": "minor",
          "published_at": "2021-01-04T21:50:35Z"
        },
        {
          "tag": "v0.11.1",
          "kind": "patch",
          "published_at": "2020-12-23T18:23:01Z"
        },
        {
          "tag": "v0.11.0",
          "kind": "minor",
          "published_at": "2020-12-18T21:59:30Z"
        },
        {
          "tag": "v0.10.0",
          "kind": "minor",
          "published_at": "2020-12-10T03:20:53Z"
        },
        {
          "tag": "v0.9.2",
          "kind": "patch",
          "published_at": "2020-12-03T21:32:24Z"
        },
        {
          "tag": "v0.9.1",
          "kind": "patch",
          "published_at": "2020-12-02T12:50:31Z"
        },
        {
          "tag": "v0.9.0",
          "kind": "minor",
          "published_at": "2020-11-30T16:37:44Z"
        },
        {
          "tag": "v0.8.0",
          "kind": "minor",
          "published_at": "2020-11-17T18:21:57Z"
        },
        {
          "tag": "v0.7.1",
          "kind": "patch",
          "published_at": "2020-11-12T14:36:20Z"
        },
        {
          "tag": "v0.7.0",
          "kind": "minor",
          "published_at": "2020-11-11T20:15:12Z"
        },
        {
          "tag": "v0.6.0",
          "kind": "minor",
          "published_at": "2020-11-09T19:18:48Z"
        },
        {
          "tag": "v0.5.1",
          "kind": "patch",
          "published_at": "2020-11-04T20:47:55Z"
        },
        {
          "tag": "v0.5.0",
          "kind": "minor",
          "published_at": "2020-10-30T19:14:32Z"
        },
        {
          "tag": "v0.4.1",
          "kind": "patch",
          "published_at": "2020-10-26T15:19:25Z"
        },
        {
          "tag": "v0.4.0",
          "kind": "minor",
          "published_at": "2020-10-23T15:06:51Z"
        },
        {
          "tag": "v0.3.0",
          "kind": "minor",
          "published_at": "2020-10-15T18:41:28Z"
        },
        {
          "tag": "v0.2.0",
          "kind": "minor",
          "published_at": "2020-10-08T18:37:06Z"
        },
        {
          "tag": "v0.1.0",
          "kind": "minor",
          "published_at": "2020-09-29T20:33:40Z"
        },
        {
          "tag": "v0.1.0-beta.5",
          "kind": "prerelease",
          "published_at": "2020-09-26T02:59:19Z"
        },
        {
          "tag": "v0.1.0-beta.4",
          "kind": "prerelease",
          "published_at": "2020-08-10T22:28:43Z"
        },
        {
          "tag": "v0.1.0-beta.3",
          "kind": "prerelease",
          "published_at": "2020-08-10T14:33:44Z"
        },
        {
          "tag": "v0.1.0-beta.2",
          "kind": "prerelease",
          "published_at": "2020-07-27T19:13:41Z"
        },
        {
          "tag": "v0.1.0-beta.1",
          "kind": "prerelease",
          "published_at": "2020-07-27T13:55:11Z"
        }
      ],
      "recent_commits": [
        {
          "oid": "890fb3f0e8595c1bd4a746d50fa32ac44a0607d9",
          "body": "Signed-off-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "fix: missing APK node vulnerabilities (#1565)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-02-10T20:52:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e236054668434857e07ec4f6bd7f9e391019e9a3",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "fix: python CPE generation for alpine (#1564)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-02-10T18:04:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3013c8b69138298814a565d2addf42eb4bfced98",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 23.0.0+incompatible to 23.0.1+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v23.0.0...v23.0.1)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name:\n[…]\n:production\r\n  update-type: version-update:semver-patch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1563)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-02-10T15:43:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "88c81d33edc67b0b9636d0046417a9373ac8b74f",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "switch from trigger-release target to release target (#1560)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-02-09T16:35:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "988041ba6d786d51cfa431d9579bc51b7bc17877",
          "body": "…#1510)\n\n* replace raw globs with index equivelent operations\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n* add cataloger test for alpm cataloger\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n* fix import sorting for binary cataloger\r\n\r\nSigned-off-by: Alex Goodman <al\n[…]\ndman <alex.goodman@anchore.com>\r\n\r\n* move observing resolver to pkgtest\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "Speed up cataloging by replacing globs searching with index lookups (…",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-02-09T16:19:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "550e2fc7c32f84581b8fe1dd7e57b1996df21018",
          "body": null,
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1549)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-02-09T15:10:35Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "43b53ac17377e16357cd1fec4f8d94318f17e2c4",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "Fix installed versions (#1556)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2023-02-09T14:03:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "08804842fa54219cf48919202e94583dec9ebecd",
          "body": "Bumps [golang.org/x/net](https://github.com/golang/net) from 0.5.0 to 0.6.0.\r\n- [Release notes](https://github.com/golang/net/releases)\r\n- [Commits](https://github.com/golang/net/compare/v0.5.0...v0.6.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/net\r\n  dependency-type: direct:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/net from 0.5.0 to 0.6.0 (#1558)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-02-09T14:01:56Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "284814153d311a5577724e33cfe770716bc23762",
          "body": "* add postgresql classifier\r\nSigned-off-by: witchcraze <witchcraze@gmail.com>\r\n\r\n* revert package dedup test upgrade\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "feat: add postgresql classifier (#1536)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2023-02-08T19:31:17Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8847ba5d0b2ba09e673c43ddcf064d21d4470c0d",
          "body": "* add release trigger\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n* deduplicate version and changelog calls + add gh checks\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n* add more chronicle verbosity, but not when triggering releases\r\n\r\nSigned-off-by: Alex Goodman <a\n[…]\nhore.com>\r\n\r\n* add version prefix check on tags in release quality gate\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "Add release trigger (#1501)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-02-08T16:38:27Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "48528efff3b7268b921d74645678a4c7f07ae35c",
          "body": "Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.7.0 to 0.8.0.\r\n- [Release notes](https://github.com/golang/mod/releases)\r\n- [Commits](https://github.com/golang/mod/compare/v0.7.0...v0.8.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/mod\r\n  dependency-type: direct:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/mod from 0.7.0 to 0.8.0 (#1552)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-02-08T15:07:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d856a7c7bbd1cb8e54776a8995cf497091b7e9e",
          "body": "Bumps [golang.org/x/term](https://github.com/golang/term) from 0.4.0 to 0.5.0.\r\n- [Release notes](https://github.com/golang/term/releases)\r\n- [Commits](https://github.com/golang/term/compare/v0.4.0...v0.5.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/term\r\n  dependency-type: dire\n[…]\n:production\r\n  update-type: version-update:semver-minor\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/term from 0.4.0 to 0.5.0 (#1551)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-02-08T14:23:31Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "38a090c2189fc15327b26973d2e22b155cc40d7a",
          "body": "Signed-off-by: Avi Deitcher <avi@deitcher.net>",
          "is_bot": false,
          "headline": "fix: add support for licenses not found on list (#1540)",
          "author_name": "Avi Deitcher",
          "author_login": "deitch",
          "committed_at": "2023-02-07T16:47:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "deb7052f419fc91ffe71e6be862be79c9475ef84",
          "body": "* Update syft bootstrap tools to latest versions.\r\nSigned-off-by: GitHub <noreply@github.com>\r\n\r\n* fix: remove ineff assign\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\r\n\r\n---------\r\n\r\nSigned-off-by: GitHub <noreply@github.com>\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\r\nCo-authored-by: spiffcs <spiffcs@users.noreply.github.com>\r\nCo-authored-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1541)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-02-07T15:41:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "965047329845d8fefb93e633d71c6a737008082f",
          "body": null,
          "is_bot": false,
          "headline": "feat: Allow specific versions of formats to be specified (#1543)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-02-07T15:40:43Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "95201840d2baef90379dd80fd79f19d5fda51da6",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: kzantow <kzantow@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update Stereoscope to c49244e4d66f1ee789027ea23acc746968799c3b (#1539)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-02-07T15:05:18Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6ba595344a47fc04947367ced288019fe66c5704",
          "body": "When base is set, it should appear identically to when we scan the root\r\nfilesystem - and as a result, the path should begin with the path\r\nseparator.\r\n\r\nE.g. when scanning the root `./target/` with the same base,\r\n`target/bin/busybox` should appear in the output as `/bin/busybox`, not\r\nas previously as `bin/busybox`.\r\n\r\nSigned-off-by: Justin Chadwell <me@jedevc.com>",
          "is_bot": false,
          "headline": "source: when base is set, responsePath should be absolute (#1542)",
          "author_name": "Justin Chadwell",
          "author_login": "jedevc",
          "committed_at": "2023-02-06T17:06:04Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "9995950c70e849f9921919faffbfcf46401f71f3",
          "body": "* fix: update config struct to not decode password/key\r\n* test: update tests to confirm no secrets in output\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\r\n---------\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "fix: update config struct to not decode password/key (#1538)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-02-03T18:06:14Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b6a496f18c3faa5711dce3ca0a845edd1a8e37e6",
          "body": "Signed-off-by: GitHub <noreply@github.com>\r\nCo-authored-by: spiffcs <spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1537)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-02-03T17:35:33Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "0853a50f4d0be5898181772aace19f2dc094bc1d",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "feat: add traefik classifier (#1504)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2023-02-02T18:59:26Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a1b82c96643d83cd89868e5b78a3206550342007",
          "body": "Signed-off-by: Nils Hanke <nils.hanke@outlook.de>",
          "is_bot": false,
          "headline": "fix: don't hardcode Cosign attest type (#1533)",
          "author_name": "Nils Hanke",
          "author_login": "Nirusu",
          "committed_at": "2023-02-02T17:47:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ad8604c2230ca21872f85c8c9c3ca1dca2b7f830",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.23+incompatible to 23.0.0+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v20.10.23...v23.0.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-n\n[…]\n:production\r\n  update-type: version-update:semver-major\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1531)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-02-02T15:53:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d80ee966dcfd790725ac6006f37ed4928c41d73f",
          "body": null,
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1530)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-02-02T13:47:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "1530ef354ffaf59cef6a02c949f2cdb82353954f",
          "body": null,
          "is_bot": false,
          "headline": "chore: update spdx/tools-golang to v0.5.0-rc1 (#1503)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-31T16:53:16Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "cdac2245b5d7302d2178b8144d2a90c5b67ab96f",
          "body": "* feat: update golang to 1.19\r\n\r\nSigned-off-by: Bradley Jones <bradley.jones@anchore.com>\r\n\r\n* chore: break out json schema drift check into separate script\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n* chore: update git index refresh\r\n\r\nSigned-off-by: Christopher Phillips <christop\n[…]\n\n\r\n---------\r\n\r\nSigned-off-by: Bradley Jones <bradley.jones@anchore.com>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "feat: update golang to 1.19 (#1526)",
          "author_name": "Bradley Jones",
          "author_login": "bradleyjones",
          "committed_at": "2023-01-31T16:39:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "8dba4c33dd6e306f074bb01900b5d87ae9cad364",
          "body": null,
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1525)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-01-31T14:27:38Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b81c9805dcc9bf25dad7659fd9c2bbf7dd3f3d90",
          "body": "* source: avoid second-step of symlink resolution in directory resolver\r\n\r\nWe can use the already existing file tree to peform symlink resolution\r\nfor FilesByPath, instead of traversing the symlinks again.\r\n\r\nThis moves all of the symlink logic into the indexing code, and then we\r\ncan rely on syft's\n[…]\nd-off-by: Justin Chadwell <me@jedevc.com>\r\n\r\n* source: add tests for new base parameter\r\n\r\nSigned-off-by: Justin Chadwell <me@jedevc.com>\r\n\r\n---------\r\n\r\nSigned-off-by: Justin Chadwell <me@jedevc.com>",
          "is_bot": false,
          "headline": "Allow scanning unpacked container filesystems (#1485)",
          "author_name": "Justin Chadwell",
          "author_login": "jedevc",
          "committed_at": "2023-01-30T18:47:24Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ba55963104b260ff0b98c595bdd697371367f324",
          "body": null,
          "is_bot": false,
          "headline": "fix: allow template for syft convert (#1521)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-26T17:07:36Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8c9160554164a50a5090563c4c6b79143c3f4085",
          "body": "1465 attestation with private key (#1502)\r\n\r\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "1465 attestation with private key (#1502)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-01-26T16:19:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4c0aef09b8d7fb78200b04416f474b90b79370de",
          "body": "Signed-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "fix: add relevant CPEs to python and busybox classifiers (#1517)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-01-25T17:18:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "02fb757c2111302cf6f9f5c95222704a2e69dbd8",
          "body": null,
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1515)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-01-25T15:31:53Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "674a54512c3ebe0c06d921ce093ed7a74317bb78",
          "body": null,
          "is_bot": false,
          "headline": "chore: correct bootstrap tool script (#1514)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-25T15:22:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "21ba5d0806a7ccf1ee6115ca2766a943223bd266",
          "body": "Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.12.1 to 0.13.0.\r\n- [Release notes](https://github.com/google/go-containerregistry/releases)\r\n- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)\r\n- [Commits](http\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/google/go-containerregistry (#1513)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-25T13:41:43Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0ba57a5936ed3ab34cc7e8331b55012ef13fdee2",
          "body": "…(#1511)\n\n* fix AssertEncoderAgainstGoldenSnapshot calls to conditionally update\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\n* chore: redact schema versions from syftjson comparison\r\n\r\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\r\n\r\n* chore: does not need a multiline expression\r\n\n[…]\ned-off-by: Keith Zantow <kzantow@gmail.com>\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\r\nCo-authored-by: Keith Zantow <kzantow@gmail.com>",
          "is_bot": false,
          "headline": "Fix AssertEncoderAgainstGoldenSnapshot calls to conditionally update …",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-01-24T21:41:57Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "3269bc98d4f5c6d9afcda106442402210a001720",
          "body": "Bumps [golang.org/x/mod](https://github.com/golang/mod) from 0.6.0 to 0.7.0.\r\n- [Release notes](https://github.com/golang/mod/releases)\r\n- [Commits](https://github.com/golang/mod/compare/v0.6.0...v0.7.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/mod\r\n  dependency-type: direct:pr\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/mod from 0.6.0 to 0.7.0 (#1505)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-23T20:01:25Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7f3382f7ebfc77b92cdfafd570d30286705a0ed0",
          "body": "Bumps [github.com/docker/docker](https://github.com/docker/docker) from 20.10.20+incompatible to 20.10.23+incompatible.\r\n- [Release notes](https://github.com/docker/docker/releases)\r\n- [Commits](https://github.com/docker/docker/compare/v20.10.20...v20.10.23)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependen\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/docker/docker (#1506)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-23T19:58:39Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "65e5ff63f05ceb8badab7941e1d3093ec9f95692",
          "body": "… (#1507)\n\nBumps [github.com/Masterminds/sprig/v3](https://github.com/Masterminds/sprig) from 3.2.2 to 3.2.3.\r\n- [Release notes](https://github.com/Masterminds/sprig/releases)\r\n- [Changelog](https://github.com/Masterminds/sprig/blob/master/CHANGELOG.md)\r\n- [Commits](https://github.com/Masterminds/sp\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/Masterminds/sprig/v3 from 3.2.2 to 3.2.3…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-23T19:48:22Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d287c22b6979ceb808038d343552b4f0e5555c77",
          "body": "…#1508)\n\nBumps [github.com/dustin/go-humanize](https://github.com/dustin/go-humanize) from 1.0.0 to 1.0.1.\r\n- [Release notes](https://github.com/dustin/go-humanize/releases)\r\n- [Commits](https://github.com/dustin/go-humanize/compare/v1.0.0...v1.0.1)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: \n[…]\nch\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/dustin/go-humanize from 1.0.0 to 1.0.1 (…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-23T19:48:00Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e8be93a8eb94c2ae2611415afc4f3582734d14fd",
          "body": "Signed-off-by: Luca Comellini <luca.com@gmail.com>",
          "is_bot": false,
          "headline": "Bump github.com/spdx/tools-golang to v0.4.0 (#1450)",
          "author_name": "Luca Comellini",
          "author_login": "lucacome",
          "committed_at": "2023-01-20T22:00:21Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e58050bac045be672621047d5699b88884e2da62",
          "body": "* Add failing test for strip version specifiers panic\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n* Fix test\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n* Prevent panic scenario in helper func\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\n\r\n* Fix lint issue\r\n\n[…]\ndman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Dan Luhring <dluhring@chainguard.dev>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "Fix panic in apkdb parsing on empty \"provides\" values (#1494)",
          "author_name": "Dan Luhring",
          "author_login": "luhring",
          "committed_at": "2023-01-20T14:49:44Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "36a0945c9541159c56a874f1074fe17d5ade1759",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "push detailed log statements to trace-level (#1500)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-01-20T14:33:23Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "396441e921f8415c13e81721f6c831e4052dd679",
          "body": "Signed-off-by: mikcl <mikesmikes400@gmail.com>",
          "is_bot": false,
          "headline": "npm: package-lock license decoding to accept string or array (#1482)",
          "author_name": "mikcl",
          "author_login": "Mikcl",
          "committed_at": "2023-01-20T14:28:51Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "972e4cdaebb807aecd5b19695715a98c679eaecf",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "always set the package ID for java packages (#1493)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-01-20T14:18:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "99f55f6a81cc4a3d1bdd92fdd23e062938a1549d",
          "body": "Signed-off-by: Nils Hanke <nils.hanke@outlook.de>\r\n\r\nSigned-off-by: Nils Hanke <nils.hanke@outlook.de>",
          "is_bot": false,
          "headline": "fix: skip filling in empty fields in APK metadata (#1484)",
          "author_name": "Nils Hanke",
          "author_login": "Nirusu",
          "committed_at": "2023-01-20T14:03:30Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "285112fe290dd750aa44dd47b5259b9ff7fa11ab",
          "body": "Bumps [github.com/facebookincubator/nvdtools](https://github.com/facebookincubator/nvdtools) from 0.1.4 to 0.1.5.\r\n- [Release notes](https://github.com/facebookincubator/nvdtools/releases)\r\n- [Commits](https://github.com/facebookincubator/nvdtools/compare/v0.1.4...v0.1.5)\r\n\r\n---\r\nupdated-dependencie\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/facebookincubator/nvdtools (#1499)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-20T14:02:47Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f29bea59215d080435c24a191a94c47ee2f4b9bf",
          "body": "Bumps [github.com/jinzhu/copier](https://github.com/jinzhu/copier) from 0.3.2 to 0.3.5.\r\n- [Release notes](https://github.com/jinzhu/copier/releases)\r\n- [Commits](https://github.com/jinzhu/copier/compare/v0.3.2...v0.3.5)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/jinzhu/copier\r\n  d\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/jinzhu/copier from 0.3.2 to 0.3.5 (#1498)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-20T13:51:20Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "39cdbc42aa3a3d401a309542ccd74a0b5351e38b",
          "body": "Bumps [github.com/vbatts/go-mtree](https://github.com/vbatts/go-mtree) from 0.5.0 to 0.5.2.\r\n- [Release notes](https://github.com/vbatts/go-mtree/releases)\r\n- [Changelog](https://github.com/vbatts/go-mtree/blob/main/releases.md)\r\n- [Commits](https://github.com/vbatts/go-mtree/compare/v0.5.0...v0.5.2\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/vbatts/go-mtree from 0.5.0 to 0.5.2 (#1497)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-20T13:50:59Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "27b62ce833194c3dc06a5b908b1be549372f3075",
          "body": "Bumps [github.com/gookit/color](https://github.com/gookit/color) from 1.4.2 to 1.5.2.\r\n- [Release notes](https://github.com/gookit/color/releases)\r\n- [Commits](https://github.com/gookit/color/compare/v1.4.2...v1.5.2)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/gookit/color\r\n  depend\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/gookit/color from 1.4.2 to 1.5.2 (#1496)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-20T13:50:37Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "499e7c4e16c39951bee97a74b92675d985dad415",
          "body": "Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.14.0 to 1.15.0.\r\n- [Release notes](https://github.com/spf13/viper/releases)\r\n- [Commits](https://github.com/spf13/viper/compare/v1.14.0...v1.15.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/spf13/viper\r\n  depende\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/viper from 1.14.0 to 1.15.0 (#1495)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-20T13:50:19Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "0f75f975c82086b5b8d3933db0127ceba4ed4e46",
          "body": "* binary cataloger should continue on errors\n\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\n\n* test: add redirect for cmd stderr stdout\n\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\n\n* test: image update for test failure\n\nSigned-off-by: Christopher Phillips <christ\n[…]\n>\n\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\nSigned-off-by: Christopher Phillips <christopher.phillips@anchore.com>\nCo-authored-by: Christopher Phillips <christopher.phillips@anchore.com>",
          "is_bot": false,
          "headline": "Relax error conditions for catalogers (#1492)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-01-20T00:28:42Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "7427445fe98dd72a81835fc0b939912cf270f3a9",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "feat: add memcached classifier (#1486)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2023-01-19T16:22:11Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "09a5baf5230aadfecb0b3693ba6ca0f83ef26208",
          "body": "Bumps [github.com/spf13/viper](https://github.com/spf13/viper) from 1.13.0 to 1.14.0.\r\n- [Release notes](https://github.com/spf13/viper/releases)\r\n- [Commits](https://github.com/spf13/viper/compare/v1.13.0...v1.14.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/spf13/viper\r\n  depende\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/viper from 1.13.0 to 1.14.0 (#1488)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-19T15:39:04Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "33c08c8545d20706d22eb884fa5c55be434f2ebb",
          "body": "…0 (#1489)\n\nBumps [github.com/bmatcuk/doublestar/v4](https://github.com/bmatcuk/doublestar) from 4.0.2 to 4.6.0.\r\n- [Release notes](https://github.com/bmatcuk/doublestar/releases)\r\n- [Commits](https://github.com/bmatcuk/doublestar/compare/v4.0.2...v4.6.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/bmatcuk/doublestar/v4 from 4.0.2 to 4.6.…",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-19T15:38:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "fd002db80264c2e68d5f33a033ac57802a06b7f9",
          "body": "Bumps [github.com/spf13/cobra](https://github.com/spf13/cobra) from 1.6.0 to 1.6.1.\r\n- [Release notes](https://github.com/spf13/cobra/releases)\r\n- [Commits](https://github.com/spf13/cobra/compare/v1.6.0...v1.6.1)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/spf13/cobra\r\n  dependency-\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/spf13/cobra from 1.6.0 to 1.6.1 (#1490)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-19T14:16:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "cb3e4b8e49c6ad2c73cf76566e172c9c5933d880",
          "body": "Bumps [github.com/go-test/deep](https://github.com/go-test/deep) from 1.0.8 to 1.1.0.\r\n- [Release notes](https://github.com/go-test/deep/releases)\r\n- [Changelog](https://github.com/go-test/deep/blob/master/CHANGES.md)\r\n- [Commits](https://github.com/go-test/deep/compare/v1.0.8...v1.1.0)\r\n\r\n---\r\nupda\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/go-test/deep from 1.0.8 to 1.1.0 (#1491)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-19T14:01:33Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "5917f8d8f941a2279334a9e5b2af9c318f68129b",
          "body": "Bumps [github.com/google/go-containerregistry](https://github.com/google/go-containerregistry) from 0.11.0 to 0.12.1.\r\n- [Release notes](https://github.com/google/go-containerregistry/releases)\r\n- [Changelog](https://github.com/google/go-containerregistry/blob/main/.goreleaser.yml)\r\n- [Commits](http\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/google/go-containerregistry (#1487)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-19T13:47:36Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "70e6d0f2e38d0f89696bfad468b582b48c2bd02b",
          "body": "Bumps [golang.org/x/net](https://github.com/golang/net) from 0.4.0 to 0.5.0.\r\n- [Release notes](https://github.com/golang/net/releases)\r\n- [Commits](https://github.com/golang/net/compare/v0.4.0...v0.5.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: golang.org/x/net\r\n  dependency-type: direct:pr\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump golang.org/x/net from 0.4.0 to 0.5.0 (#1475)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-18T14:39:50Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "31a763c46deb9bf776e1fc2c84ab4c6ef7435f49",
          "body": "Bumps [github.com/adrg/xdg](https://github.com/adrg/xdg) from 0.3.3 to 0.4.0.\r\n- [Release notes](https://github.com/adrg/xdg/releases)\r\n- [Commits](https://github.com/adrg/xdg/compare/v0.3.3...v0.4.0)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/adrg/xdg\r\n  dependency-type: direct:pr\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/adrg/xdg from 0.3.3 to 0.4.0 (#1477)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-18T14:39:35Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "ae6c9c2e974c806d4971aac2ad01b37045349a8a",
          "body": "Bumps [github.com/sergi/go-diff](https://github.com/sergi/go-diff) from 1.2.0 to 1.3.1.\r\n- [Release notes](https://github.com/sergi/go-diff/releases)\r\n- [Commits](https://github.com/sergi/go-diff/compare/v1.2.0...v1.3.1)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/sergi/go-diff\r\n  d\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/sergi/go-diff from 1.2.0 to 1.3.1 (#1476)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-18T14:39:15Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "f6a0dd33d1a1a62f554dc20cfca7a72762f1d5c5",
          "body": "Bumps [github.com/vifraa/gopom](https://github.com/vifraa/gopom) from 0.1.0 to 0.2.1.\r\n- [Release notes](https://github.com/vifraa/gopom/releases)\r\n- [Commits](https://github.com/vifraa/gopom/compare/v0.1.0...v0.2.1)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: github.com/vifraa/gopom\r\n  depend\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github.com/vifraa/gopom from 0.1.0 to 0.2.1 (#1474)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-18T14:38:30Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "b77c104aa615bf5975b6cc000bc0551ae5fd6290",
          "body": "Bumps [github/codeql-action](https://github.com/github/codeql-action) from 1 to 2.\r\n- [Release notes](https://github.com/github/codeql-action/releases)\r\n- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)\r\n- [Commits](https://github.com/github/codeql-action/compare/v1...v2)\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump github/codeql-action from 1 to 2 (#1473)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-18T14:38:06Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "10ca7f56ab2d974fa864d8ddee77414afe13a52a",
          "body": "Bumps [actions/setup-go](https://github.com/actions/setup-go) from 2 to 3.\r\n- [Release notes](https://github.com/actions/setup-go/releases)\r\n- [Commits](https://github.com/actions/setup-go/compare/v2...v3)\r\n\r\n---\r\nupdated-dependencies:\r\n- dependency-name: actions/setup-go\r\n  dependency-type: direct:\n[…]\n\r\n...\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\n\r\nSigned-off-by: dependabot[bot] <support@github.com>\r\nCo-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>",
          "is_bot": true,
          "headline": "chore(deps): bump actions/setup-go from 2 to 3 (#1472)",
          "author_name": "dependabot[bot]",
          "author_login": "dependabot[bot]",
          "committed_at": "2023-01-18T14:37:45Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "6b2dc08ffbe0ae51911cd52b78e509e16909ec82",
          "body": "Signed-off-by: Luca Comellini <luca.com@gmail.com>\r\n\r\nSigned-off-by: Luca Comellini <luca.com@gmail.com>",
          "is_bot": false,
          "headline": "Add dependabot (#1451)",
          "author_name": "Luca Comellini",
          "author_login": "lucacome",
          "committed_at": "2023-01-18T14:29:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "03971ace43b877e371c13e3f786c1f6c3a4ec507",
          "body": null,
          "is_bot": false,
          "headline": "chore: use checkout v3 with new depth (#1471)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-01-17T21:26:39Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "07aee798b08a0a07370a85cc923e5e30c8ff384d",
          "body": null,
          "is_bot": false,
          "headline": "chore: use checkout v2 for tag depth (#1470)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-01-17T21:03:29Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6cf668f749f41426d306d6cfbc87222f89b06d80",
          "body": "* normalize error handling and recover from panics while parsing binaries\r\nSigned-off-by: Keith Zantow <kzantow@gmail.com>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "fix: nil panic in graalvm cataloger (#1468)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-17T19:06:24Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "2ec4371c95a0b3808c852c16c4e24e7f0d5d6e7c",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "add linter for type assertion checks (#1469)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-01-17T19:00:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "fc4d28f365eb1df50799894056e5115d999272c8",
          "body": "resolves reporting of CVE-2022-41717\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "fix: bump golang.org/x/net to v0.4.0 (#1467)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-01-17T17:02:34Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5290dfb9c2b1f34d1e7e39ab5fe80f9934478872",
          "body": "This resolves reporting of GHSA-69ch-w2m2-3vjp\r\n\r\nSigned-off-by: Weston Steimel <weston.steimel@anchore.com>",
          "is_bot": false,
          "headline": "fix: bump golang.org/x/text to v0.3.8 (#1466)",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-01-17T15:50:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "05611c283dac7e22cdff6c7a9d9389e34b015556",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "bootstrap within composite action (#1461)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2023-01-17T15:04:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "934644232ab115b2518acdb5d240ae31aaf55989",
          "body": "…data (#1458)",
          "is_bot": false,
          "headline": "chore: revert GolangBinMetadata name and make analogous GolangModMeta…",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-13T21:46:12Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "641bccc79bd98af48dcb450af9b217d68b1d5662",
          "body": "22.05 has been released, update the instructions.\r\n\r\nSigned-off-by: Florian Klink <flokli@flokli.de>",
          "is_bot": false,
          "headline": "README: update Nix installation instructions (#1455)",
          "author_name": "Florian Klink",
          "author_login": "flokli",
          "committed_at": "2023-01-13T15:43:25Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac94bf530c7b1e6ee5df1ed0f9f6454fca8bc918",
          "body": "Fixes https://github.com/anchore/syft/issues/1453",
          "is_bot": false,
          "headline": "fix: update graalvm cataloger to fix panic (#1454)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-12T22:42:13Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e87cfe7319649df797a553947dc049c5d927b5b5",
          "body": "…(#1452)",
          "is_bot": false,
          "headline": "chore: remove bumping cosign in go.mod when updating bootstrap tools …",
          "author_name": "Weston Steimel",
          "author_login": "westonsteimel",
          "committed_at": "2023-01-12T21:21:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "260cb4c72d001b63e7462ed214caeb0aab605714",
          "body": "* moved the relevant fields to the Metadata field\r\n\r\nSigned-off-by: Asaf Greenholts <asaf@cidersecurity.io>\r\n\r\n* added metadata types\r\n\r\nSigned-off-by: Asaf Greenholts <asaf@cidersecurity.io>\r\n\r\n* Added hashes to metadata of packge-lock.json and Pipfile.lock\r\n\r\nSigned-off-by: Asaf Greenholts <asaf@c\n[…]\nan <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Asaf Greenholts <asaf@cidersecurity.io>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "feat: Add the origin field to the output format of syftjson (#1327)",
          "author_name": "Asi Greenholts",
          "author_login": "TupleType",
          "committed_at": "2023-01-12T20:03:05Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "85bddaa43d09d70bdc4bd0a6927765c994bdc4e6",
          "body": null,
          "is_bot": false,
          "headline": "chore: update schema (#1449)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-12T19:25:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a864dc950544cf8e01762e3dc1487cda5dc020f9",
          "body": "* feat: prefer known CPE vendors over other candidates\r\n\r\nAll ASF projects will be under the `apache` vendor in CPE, and\r\nindeed this is already one of the candidates, but the logic\r\nfor selecting the 'most specific' CPE string would select for\r\nexample `apache_software_foundation` or `commons-text`\n[…]\nx Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Arnout Engelen <arnout@bzzt.net>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "feat: prefer known CPE vendors over other candidates (#1294)",
          "author_name": "Arnout Engelen",
          "author_login": "raboof",
          "committed_at": "2023-01-12T19:16:53Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "44e8ae2577f2bed4c97e4655424a32dfc3abb2f4",
          "body": "…out for keyless flow (#1442)\n\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "fix: update attestation code to remove library dependencies and shell…",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-01-12T17:22:05Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "ac8f72fdd1b93e5ead343601bba1c06a9341d8ba",
          "body": "* feat: initial commit providing mix support\r\n\r\nSigned-off-by: cpendery <cpendery@vt.edu>\r\n\r\n* feat: add rebar parser\r\n\r\nSigned-off-by: cpendery <cpendery@vt.edu>\r\n\r\n* fix: add beam/hex everywhere else required for Syft runtime\r\n\r\nSigned-off-by: cpendery <cpendery@vt.edu>\r\n\r\n* style: fix lints\r\n\r\nSi\n[…]\ny: Alex Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: cpendery <cpendery@vt.edu>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "feat: add BeamVM Hex support (#1073)",
          "author_name": "Chapman Pendery",
          "author_login": "cpendery",
          "committed_at": "2023-01-12T17:10:46Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "e063471c6608b9f7492820aa47d5de8acbf9ffef",
          "body": "Signed-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "feat: add apache httpd binary classifier (#1448)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2023-01-12T15:50:01Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "645debe7a4aa42e910d61bbc881b884746c5c8d4",
          "body": "Signed-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>\r\n\r\nSigned-off-by: Batuhan Apaydın <batuhan.apaydin@trendyol.com>",
          "is_bot": false,
          "headline": "chore: claim artifacthub package ownership from developer-guy (#881)",
          "author_name": "Batuhan Apaydın",
          "author_login": "developer-guy",
          "committed_at": "2023-01-11T20:25:42Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "4bfb849310a2d2befbabddc62fd79aca0d028953",
          "body": "* catalog: run cataloggers concurrently\r\n\r\nSigned-off-by: mikcl <mikesmikes400@gmail.com>\r\n\r\n* frontend: expose workers as a configurable option\r\n\r\nSigned-off-by: mikcl <mikesmikes400@gmail.com>\r\n\r\n* fixup! frontend: expose workers as a configurable option\r\n\r\nSigned-off-by: mikcl <mikesmikes400@gmai\n[…]\nf-by: mikcl <mikesmikes400@gmail.com>\r\n\r\nSigned-off-by: mikcl <mikesmikes400@gmail.com>\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>\r\nCo-authored-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "Parallel package catalog processing (#1355)",
          "author_name": "mikcl",
          "author_login": "Mikcl",
          "committed_at": "2023-01-11T20:18:02Z",
          "body_truncated": true,
          "is_coding_agent": false
        },
        {
          "oid": "d524bd5fc39cc5a583b20ec656cd01a9742fce7a",
          "body": "* add php classifier\r\nSigned-off-by: witchcraze <witchcraze@gmail.com>\r\n\r\n* make lint-fix\r\nSigned-off-by: witchcraze <witchcraze@gmail.com>",
          "is_bot": false,
          "headline": "feat: Add php binary catalogers (#1444)",
          "author_name": "witchcraze",
          "author_login": "witchcraze",
          "committed_at": "2023-01-11T18:46:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "a8416d674bf7b8c9d43ba295cdc6a8c8b07f72ca",
          "body": "Co-authored-by: spiffcs <spiffcs@users.noreply.github.com>",
          "is_bot": true,
          "headline": "Update syft bootstrap tools to latest versions. (#1443)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-01-11T17:50:40Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "725529f43f92aa6e1c08634ade543e228f7b8744",
          "body": null,
          "is_bot": false,
          "headline": "fix: duplicate file in tar archive causes read to fail (#1445)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-10T19:55:02Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e480443c8c2966159ac1d84901d117529d50b227",
          "body": "Signed-off-by: William Blair <william.blair@oracle.com>",
          "is_bot": false,
          "headline": "Add support for GraalVM Native Image executables. (#1276)",
          "author_name": "William Blair",
          "author_login": "wdblair",
          "committed_at": "2023-01-06T23:31:22Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "db386baf81f2d3402ef197ec30a0b5b3b674bd0c",
          "body": "Signed-off-by: Benji Visser <benji@093b.org>",
          "is_bot": false,
          "headline": "Add redis binary classifier (#1438)",
          "author_name": "Benji Visser",
          "author_login": "noqcks",
          "committed_at": "2023-01-06T17:50:48Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "795a63f1c9f05674db7d2734b5c25c4431170e3a",
          "body": null,
          "is_bot": false,
          "headline": "docs: add cataloger construction summary (#1434)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2023-01-05T17:03:00Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "d4f9993b8d5ff947a085eeed15e5af3cd9b784d1",
          "body": null,
          "is_bot": true,
          "headline": "chore: update bootstrap tools to latest versions. (#1428)",
          "author_name": "anchore-actions-token-generator[bot]",
          "author_login": "anchore-actions-token-generator[bot]",
          "committed_at": "2023-01-05T15:20:58Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bb6fc6525c6b791999a21d014b7557075202a2e8",
          "body": "Signed-off-by: Benji Visser <benji@093b.org>",
          "is_bot": false,
          "headline": "Add alpine type to purl (#1431)",
          "author_name": "Benji Visser",
          "author_login": "noqcks",
          "committed_at": "2023-01-04T22:35:46Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "bc1edb9c8a2fb4824bfdcac6147edc2bbf47aaf6",
          "body": "Signed-off-by: Benji Visser <benji@093b.org>",
          "is_bot": false,
          "headline": "adding purl types for binary classifiers (#1435)",
          "author_name": "Benji Visser",
          "author_login": "noqcks",
          "committed_at": "2023-01-04T16:34:37Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "64be0a10721d8f4573c2800b777340eae219f64c",
          "body": null,
          "is_bot": false,
          "headline": "chore: refactor basic CPE functionality to its own package (#1436)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2023-01-04T16:26:28Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e3d6ffd30e44428b898675922a0474221a7f7dc7",
          "body": "Signed-off-by: Justin Chadwell <me@jedevc.com>",
          "is_bot": false,
          "headline": "fix: typo in os.Getwd error message (#1433)",
          "author_name": "Justin Chadwell",
          "author_login": "jedevc",
          "committed_at": "2023-01-03T14:56:20Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "8d36b212370860c5cc152deb3d710267fcbed857",
          "body": "The original fix b125ea83baa30dc981e82f4ddd384602f778f090 didn't catch\r\nall the excessive warnings, it seems like getArches can also be called\r\non binaries that aren't neccessarily go binaries, so the messages from\r\nthis should also be Trace instead of Warn.\r\n\r\nSigned-off-by: Justin Chadwell <me@jedevc.com>",
          "is_bot": false,
          "headline": "fix: additional excessive go binary warnings (#1432)",
          "author_name": "Justin Chadwell",
          "author_login": "jedevc",
          "committed_at": "2023-01-03T14:54:08Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "6a7d6e6071829c7ce2943266c0e187b27c0b325c",
          "body": null,
          "is_bot": false,
          "headline": "docs: migrate to homebrew-core (#1427)",
          "author_name": "Rui Chen",
          "author_login": "chenrui333",
          "committed_at": "2023-01-02T13:16:32Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "e1e489a2849c8432781a7cb58b257fa935efa1cf",
          "body": null,
          "is_bot": false,
          "headline": "fix: unicode output in cyclonedx-json format (#1420)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2022-12-23T13:37:47Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "b125ea83baa30dc981e82f4ddd384602f778f090",
          "body": null,
          "is_bot": false,
          "headline": "fix: excessive go binary warnings (#1424)",
          "author_name": "Keith Zantow",
          "author_login": "kzantow",
          "committed_at": "2022-12-23T13:36:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "3690f979b3ea776e9701bc71d496410576953422",
          "body": "…#1418)",
          "is_bot": false,
          "headline": "feat: update spdx format model to produce valid spdx json documents (…",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2022-12-21T20:56:03Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "5dd726fc865a09952c57fceb62ea684912024d05",
          "body": "Signed-off-by: Alex Goodman <alex.goodman@anchore.com>\r\n\r\nSigned-off-by: Alex Goodman <alex.goodman@anchore.com>",
          "is_bot": false,
          "headline": "clean package names in python parsers (#1417)",
          "author_name": "Alex Goodman",
          "author_login": "wagoodman",
          "committed_at": "2022-12-21T18:31:49Z",
          "body_truncated": false,
          "is_coding_agent": false
        },
        {
          "oid": "c8b8b1ca1198597e2deeac3b06ff947eaaa05c66",
          "body": null,
          "is_bot": false,
          "headline": "docs: update schema name to 2.3 (#1416)",
          "author_name": "Christopher Angelo Phillips",
          "author_login": "spiffcs",
          "committed_at": "2022-12-20T02:57:19Z",
          "body_truncated": false,
          "is_coding_agent": false
        }
      ],
      "releases_count": 48,
      "commits_last_year": 0,
      "latest_release_at": "2021-09-23T00:55:03Z",
      "latest_release_tag": "v0.24.0",
      "releases_from_tags": true,
      "days_since_last_push": 427,
      "active_weeks_last_year": 0,
      "days_since_latest_release": 1766,
      "mean_days_between_releases": 12.3
    },
    "community": {
      "has_readme": false,
      "has_license": false,
      "has_description": false,
      "has_contributing": false,
      "health_percentage": null,
      "has_issue_template": false,
      "has_code_of_conduct": false,
      "has_pull_request_template": false
    },
    "ecosystem": {
      "packages": [
        {
          "name": "github.com/anchore/syft",
          "exists": true,
          "license": null,
          "keywords": [],
          "ecosystem": "go",
          "matches_repo": false,
          "registry_url": "https://pkg.go.dev/github.com/anchore/syft",
          "is_deprecated": false,
          "latest_version": "v1.49.0",
          "repository_url": "https://github.com/anchore/syft",
          "versions_count": 268,
          "total_downloads": null,
          "dependents_count": null,
          "deprecation_note": null,
          "maintainers_count": null,
          "monthly_downloads": null,
          "first_published_at": null,
          "latest_published_at": "2026-07-20T18:04:57Z",
          "latest_version_yanked": null,
          "days_since_latest_publish": 4
        }
      ]
    },
    "popularity": {
      "forks": 0,
      "stars": 0,
      "watchers": 0,
      "fork_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_forks": 0
      },
      "star_history": {
        "days": [],
        "complete": true,
        "collected": 0,
        "total_stars": 0,
        "collected_at": null
      },
      "open_issues_and_prs": 0
    },
    "ai_readiness": {
      "has_nix": false,
      "example_dirs": [
        "example",
        "sample"
      ],
      "has_llms_txt": false,
      "has_dockerfile": true,
      "has_mcp_signal": false,
      "bootstrap_files": [
        "Makefile",
        "schema/cyclonedx/Makefile",
        "syft/pkg/cataloger/golang/test-fixtures/archs/Makefile",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile",
        "syft/pkg/cataloger/rpm/test-fixtures/Makefile",
        "test/cli/test-fixtures/Makefile",
        "test/cli/test-fixtures/image-java-spdx-tools/Makefile",
        "test/cli/test-fixtures/registry/Makefile",
        "test/install/Makefile",
        "test/integration/test-fixtures/Makefile"
      ],
      "api_schema_files": [],
      "has_devcontainer": false,
      "typecheck_configs": [],
      "toolchain_manifests": [
        "go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod",
        "syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod",
        "syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml",
        "syft/pkg/cataloger/java/test-fixtures/pom/pom.xml",
        "test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod",
        "test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod",
        "test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml",
        "test/integration/test-fixtures/image-sbom-cataloger/go.mod"
      ],
      "largest_source_bytes": 69935,
      "source_files_sampled": 563,
      "oversized_source_files": 2,
      "agent_instruction_files": [],
      "agent_instruction_max_bytes": null
    },
    "dependencies": {
      "manifests": [
        "go.mod"
      ],
      "advisories": {
        "error": "No resolved dependencies to assess",
        "scope": "repository_graph",
        "source": null,
        "findings": [],
        "collected": false,
        "malicious": [],
        "truncated": false,
        "by_severity": {},
        "advisory_count": 0,
        "affected_count": 0,
        "assessed_count": 0,
        "malicious_count": 0,
        "assessed_package": null,
        "unassessed_count": 0,
        "direct_affected_count": 0
      },
      "ecosystems": [
        "go"
      ],
      "dependencies": [
        {
          "name": "github.com/acarl005/stripansi",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20180116102854-5a71ef0e047d"
        },
        {
          "name": "github.com/acobaugh/osrelease",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.0"
        },
        {
          "name": "github.com/adrg/xdg",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.4.0"
        },
        {
          "name": "github.com/anchore/go-macholibre",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220308212642-53e6d0aaf6fb"
        },
        {
          "name": "github.com/anchore/go-testutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200925183923-d5f45b0d3c04"
        },
        {
          "name": "github.com/anchore/go-version",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.2-0.20200701162849-18adb9c92b9b"
        },
        {
          "name": "github.com/anchore/packageurl-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.1-0.20230104203445-02e0a6721501"
        },
        {
          "name": "github.com/bmatcuk/doublestar/v4",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v4.6.0"
        },
        {
          "name": "github.com/dustin/go-humanize",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.1"
        },
        {
          "name": "github.com/facebookincubator/nvdtools",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.1.5"
        },
        {
          "name": "github.com/go-test/deep",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/google/go-cmp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.9"
        },
        {
          "name": "github.com/google/uuid",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.0"
        },
        {
          "name": "github.com/gookit/color",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.2"
        },
        {
          "name": "github.com/hashicorp/go-multierror",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.1"
        },
        {
          "name": "github.com/jinzhu/copier",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.3.5"
        },
        {
          "name": "github.com/mholt/archiver/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.5.1"
        },
        {
          "name": "github.com/microsoft/go-rustaudit",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220730194248-4b17361d90a5"
        },
        {
          "name": "github.com/mitchellh/go-homedir",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.1.0"
        },
        {
          "name": "github.com/mitchellh/hashstructure/v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.0.2"
        },
        {
          "name": "github.com/mitchellh/mapstructure",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.5.0"
        },
        {
          "name": "github.com/olekukonko/tablewriter",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.5"
        },
        {
          "name": "github.com/pelletier/go-toml",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.5"
        },
        {
          "name": "github.com/scylladb/go-set",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.3-0.20200225121959-cc7b2070d91e"
        },
        {
          "name": "github.com/sergi/go-diff",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.3.1"
        },
        {
          "name": "github.com/sirupsen/logrus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.0"
        },
        {
          "name": "github.com/spdx/tools-golang",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.0-rc1"
        },
        {
          "name": "github.com/spf13/afero",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.9.3"
        },
        {
          "name": "github.com/spf13/cobra",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.6.1"
        },
        {
          "name": "github.com/spf13/pflag",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.5"
        },
        {
          "name": "github.com/spf13/viper",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.15.0"
        },
        {
          "name": "github.com/stretchr/testify",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.8.1"
        },
        {
          "name": "github.com/vifraa/gopom",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.1"
        },
        {
          "name": "github.com/wagoodman/go-partybus",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20210627031916-db1f5573bbc5"
        },
        {
          "name": "github.com/wagoodman/go-progress",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20200731105512-1020f39e6240"
        },
        {
          "name": "github.com/wagoodman/jotframe",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20211129225309-56b0d0a4aebb"
        },
        {
          "name": "github.com/xeipuuv/gojsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.2.0"
        },
        {
          "name": "golang.org/x/mod",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.8.0"
        },
        {
          "name": "golang.org/x/net",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.6.0"
        },
        {
          "name": "golang.org/x/term",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.0"
        },
        {
          "name": "gopkg.in/yaml.v2",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v2.4.0"
        },
        {
          "name": "github.com/CycloneDX/cyclonedx-go",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.1-0.20221222100750-41a1ac565cce"
        },
        {
          "name": "github.com/Masterminds/sprig/v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.2.3"
        },
        {
          "name": "github.com/anchore/go-logger",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20220728155337-03b66a5207d8"
        },
        {
          "name": "github.com/anchore/stereoscope",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230208154630-5a306f07f2e7"
        },
        {
          "name": "github.com/docker/docker",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v23.0.1+incompatible"
        },
        {
          "name": "github.com/google/go-containerregistry",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.13.0"
        },
        {
          "name": "github.com/invopop/jsonschema",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.7.0"
        },
        {
          "name": "github.com/knqyf263/go-rpmdb",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20221030135625-4082a22221ce"
        },
        {
          "name": "github.com/opencontainers/go-digest",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v1.0.0"
        },
        {
          "name": "github.com/sassoftware/go-rpmutils",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.2.0"
        },
        {
          "name": "github.com/vbatts/go-mtree",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.5.2"
        },
        {
          "name": "golang.org/x/exp",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v0.0.0-20230202163644-54bba9f4231b"
        },
        {
          "name": "gopkg.in/yaml.v3",
          "manifest": "go.mod",
          "ecosystem": "go",
          "version_constraint": "v3.0.1"
        }
      ],
      "all_dependencies": {
        "error": null,
        "source": "github-sbom",
        "packages": [],
        "collected": true,
        "truncated": false,
        "total_count": 0,
        "direct_count": 0,
        "indirect_count": 0
      }
    },
    "maintainership": {
      "issues": {
        "open_prs": 0,
        "merged_prs": 0,
        "open_issues": 0,
        "closed_ratio": null,
        "closed_issues": 0,
        "closed_unmerged_prs": 0
      },
      "bus_factor": 1,
      "bot_contributors": 2,
      "top_contributors": [
        {
          "type": "User",
          "login": "wagoodman",
          "commits": 572,
          "avatar_url": "https://avatars.githubusercontent.com/u/590471?v=4"
        },
        {
          "type": "User",
          "login": "spiffcs",
          "commits": 112,
          "avatar_url": "https://avatars.githubusercontent.com/u/32073428?v=4"
        },
        {
          "type": "User",
          "login": "luhring",
          "commits": 105,
          "avatar_url": "https://avatars.githubusercontent.com/u/5199289?v=4"
        },
        {
          "type": "User",
          "login": "kzantow",
          "commits": 74,
          "avatar_url": "https://avatars.githubusercontent.com/u/3009477?v=4"
        },
        {
          "type": "User",
          "login": "jonasagx",
          "commits": 28,
          "avatar_url": "https://avatars.githubusercontent.com/u/774704?v=4"
        },
        {
          "type": "User",
          "login": "westonsteimel",
          "commits": 26,
          "avatar_url": "https://avatars.githubusercontent.com/u/1593939?v=4"
        },
        {
          "type": "User",
          "login": "cpendery",
          "commits": 15,
          "avatar_url": "https://avatars.githubusercontent.com/u/35637443?v=4"
        },
        {
          "type": "User",
          "login": "sambhav",
          "commits": 8,
          "avatar_url": "https://avatars.githubusercontent.com/u/16130816?v=4"
        },
        {
          "type": "User",
          "login": "jedevc",
          "commits": 7,
          "avatar_url": "https://avatars.githubusercontent.com/u/7352848?v=4"
        },
        {
          "type": "User",
          "login": "witchcraze",
          "commits": 6,
          "avatar_url": "https://avatars.githubusercontent.com/u/67056980?v=4"
        }
      ],
      "contributors_sampled": 75,
      "top_contributor_share": 0.544
    },
    "quality_signals": {
      "has_ci": true,
      "has_tests": true,
      "ci_workflows": [
        "benchmark-testing.yaml",
        "codeql-analysis.yml",
        "release.yaml",
        "update-bootstrap-tools.yml",
        "update-stereoscope-release.yml",
        "validations.yaml"
      ],
      "has_docs_dir": false,
      "linter_configs": [
        ".golangci.yaml"
      ],
      "has_editorconfig": false,
      "has_linter_config": true,
      "has_precommit_config": false
    },
    "security_signals": {
      "lockfiles": [
        "Cargo.lock",
        "Gemfile.lock",
        "Pipfile.lock",
        "composer.lock",
        "go.sum",
        "mix.lock",
        "package-lock.json",
        "pnpm-lock.yaml",
        "poetry.lock",
        "yarn.lock"
      ],
      "scorecard": {
        "checks": [
          {
            "name": "Binary-Artifacts",
            "score": 6,
            "reason": "binaries present in source code",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#binary-artifacts"
          },
          {
            "name": "Branch-Protection",
            "score": 0,
            "reason": "branch protection not enabled on development/release branches",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#branch-protection"
          },
          {
            "name": "CI-Tests",
            "score": null,
            "reason": "no pull request found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#ci-tests"
          },
          {
            "name": "CII-Best-Practices",
            "score": 0,
            "reason": "no effort to earn an OpenSSF best practices badge detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#cii-best-practices"
          },
          {
            "name": "Code-Review",
            "score": 0,
            "reason": "Found 0/30 approved changesets -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#code-review"
          },
          {
            "name": "Contributors",
            "score": 10,
            "reason": "project has 19 contributing companies or organizations",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#contributors"
          },
          {
            "name": "Dangerous-Workflow",
            "score": 10,
            "reason": "no dangerous workflow patterns detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dangerous-workflow"
          },
          {
            "name": "Dependency-Update-Tool",
            "score": 10,
            "reason": "update tool detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#dependency-update-tool"
          },
          {
            "name": "Fuzzing",
            "score": 0,
            "reason": "project is not fuzzed",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#fuzzing"
          },
          {
            "name": "License",
            "score": 10,
            "reason": "license file detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#license"
          },
          {
            "name": "Maintained",
            "score": 0,
            "reason": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#maintained"
          },
          {
            "name": "Packaging",
            "score": null,
            "reason": "packaging workflow not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#packaging"
          },
          {
            "name": "Pinned-Dependencies",
            "score": 1,
            "reason": "dependency not pinned by hash detected -- score normalized to 1",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#pinned-dependencies"
          },
          {
            "name": "SAST",
            "score": 10,
            "reason": "SAST tool detected: CodeQL",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#sast"
          },
          {
            "name": "Security-Policy",
            "score": 0,
            "reason": "security policy file not detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#security-policy"
          },
          {
            "name": "Signed-Releases",
            "score": null,
            "reason": "no releases found",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#signed-releases"
          },
          {
            "name": "Token-Permissions",
            "score": 0,
            "reason": "detected GitHub workflow tokens with excessive permissions",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#token-permissions"
          },
          {
            "name": "Vulnerabilities",
            "score": 0,
            "reason": "237 existing vulnerabilities detected",
            "documentation_url": "https://github.com/ossf/scorecard/blob/c395761df6afe1a69e476bc60a013a94bcbc153f/docs/checks.md#vulnerabilities"
          }
        ],
        "commit": "890fb3f0e8595c1bd4a746d50fa32ac44a0607d9",
        "ran_at": "2026-07-25T10:18:58Z",
        "aggregate_score": 3.6,
        "scorecard_version": "v5.5.0"
      },
      "has_codeql_workflow": true,
      "has_security_policy": false,
      "has_dependabot_config": true
    },
    "contribution_flow": {
      "collected": true,
      "ci_last_run_at": null,
      "oldest_open_prs": [],
      "last_merged_pr_at": null,
      "ci_last_conclusion": null,
      "oldest_open_issues": []
    }
  },
  "config": {
    "disabled_metrics": [],
    "disabled_categories": [],
    "disabled_components": {}
  },
  "source": {
    "url": "https://github.com/luhring/syft",
    "host": "github.com",
    "name": "syft",
    "owner": "luhring"
  },
  "metrics": {
    "overall": {
      "key": "overall",
      "band": "critical",
      "name": "Overall health",
      "note": "Abandonment Policy applies a 85% multiplier to weighted overall health.",
      "notes": [
        {
          "code": "abandonment_overall_adjustment",
          "params": {
            "cap": 0,
            "pct": 85
          }
        }
      ],
      "value": 26,
      "inputs": {
        "security": 36,
        "vitality": 20,
        "community": 12,
        "governance": 36,
        "engineering": 52,
        "abandonment_cap": null,
        "abandonment_state": "at_risk",
        "abandonment_multiplier": 85,
        "weighted_overall_before_abandonment": 31,
        "overall_after_abandonment_multiplier": 26
      },
      "components": []
    },
    "categories": [
      {
        "key": "vitality",
        "band": "critical",
        "name": "Vitality",
        "value": 20,
        "weight": 0.22,
        "metrics": [
          {
            "key": "development_activity",
            "band": "critical",
            "name": "Development activity",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "commits_last_year": 0,
              "human_commit_share": 0.65,
              "days_since_last_push": 427,
              "active_weeks_last_year": 0
            },
            "components": [
              {
                "key": "push_recency",
                "name": "Push recency",
                "detail": "last push 427 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "push_recency",
                    "params": {
                      "days": 427
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_cadence",
                "name": "Commit cadence",
                "detail": "0/52 weeks with commits",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "commit_cadence_weeks",
                    "params": {
                      "weeks": 0
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "commit_volume",
                "name": "Commit volume",
                "detail": "0 commits in the last year",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "commits_last_year",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "openssf_scorecard_maintained",
                "name": "OpenSSF Scorecard: Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "release_discipline",
            "band": "at_risk",
            "name": "Release discipline",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 48,
            "inputs": {
              "releases_count": 48,
              "latest_release_tag": "v0.24.0",
              "releases_from_tags": true,
              "days_since_latest_release": 1766,
              "mean_days_between_releases": 12.3
            },
            "components": [
              {
                "key": "ships_releases",
                "name": "Ships releases",
                "detail": "48 version tags (no GitHub releases)",
                "points": 16.2,
                "status": "partial",
                "details": [
                  {
                    "code": "version_tags_no_releases",
                    "params": {
                      "count": 48
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "release_recency",
                "name": "Release recency",
                "detail": "latest release 1766 days ago",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "release_recency",
                    "params": {
                      "days": 1766
                    }
                  }
                ],
                "max_points": 36
              },
              {
                "key": "release_cadence",
                "name": "Release cadence",
                "detail": "a release every ~12.3 days",
                "points": 27,
                "status": "met",
                "details": [
                  {
                    "code": "release_cadence",
                    "params": {
                      "gap": 12.3
                    }
                  }
                ],
                "max_points": 27
              },
              {
                "key": "openssf_scorecard_signed_releases",
                "name": "OpenSSF Scorecard: Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 10
              }
            ]
          },
          {
            "key": "abandonment",
            "band": "excellent",
            "name": "Abandonment",
            "note": null,
            "notes": [],
            "value": 85,
            "inputs": {
              "cap": null,
              "state": "at_risk",
              "guards": [
                "no_open_demand"
              ],
              "signals": [
                "release_stall",
                "scorecard_unmaintained"
              ],
              "red_flag": true,
              "multiplier_pct": 85,
              "declared_reason": null,
              "unverified_reason": null,
              "unanswered_open_prs": 0,
              "unanswered_open_issues": 0,
              "days_since_last_merged_pr": null,
              "days_since_last_human_commit": 1260,
              "days_since_last_human_commit_is_floor": false
            },
            "components": [
              {
                "key": "project_is_still_maintained",
                "name": "Project is still maintained",
                "detail": "no human commit for 1260 days; 2 unmet obligation(s): releases stalled, Scorecard reports it unmaintained",
                "points": 85,
                "status": "partial",
                "details": [
                  {
                    "code": "abandonment_flagged",
                    "params": {
                      "days": 1260,
                      "count": 2,
                      "signals": "releases stalled, Scorecard reports it unmaintained"
                    }
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Is the project alive — is code being written and are releases shipping?"
      },
      {
        "key": "community",
        "band": "critical",
        "name": "Community & Adoption",
        "value": 12,
        "weight": 0.18,
        "metrics": [
          {
            "key": "popularity",
            "band": "critical",
            "name": "Popularity & adoption",
            "note": null,
            "notes": [],
            "value": 1,
            "inputs": {
              "forks": 0,
              "stars": 0,
              "watchers": 0,
              "growth_state": "unverified",
              "growth_factor_pct": 100,
              "growth_unverified_reason": "no_history"
            },
            "components": [
              {
                "key": "stars",
                "name": "Stars",
                "detail": "0 stars",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "stars",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 60
              },
              {
                "key": "forks",
                "name": "Forks",
                "detail": "0 forks",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "forks",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "watchers",
                "name": "Watchers",
                "detail": "0 watchers",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "watchers",
                    "params": {
                      "count": 0
                    }
                  }
                ],
                "max_points": 15
              }
            ]
          },
          {
            "key": "community_health",
            "band": "critical",
            "name": "Community health",
            "note": null,
            "notes": [],
            "value": 25,
            "inputs": {
              "has_readme": false,
              "has_license": false,
              "has_contributing": false,
              "has_issue_template": false,
              "has_code_of_conduct": false,
              "has_pull_request_template": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 22.5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "recognized license (Apache-2.0)",
                "points": 22.5,
                "status": "met",
                "details": [
                  {
                    "code": "license_standard",
                    "params": {}
                  },
                  {
                    "code": "license_spdx",
                    "params": {
                      "spdx": "Apache-2.0"
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributing_guide",
                "name": "CONTRIBUTING guide",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 18
              },
              {
                "key": "code_of_conduct",
                "name": "Code of conduct",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 13.5
              },
              {
                "key": "issue_template",
                "name": "Issue template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.2
              },
              {
                "key": "pr_template",
                "name": "PR template",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.3
              }
            ]
          }
        ],
        "description": "Does the project have users, downloads, attention, and a welcoming setup for contributors?"
      },
      {
        "key": "governance",
        "band": "at_risk",
        "name": "Sustainability & Governance",
        "value": 36,
        "weight": 0.24,
        "metrics": [
          {
            "key": "maintainer_resilience",
            "band": "at_risk",
            "name": "Maintainer resilience (bus factor)",
            "note": null,
            "notes": [],
            "value": 43,
            "inputs": {
              "bus_factor": 1,
              "contributors_sampled": 75,
              "top_contributor_share": 0.544
            },
            "components": [
              {
                "key": "bus_factor",
                "name": "Bus factor",
                "detail": "1 contributor(s) cover half of all commits",
                "points": 9,
                "status": "partial",
                "details": [
                  {
                    "code": "bus_factor",
                    "params": {
                      "count": 1
                    }
                  }
                ],
                "max_points": 54
              },
              {
                "key": "commit_distribution",
                "name": "Commit distribution",
                "detail": "top contributor authored 54% of commits",
                "points": 10.3,
                "status": "partial",
                "details": [
                  {
                    "code": "top_contributor_share",
                    "params": {
                      "share": 54
                    }
                  }
                ],
                "max_points": 22.5
              },
              {
                "key": "contributor_breadth",
                "name": "Contributor breadth",
                "detail": "75 contributors",
                "points": 13.5,
                "status": "met",
                "details": [
                  {
                    "code": "contributors_sampled",
                    "params": {
                      "count": 75
                    }
                  }
                ],
                "max_points": 13.5
              },
              {
                "key": "openssf_scorecard_contributors",
                "name": "OpenSSF Scorecard: Contributors",
                "detail": "project has 19 contributing companies or organizations",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "responsiveness",
            "band": "critical",
            "name": "Issue & PR responsiveness",
            "note": "Excluded from scoring (no data or not applicable): Issue resolution, PR acceptance. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "issue_resolution",
                    "pr_acceptance"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 1,
            "inputs": {
              "merged_prs": 0,
              "open_issues": 0,
              "closed_issues": 0,
              "issue_closed_ratio": null,
              "closed_unmerged_prs": 0
            },
            "components": [
              {
                "key": "issue_resolution",
                "name": "Issue resolution",
                "detail": "no issues or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_issues_or_data",
                    "params": {}
                  }
                ],
                "max_points": 46.75
              },
              {
                "key": "pr_acceptance",
                "name": "PR acceptance",
                "detail": "no decided pull requests or no data",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_decided_prs_or_data",
                    "params": {}
                  }
                ],
                "max_points": 38.25
              },
              {
                "key": "openssf_scorecard_code_review",
                "name": "OpenSSF Scorecard: Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              }
            ]
          },
          {
            "key": "stewardship",
            "band": "moderate",
            "name": "Ownership & stewardship",
            "note": "Excluded from scoring (no data or not applicable): Verified domain. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "verified_domain"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 62,
            "inputs": {
              "followers": 105,
              "owner_type": "User",
              "is_verified": null,
              "owner_login": "luhring",
              "public_repos": 97,
              "account_age_days": 4732
            },
            "components": [
              {
                "key": "ownership_backing",
                "name": "Ownership backing",
                "detail": "personal (user) account",
                "points": 10,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_personal",
                    "params": {}
                  }
                ],
                "max_points": 30
              },
              {
                "key": "verified_domain",
                "name": "Verified domain",
                "detail": "not applicable to user accounts",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "not_applicable_to_user_accounts",
                    "params": {}
                  }
                ],
                "max_points": 20
              },
              {
                "key": "owner_reach",
                "name": "Owner reach",
                "detail": "105 followers of luhring",
                "points": 14.6,
                "status": "partial",
                "details": [
                  {
                    "code": "owner_followers",
                    "params": {
                      "count": 105,
                      "login": "luhring"
                    }
                  }
                ],
                "max_points": 25
              },
              {
                "key": "track_record",
                "name": "Track record",
                "detail": "97 public repos, account ~12 yr old",
                "points": 25,
                "status": "met",
                "details": [
                  {
                    "code": "public_repos",
                    "params": {
                      "count": 97
                    }
                  },
                  {
                    "code": "account_age_years",
                    "params": {
                      "years": 12
                    }
                  }
                ],
                "max_points": 25
              }
            ]
          }
        ],
        "description": "Will the project survive its people — bus factor, responsiveness, who backs it, and package upkeep?"
      },
      {
        "key": "engineering",
        "band": "moderate",
        "name": "Engineering Quality",
        "value": 52,
        "weight": 0.2,
        "metrics": [
          {
            "key": "engineering_practices",
            "band": "good",
            "name": "Engineering practices",
            "note": "Excluded from scoring (no data or not applicable): OpenSSF Scorecard: CI-Tests. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "openssf_scorecard_ci_tests"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 80,
            "inputs": {
              "has_ci": true,
              "has_tests": true,
              "has_editorconfig": false,
              "has_linter_config": true,
              "has_precommit_config": false
            },
            "components": [
              {
                "key": "ci_workflows",
                "name": "CI workflows",
                "detail": "6 workflow(s)",
                "points": 24,
                "status": "met",
                "details": [
                  {
                    "code": "ci_workflows",
                    "params": {
                      "count": 6
                    }
                  }
                ],
                "max_points": 24
              },
              {
                "key": "tests_present",
                "name": "Tests present",
                "detail": null,
                "points": 24,
                "status": "met",
                "details": [],
                "max_points": 24
              },
              {
                "key": "linter_config",
                "name": "Linter config",
                "detail": ".golangci.yaml",
                "points": 16,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 16
              },
              {
                "key": "pre_commit_hooks",
                "name": "Pre-commit hooks",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 9.6
              },
              {
                "key": "editorconfig",
                "name": ".editorconfig",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 6.4
              },
              {
                "key": "openssf_scorecard_ci_tests",
                "name": "OpenSSF Scorecard: CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 20
              }
            ]
          },
          {
            "key": "documentation",
            "band": "critical",
            "name": "Documentation",
            "note": null,
            "notes": [],
            "value": 10,
            "inputs": {
              "topics": [],
              "has_wiki": true,
              "homepage": null,
              "has_readme": false,
              "has_docs_dir": false,
              "has_description": false
            },
            "components": [
              {
                "key": "readme",
                "name": "README",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 30
              },
              {
                "key": "documentation_directory",
                "name": "Documentation directory",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 25
              },
              {
                "key": "documentation_homepage_site",
                "name": "Documentation / homepage site",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "repository_description",
                "name": "Repository description",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "topics",
                "name": "Topics",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 10
              },
              {
                "key": "wiki",
                "name": "Wiki",
                "detail": null,
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              }
            ]
          }
        ],
        "description": "Are baseline engineering and documentation practices in place?"
      },
      {
        "key": "security",
        "band": "at_risk",
        "name": "Security",
        "value": 36,
        "weight": 0.16,
        "metrics": [
          {
            "key": "security_posture",
            "band": "at_risk",
            "name": "Security posture",
            "note": "Excluded from scoring (no data or not applicable): CI-Tests, Packaging, Signed-Releases. Remaining weights renormalized.",
            "notes": [
              {
                "code": "excluded_no_data",
                "params": {
                  "components": [
                    "ci_tests",
                    "packaging",
                    "signed_releases"
                  ]
                }
              },
              {
                "code": "weights_renormalized",
                "params": {}
              }
            ],
            "value": 36,
            "inputs": {
              "source": "openssf_scorecard",
              "checks_evaluated": 15,
              "scorecard_version": "v5.5.0",
              "checks_inconclusive": 3,
              "scorecard_aggregate": 3.6
            },
            "components": [
              {
                "key": "binary_artifacts",
                "name": "Binary-Artifacts",
                "detail": "binaries present in source code",
                "points": 4.5,
                "status": "partial",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "branch_protection",
                "name": "Branch-Protection",
                "detail": "branch protection not enabled on development/release branches",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "ci_tests",
                "name": "CI-Tests",
                "detail": "no pull request found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 2.5
              },
              {
                "key": "cii_best_practices",
                "name": "CII-Best-Practices",
                "detail": "no effort to earn an OpenSSF best practices badge detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "code_review",
                "name": "Code-Review",
                "detail": "Found 0/30 approved changesets -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "contributors",
                "name": "Contributors",
                "detail": "project has 19 contributing companies or organizations",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "dangerous_workflow",
                "name": "Dangerous-Workflow",
                "detail": "no dangerous workflow patterns detected",
                "points": 10,
                "status": "met",
                "details": [],
                "max_points": 10
              },
              {
                "key": "dependency_update_tool",
                "name": "Dependency-Update-Tool",
                "detail": "update tool detected",
                "points": 7.5,
                "status": "met",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "fuzzing",
                "name": "Fuzzing",
                "detail": "project is not fuzzed",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "license",
                "name": "License",
                "detail": "license file detected",
                "points": 2.5,
                "status": "met",
                "details": [],
                "max_points": 2.5
              },
              {
                "key": "maintained",
                "name": "Maintained",
                "detail": "0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "packaging",
                "name": "Packaging",
                "detail": "packaging workflow not detected",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 5
              },
              {
                "key": "pinned_dependencies",
                "name": "Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 0.5,
                "status": "partial",
                "details": [],
                "max_points": 5
              },
              {
                "key": "sast",
                "name": "SAST",
                "detail": "SAST tool detected: CodeQL",
                "points": 5,
                "status": "met",
                "details": [],
                "max_points": 5
              },
              {
                "key": "security_policy",
                "name": "Security-Policy",
                "detail": "security policy file not detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 5
              },
              {
                "key": "signed_releases",
                "name": "Signed-Releases",
                "detail": "no releases found",
                "points": 0,
                "status": "excluded",
                "details": [
                  {
                    "code": "no_data",
                    "params": {}
                  }
                ],
                "max_points": 7.5
              },
              {
                "key": "token_permissions",
                "name": "Token-Permissions",
                "detail": "detected GitHub workflow tokens with excessive permissions",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              },
              {
                "key": "vulnerabilities",
                "name": "Vulnerabilities",
                "detail": "237 existing vulnerabilities detected",
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 7.5
              }
            ]
          },
          {
            "key": "high_risk_jurisdiction_exposure",
            "band": "excellent",
            "name": "High-Risk Jurisdiction Exposure",
            "note": "Only high-confidence self-published location evidence affects this multiplier. Ambiguous matches are review-only; country evidence is not proof of nationality, citizenship, legal registration, malicious intent, or sanctions status.",
            "notes": [
              {
                "code": "jurisdiction_evidence_limits",
                "params": {}
              }
            ],
            "value": 100,
            "inputs": {
              "meaning": "self-published location evidence; not nationality or citizenship",
              "red_flag": false,
              "exposures": [],
              "policy_countries": [
                "Russia",
                "Iran",
                "North Korea"
              ],
              "review_only_matches": 0,
              "assessed_self_published_locations": 12
            },
            "components": [
              {
                "key": "policy_exposure_multiplier",
                "name": "Policy exposure multiplier",
                "detail": "no confirmed policy-scope location match",
                "points": 100,
                "status": "met",
                "details": [
                  {
                    "code": "jurisdiction_no_match",
                    "params": {}
                  }
                ],
                "max_points": 100
              }
            ]
          }
        ],
        "description": "Are visible security and supply-chain practices strong, with no malicious dependency and no unresolved high-risk jurisdiction exposure?"
      },
      {
        "key": "ai_readiness",
        "band": "moderate",
        "name": "AI Readiness",
        "value": 65,
        "weight": 0,
        "metrics": [
          {
            "key": "ai_agent_context",
            "band": "at_risk",
            "name": "Agent context & guidance",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "has_llms_txt": false,
              "legible_history_share": 1,
              "agent_instruction_files": [],
              "agent_instruction_max_bytes": null
            },
            "components": [
              {
                "key": "agent_instructions",
                "name": "Agent instructions",
                "detail": "no CLAUDE.md / AGENTS.md / editor rules",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_instructions",
                    "params": {}
                  }
                ],
                "max_points": 45
              },
              {
                "key": "machine_readable_docs_llms_txt",
                "name": "Machine-readable docs (llms.txt)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 15
              },
              {
                "key": "legible_commit_history",
                "name": "Legible commit history",
                "detail": "65 of 65 human commits state their intent (structured subject or explanatory body)",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "legible_history",
                    "params": {
                      "legible": 65,
                      "sampled": 65
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          },
          {
            "key": "ai_verify_loop",
            "band": "good",
            "name": "Verify loop (build / test / typecheck)",
            "note": null,
            "notes": [],
            "value": 81,
            "inputs": {
              "has_nix": false,
              "has_tests": true,
              "lockfiles": [
                "Cargo.lock",
                "Gemfile.lock",
                "Pipfile.lock",
                "composer.lock",
                "go.sum",
                "mix.lock",
                "package-lock.json",
                "pnpm-lock.yaml",
                "poetry.lock",
                "yarn.lock"
              ],
              "has_dockerfile": true,
              "typed_language": true,
              "bootstrap_files": [
                "Makefile",
                "schema/cyclonedx/Makefile",
                "syft/pkg/cataloger/golang/test-fixtures/archs/Makefile",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile",
                "syft/pkg/cataloger/rpm/test-fixtures/Makefile",
                "test/cli/test-fixtures/Makefile",
                "test/cli/test-fixtures/image-java-spdx-tools/Makefile",
                "test/cli/test-fixtures/registry/Makefile",
                "test/install/Makefile",
                "test/integration/test-fixtures/Makefile"
              ],
              "has_devcontainer": false,
              "has_linter_config": true,
              "typecheck_configs": [],
              "agent_commit_share": 0,
              "toolchain_manifests": [
                "go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/archs/src/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/glob-paths/src/go.mod",
                "syft/pkg/cataloger/golang/test-fixtures/go-sum-hashes/go.mod",
                "syft/pkg/cataloger/java/test-fixtures/glob-paths/src/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/build.gradle",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-java-app/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-jenkins-plugin/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/java-builds/example-sb-app/pom.xml",
                "syft/pkg/cataloger/java/test-fixtures/pom/pom.xml",
                "test/integration/test-fixtures/image-go-bin-arch-coverage/go.mod",
                "test/integration/test-fixtures/image-pkg-coverage/pkgs/go/go.mod",
                "test/integration/test-fixtures/image-pkg-coverage/pkgs/java/pom.xml",
                "test/integration/test-fixtures/image-sbom-cataloger/go.mod"
              ],
              "dependency_bot_commit_share": 0.26
            },
            "components": [
              {
                "key": "one_command_bootstrap",
                "name": "One-command bootstrap",
                "detail": "Makefile, schema/cyclonedx/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/rpm/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile, test/integration/test-fixtures/Makefile",
                "points": 18,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Makefile, schema/cyclonedx/Makefile, syft/pkg/cataloger/golang/test-fixtures/archs/Makefile, syft/pkg/cataloger/java/test-fixtures/java-builds/Makefile, syft/pkg/cataloger/rpm/test-fixtures/Makefile, test/cli/test-fixtures/Makefile, test/cli/test-fixtures/image-java-spdx-tools/Makefile, test/cli/test-fixtures/registry/Makefile, test/install/Makefile, test/integration/test-fixtures/Makefile"
                    }
                  }
                ],
                "max_points": 18
              },
              {
                "key": "automated_tests",
                "name": "Automated tests",
                "detail": null,
                "points": 22,
                "status": "met",
                "details": [],
                "max_points": 22
              },
              {
                "key": "lint_format_config",
                "name": "Lint / format config",
                "detail": ".golangci.yaml",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": ".golangci.yaml"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "static_type_checking",
                "name": "Static type checking",
                "detail": "Go (statically typed)",
                "points": 11,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 11
              },
              {
                "key": "reproducible_environment",
                "name": "Reproducible environment",
                "detail": "Dockerfile, lockfile",
                "points": 10,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "Dockerfile, lockfile"
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "demonstrated_agent_practice",
                "name": "Demonstrated agent practice",
                "detail": "no agent-authored commits among the last 100",
                "points": 0,
                "status": "missed",
                "details": [
                  {
                    "code": "no_agent_authored_commits",
                    "params": {
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 10
              },
              {
                "key": "automated_maintenance",
                "name": "Automated maintenance",
                "detail": "26 of the last 100 commits are automated dependency updates",
                "points": 8,
                "status": "met",
                "details": [
                  {
                    "code": "dependency_bot_commits",
                    "params": {
                      "count": 26,
                      "sampled": 100
                    }
                  }
                ],
                "max_points": 8
              },
              {
                "key": "openssf_scorecard_pinned_dependencies",
                "name": "OpenSSF Scorecard: Pinned-Dependencies",
                "detail": "dependency not pinned by hash detected -- score normalized to 1",
                "points": 1,
                "status": "partial",
                "details": [],
                "max_points": 10
              }
            ]
          },
          {
            "key": "ai_code_legibility",
            "band": "excellent",
            "name": "Code legibility for models",
            "note": null,
            "notes": [],
            "value": 100,
            "inputs": {
              "primary_language": "Go",
              "largest_source_bytes": 69935,
              "source_files_sampled": 563,
              "oversized_source_files": 2
            },
            "components": [
              {
                "key": "type_checkable_code",
                "name": "Type-checkable code",
                "detail": "Go (statically typed)",
                "points": 45,
                "status": "met",
                "details": [
                  {
                    "code": "statically_typed_language",
                    "params": {
                      "language": "Go"
                    }
                  }
                ],
                "max_points": 45
              },
              {
                "key": "manageable_file_sizes",
                "name": "Manageable file sizes",
                "detail": "2/563 source files over 60KB",
                "points": 54.8,
                "status": "partial",
                "details": [
                  {
                    "code": "oversized_source_files",
                    "params": {
                      "kb": 60,
                      "sampled": 563,
                      "oversized": 2
                    }
                  }
                ],
                "max_points": 55
              }
            ]
          },
          {
            "key": "ai_interfaces",
            "band": "at_risk",
            "name": "Machine-readable interfaces",
            "note": null,
            "notes": [],
            "value": 40,
            "inputs": {
              "example_dirs": [
                "example",
                "sample"
              ],
              "has_mcp_signal": false,
              "api_schema_files": []
            },
            "components": [
              {
                "key": "api_schema_openapi_graphql_proto",
                "name": "API schema (OpenAPI/GraphQL/proto)",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 40
              },
              {
                "key": "mcp_server",
                "name": "MCP server",
                "detail": null,
                "points": 0,
                "status": "missed",
                "details": [],
                "max_points": 20
              },
              {
                "key": "runnable_examples",
                "name": "Runnable examples",
                "detail": "example, sample",
                "points": 40,
                "status": "met",
                "details": [
                  {
                    "code": "file_list",
                    "params": {
                      "files": "example, sample"
                    }
                  }
                ],
                "max_points": 40
              }
            ]
          }
        ],
        "description": "How well is the repo equipped to be developed and maintained with AI coding agents? An independent, experimental badge — weight 0.0, so it is surfaced on its own and does not affect the overall health score."
      }
    ],
    "metrics_version": "1.13.0"
  },
  "warnings": [
    "Community profile unavailable",
    "go package 'github.com/anchore/syft' points at a different repository (https://github.com/anchore/syft); excluded from ecosystem scoring"
  ],
  "report_type": "repository",
  "generated_at": "2026-07-25T10:19:17.402061Z",
  "schema_version": "0.27.0",
  "badge_url": "https://raw.githubusercontent.com/inspect-software/badges/main/v1/l/luhring/syft.svg",
  "full_name": "luhring/syft",
  "license_state": "standard",
  "license_spdx": "Apache-2.0"
}